Accreditation of auditors and audit firms and duty of cooperation of accredited statutory auditors

NBB_2024_12 - 16 July 2024 Circular - Page 1/53 14 Boulevard de Berlaimont - 1000 Brussels +32 2 221 38 12 Company number: 0203.201.340 Brussels RLE www.nbb.be Circular Brussels, 16 July 2024 Reference: NBB_2024_12 Your correspondents:
Michel Colinet / Claude Louckx
+32 2 221 37 17 / 49 63 michel.colinet@nbb.be / claude.louckx@nbb.be Accreditation of auditors and audit firms and duty of cooperation of accredited statutory auditors Scope of application Accredited auditors and accredited audit firms with a view to performance of their duty of cooperation for the following types of financial institutions:

credit institutions governed by Belgian law;
stockbroking firms governed by Belgian law;
payment institutions governed by Belgian law;
payment institutions of limited size governed by Belgian law;
electronic money institutions governed by Belgian law
electronic money institutions of limited size governed by Belgian law;
central securities depositories, institutions providing support to central securities depositories and
custodian banks governed by Belgian law;
branches established in Belgium of credit institutions and stockbroking firms governed by the law of
another European Economic Area (EEA) country;
branches established in Belgium of credit institutions and stockbroking firms governed by the law of
a non-EEA country;
central securities depositories, institutions providing support to central securities depositories and
custodian banks established in Belgium as branches of foreign institutions;
authorised and designated financial holding companies and mixed financial holding companies
governed by Belgian law;
investment holding companies and mixed financial holding companies governed by Belgian law
included in the scope of supervision on a consolidated basis or review of the capitalisation test of a group of investment firms carried out by the National Bank of Belgium;
insurance or reinsurance companies governed by Belgian law;
branches established in Belgium of insurance or reinsurance companies governed by the law of a
non-EEA country; n1 BanqueNationaleBank DE BELGIQUE VAN BELGIE Eurosystem

Circular - Page 2/53 NBB_2024_12 - 16 July 2024

entities 1
responsible for an insurance or reinsurance group, within the meaning of Articles 339(2) and 343, paragraph 2(1) and (2) of the Act of 13 March 2016 on the legal status and supervision of insurance and reinsurance companies, for which the National Bank of Belgium has been designated the group supervisor within the meaning of Articles 407 and 408 of the aforementioned legislation. SUMMARY / OBJECTIVES This circular describes the prudential expectations for accredited auditors and accredited audit firms in the following areas:
the grant, renewal and withdrawal of accreditation and appointment to perform and resignation
from an engagement (mandat/mandaat) as accredited statutory auditor;
general prudential expectations regarding (i) ongoing compliance with the accreditation
requirements, including appropriate internal organisation, and (ii) general principles to ensure high-quality cooperation in the context of prudential supervision. This circular also describes the supervisory authority’s prudential expectations of accredited auditors in the performance of an engagement as accredited statutory auditor with regard to the following aspects:
auditor’s reports common to financial institutions and communications with the supervisory
authority covering: (i) the audit plan and pre-audit information, (ii) reports at the end of the first half of the financial year and at the end of the financial year, (iii) the precedence and content of the comprehensive report which constitutes the central report of the accredited statutory auditor’s duty of cooperation, (iv) the report on the assessment of internal control, (v) the annual statement by the accredited statutory auditor on special mechanisms, and (vi) special reports;
the exchange of information and interaction between the supervisory authority and accredited
statutory auditors, including the auditor’s early warning function;
prudential expectations and specific reports and the legislative and regulatory references per
sector of activity for financial institutions; and
the deadlines for the submission of reports by accredited auditors to the supervisory authority.
TABLE OF CONTENTS

DEFINITIONS.................................................................................................................. 6
PRUDENTIAL EXPECTATIONS FOR ACCREDITED AUDITORS ................................................ 9
2.1. GRANT OF ACCREDITATION - RENEWAL OF ACCREDITATION - OVERSIGHT AND WITHDRAWAL
OF ACCREDITATION - APPOINTMENT TO PERFORM AN AUDIT ENGAGEMENT - RESIGNATION
FROM AN AUDIT ENGAGEMENT......................................................................................... 9
2.1.1. GRANT OF ACCREDITATION............................................................................................. 9
2.1.2. RENEWAL OF ACCREDITATION....................................................................................... 10
2.1.3. OVERSIGHT AND WITHDRAWAL OF ACCREDITATION ........................................................ 10
2.1.4. APPOINTMENT TO PERFORM AN AUDIT ENGAGEMENT...................................................... 11
2.1.5. Resignation from an audit engagement .................................................................... 11
2.2. GENERAL PRUDENTIAL EXPECTATIONS .......................................................................... 12
2.2.1. ONGOING COMPLIANCE WITH THE ACCREDITATION REQUIREMENTS................................. 12
2.2.1.1. In-depth knowledge of the nature and technical aspects of operations specific to
financial institutions and the system of public supervision - Continuing education... 12 1 More specifically (i) insurance companies or reinsurance companies governed by Belgian law that hold a stake in at least one insurance or reinsurance company in the EEA or a third country, (ii) insurance or reinsurance companies whose parent company is a mixed holding company or a mixed financial holding company established in the EEA or in a third country, and (iii) insurance holding companies or mixed financial holding companies governed by Belgian law that are the parent company of an insurance or reinsurance company governed by Belgian law.

NBB_2024_12 - 16 July 2024 Circular - Page 3/53
2.2.1.2. Expectations in terms of independence, competency, professional scepticism and
professional judgment ............................................................................................... 12
2.2.1.3. Organisational aspects of accredited auditors and/or accredited audit firms............ 13
2.2.2. GENERAL PRINCIPLES TO ENSURE HIGH-QUALITY COOPERATION..................................... 16
2.3. AUDITOR’S REPORTS COMMON TO ALL FINANCIAL INSTITUTIONS...................................... 17
2.3.1. WRITTEN REPORTS FOR THE ATTENTION OF THE SUPERVISORY AUTHORITY..................... 17
2.3.1.1. REVIEW OF PERIODIC PRUDENTIAL RETURNS AT THE END OF THE FIRST HALF OF THE
FINANCIAL YEAR ........................................................................................................... 20
2.3.1.2. ANNUAL REPORTS AT THE END OF THE FINANCIAL YEAR.................................................. 21
2.3.1.2.1. COMPREHENSIVE REPORT............................................................................................ 21
2.3.1.2.2. AUDIT REPORT ON PERIODIC PRUDENTIAL RETURNS AT THE END OF THE FINANCIAL YEAR. 23
2.3.1.2.3. INTERNAL CONTROL ..................................................................................................... 24
2.3.1.2.4. ANNUAL STATEMENT BY THE ACCREDITED STATUTORY AUDITOR/ACCREDITED AUDITOR ON
SPECIAL MECHANISMS .................................................................................................. 29
2.3.1.3. SPECIAL REPORTS ....................................................................................................... 29
2.3.1.4. OTHER DOCUMENTS TO BE SUBMITTED TO THE SUPERVISORY AUTHORITY....................... 30
2.3.1.5. NBB SUPERVISION PORTAL.......................................................................................... 30
2.4. INTERACTION BETWEEN THE SUPERVISORY AUTHORITY AND ACCREDITED STATUTORY
AUDITORS.................................................................................................................... 30
2.4.1. EARLY WARNING FUNCTION .......................................................................................... 31
2.4.2. COMMUNICATIONS MADE ON THE SUPERVISORY AUTHORITY’S INITIATIVE TO ACCREDITED
STATUTORY AUDITORS ................................................................................................. 33
2.4.3. OTHER PERIODIC EXCHANGES AND CONSULTATIONS...................................................... 34
3. SPECIFIC EXPECTATIONS BY SECTOR OF ACTIVITY.......................................................... 35
3.1. CREDIT INSTITUTIONS................................................................................................... 35
3.1.1. AUDITOR’S REPORTS ON PERIODIC PRUDENTIAL RETURNS.............................................. 35
3.1.2. AUDITOR’S REPORTS ON THE ASSESSMENT OF INTERNAL CONTROL AND OF INTERNAL
CONTROLS RELATING TO INVESTMENT SERVICES AND ACTIVITIES .................................... 38
3.1.2.1. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROL .................................. 38
3.1.2.2. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROLS RELATING TO
INVESTMENT SERVICES AND ACTIVITIES ......................................................................... 38
3.2. STOCKBROKING FIRMS ................................................................................................. 39
3.2.1. AUDITOR’S REPORTS ON PERIODIC PRUDENTIAL RETURNS.............................................. 39
3.2.2. AUDITOR’S REPORTS ON THE ASSESSMENT OF INTERNAL CONTROL AND OF INTERNAL
CONTROLS RELATING TO INVESTMENT SERVICES AND ACTIVITIES .................................... 41
3.2.2.1. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROL .................................. 41
3.2.2.2. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROLS RELATING TO
INVESTMENT SERVICES AND ACTIVITIES ......................................................................... 41
3.3. PAYMENT INSTITUTIONS ............................................................................................... 41
3.3.1. AUDITOR’S REPORTS ON PERIODIC PRUDENTIAL RETURNS.............................................. 41
3.3.2. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROL AND OTHER REPORTS ON
INTERNAL ORGANISATION ............................................................................................. 42
3.3.2.1. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROL .................................. 42
3.3.2.2. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROLS ADOPTED TO
SAFEGUARD FUNDS RECEIVED FROM USERS OF PAYMENT SERVICES AND FROM HOLDERS OF
ELECTRONIC MONEY..................................................................................................... 42
3.3.2.3. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROLS ADOPTED WHEN THE
INSTITUTION RELIES ON OUTSOURCING.......................................................................... 43
3.4. ELECTRONIC MONEY INSTITUTIONS ............................................................................... 44
3.4.1. AUDITOR’S REPORTS ON PERIODIC PRUDENTIAL RETURNS.............................................. 44
3.4.2. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROL AND OTHER REPORTS ON
INTERNAL ORGANISATION ............................................................................................. 44
3.4.2.1. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROL OVER FINANCIAL
REPORTING.................................................................................................................. 44

Circular - Page 4/53 NBB_2024_12 - 16 July 2024
3.4.2.2. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROLS ADOPTED TO
SAFEGUARD FUNDS RECEIVED FROM USERS OF PAYMENT SERVICES AND FROM HOLDERS OF
ELECTRONIC MONEY..................................................................................................... 45
3.4.2.3. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROLS ADOPTED WHEN THE
INSTITUTION RELIES ON OUTSOURCING.......................................................................... 45
3.5. CENTRAL SECURITIES DEPOSITORIES, INSTITUTIONS PROVIDING SUPPORT TO CENTRAL
SECURITIES DEPOSITORIES AND CUSTODIAN BANKS ....................................................... 45
3.5.1. AUDITOR’S REPORTS ON PERIODIC PRUDENTIAL RETURNS.............................................. 45
3.5.2. AUDITOR’S REPORTS ON THE ASSESSMENT OF INTERNAL CONTROL AND OF INTERNAL
CONTROLS RELATING TO INVESTMENT SERVICES AND ACTIVITIES .................................... 45
3.5.2.1. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROL .................................. 45
3.5.2.2. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROLS RELATING TO
INVESTMENT SERVICES AND ACTIVITIES ......................................................................... 45
3.6. AUTHORISED AND DESIGNATED FINANCIAL HOLDING COMPANIES GOVERNED BY BELGIAN
LAW............................................................................................................................. 46
3.6.1. AUDITOR’S REPORTS ON PERIODIC PRUDENTIAL RETURNS.............................................. 46
3.6.2. AUDITOR’S REPORTS ON THE ASSESSMENT OF INTERNAL CONTROL AND OF INTERNAL
CONTROLS RELATING TO INVESTMENT SERVICES AND ACTIVITIES .................................... 46
3.6.2.1. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROL .................................. 46
3.6.2.2. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROLS RELATING TO
INVESTMENT SERVICES AND ACTIVITIES ......................................................................... 46
3.7. AUTHORISED AND DESIGNATED MIXED FINANCIAL HOLDING COMPANIES GOVERNED BY
BELGIAN LAW............................................................................................................... 46
3.7.1. AUDITOR’S REPORTS ON PERIODIC PRUDENTIAL RETURNS.............................................. 46
3.7.2. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROL .................................. 47
3.8. FINANCIAL HOLDING COMPANIES AND MIXED FINANCIAL HOLDING COMPANIES GOVERNED BY
FOREIGN LAW............................................................................................................... 47
3.9. INVESTMENT HOLDING COMPANIES AND MIXED FINANCIAL COMPANIES GOVERNED BY
BELGIAN LAW INCLUDED WITHIN THE SCOPE OF SUPERVISION ON A CONSOLIDATED BASIS OR REVIEW OF THE CAPITALISATION TEST OF A GROUP OF INVESTMENT FIRMS CARRIED OUT BY
THE NATIONAL BANK OF BELGIUM................................................................................. 48
3.10. INSURANCE AND REINSURANCE COMPANIES................................................................... 48
3.10.1. AUDITOR’S REPORTS ON PERIODIC PRUDENTIAL RETURNS.............................................. 48
3.10.2. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROL .................................. 50
3.11. BELGIAN INSURANCE AND REINSURANCE GROUPS.......................................................... 50
3.11.1. POINTS FOR ATTENTION WHEN ASSESSING GROUP SOLVENCY ........................................ 51
3.11.2. AUDITOR’S REPORT ON GROUP PERIODIC PRUDENTIAL RETURNS .................................... 51
3.11.3. AUDITOR’S REPORT ON THE ASSESSMENT OF THE GROUP GOVERNANCE SYSTEM ............ 51
4. REPORTING TO THE SUPERVISORY AUTHORITY .............................................................. 52
4.1. DEADLINES FOR THE SUBMISSION OF AUDITOR’S REPORTS ON PERIODIC PRUDENTIAL
RETURNS..................................................................................................................... 52

NBB_2024_12 - 16 July 2024 Circular - Page 5/53 Dear Sir or Madam, Given the societal importance of financial institutions in the economic and financial landscape, the legislature wished to further strengthen the prudential supervisory role of the accredited statutory auditors of such institutions compared with non-financial corporations. To this end, the legislature decided that the status of statutory auditor for a financial institution, as defined by the scope of this circular, may not be granted to just any auditor. For such institutions, it is provided that a statutory audit engagement may only be entrusted to auditors, whether they be natural or legal persons, accredited to this end by the National Bank of Belgium. The legislature subsequently decreed that accredited auditors appointed to serve as statutory auditor of a financial institution are obliged, under their own responsibility, to cooperate with the supervisory authority in the conduct of prudential supervision by the latter. This obligation implies that they must carry out certain tasks intended to support the supervision of financial institutions by the supervisory authority (“duties under public law”). This support is without prejudice to the customary tasks entrusted to statutory auditors by company law in relation to the audit of annual financial statements (“duties under private law”). This circular clarifies the prudential expectations applicable to accredited auditors and accredited audit firms. It covers the grant, renewal, and withdrawal of accreditation by the National Bank of Belgium, as well as ongoing compliance with the accreditation requirements. It also addresses various aspects of accredited statutory auditors’ duty of cooperation in the context of prudential supervision of financial institutions falling within the scope of this circular. Unless stated otherwise herein, this circular repeals and replaces, effective 31 December 2024, Circular NBB_2017_20 of 9 June 2017 on the duty of cooperation of accredited statutory auditors.

Circular - Page 6/53 NBB_2024_12 - 16 July 2024

DEFINITIONS
For purposes of this circular, the following definitions shall apply:

“Banking Act”: the Act of 25 April 2014 on the legal status and supervision of credit institutions;
“Brokerage Supervision Act”: the Act of 20 July 2022 on the legal status and supervision of
stockbroking firms and laying down various other provisions;
“Insurance Supervision Act”: the Act of 13 March 2016 on the supervision of insurance
companies, also referred to as the “Solvency II Act”;
“Act of 11 March 2018”: the Act of 11 March 2018 on the legal status and supervision of
payment institutions and electronic money institutions and access to the business of payment service provider, to the activity of issuing electronic money and to payment systems;
“Royal Decree of 26 September 2005”: the Royal Decree of 26 September 2005 on the legal
status of settlement institutions and institutions treated as settlement institutions, now known as central securities depositories, institutions providing support to central securities depositories and custodian banks governed by Belgian law;
“Supervisory laws”: the aforementioned laws and royal decrees;
“Act of 7 December 2016”: the Act of 7 December 2016 on the organisation of the profession
of auditor and public supervision of auditors;
“Accreditation Regulation”: the Regulation of the National Bank of Belgium of
21 December 2012 on the accreditation of auditors and audit firms, as amended by the Regulation of the National Bank of Belgium of 2 May 2019;
“Bank” or “NBB”: the National Bank of Belgium;
“supervisory authority”: the National Bank of Belgium or, as regards credit institutions,
authorised and designated financial holding companies, authorised and designated mixed financial holding companies, investment holding companies and mixed financial holding companies included in the scope of supervision on a consolidated basis or review of the capitalisation test of a group of investment firms carried out by the National Bank of Belgium or the European Central Bank, the authority determined in accordance with the allocation of responsibilities laid down in Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions;
“accredited auditor”: a natural person, within the meaning of Article 3(1) of the Act of
7 December 2016 on the organisation of the profession of auditor and public supervision of auditors, and/or an audit firm, within the meaning of Article 3(2) of the Act of 7 December 2016, (represented by a natural person) that has obtained the necessary approvals from the Bank pursuant to the Regulation of the National Bank of Belgium of 21 December 2012 on the accreditation of auditors and audit firms;
“ISA & ISRE”: International Standards on Auditing (reasonable assurance) & International
Standards on Review Engagements (limited assurance);
“CCA”: Code of Companies and Associations;
“accredited statutory auditor”: an accredited auditor

NBB_2024_12 - 16 July 2024 Circular - Page 7/53 ✓ appointed, pursuant to the Code of Companies and Associations, as statutory auditor of a credit institution, a stockbroking firm, a central securities depositary, an institution providing support to central securities depositories, a custodian bank (governed by Belgian law), a payment institution or payment institution of limited size, an electronic money institution or electronic money institution of limited size, an authorised or designated financial holding company, an authorised or designated mixed financial holding company, an investment holding company or a mixed financial holding company included in the scope of supervision on a consolidated basis or review of the capitalisation test of a group of investment firms carried out by the National Bank of Belgium, an insurance or reinsurance company governed by Belgian law, an entity responsible for an insurance or reinsurance group (as defined in the scope of this circular); ✓ appointed, pursuant to the second paragraph of Article 220 of the Banking Act, as statutory auditor of a credit institution governed by Belgian law which, under the CCA, is not required to appoint a statutory auditor; ✓ appointed, under the Banking Act, as auditor of a Belgian branch of a credit institution governed by the law of another EEA country (Article 326 §1, subparagraph 1, of the Banking Act) or by the law of a non-EEA country (Article 338, paragraph 1, of the Banking Act); ✓ appointed, pursuant to the second paragraph of Article 194 of the Brokerage Supervision Act, as statutory auditor of a stockbroking firm governed by Belgian law which, under the Code of Companies and Associations, is not required to appoint a statutory auditor; ✓ appointed, pursuant to the Brokerage Supervision Act, as auditor of a Belgian branch of a stockbroking firm governed by the law of another EEA country (Article 221 of the Brokerage Supervision Act), provided the firm is authorised to receive client funds and/or financial instruments in Belgium, or by the law of a third country (Article 231 of the Brokerage Supervision Act); ✓ appointed, pursuant to Articles 26 and 36 of the Royal Decree of 26 September 2005, as statutory auditor of a central securities depository, organisation providing support to central securities depositories or custodian bank governed by Belgian law; ✓ appointed, pursuant to Article 110 of the Act of 11 March 2018, as statutory auditor of a payment institution governed by Belgian law or a payment institution of limited size governed by Belgian law; ✓ appointed, pursuant to Article 213 of the Act of 11 March 2018, as statutory auditor of an electronic money institution governed by Belgian law or an electronic money institution of limited size governed by Belgian law; ✓ appointed, pursuant to Article 210 of the Banking Act, as statutory auditor of a financial holding company or mixed financial holding company governed by Belgian law; ✓ appointed, pursuant to
Article 325 §1, second subparagraph, of the Insurance Supervision Act, as statutory auditor of an insurance or reinsurance company governed by Belgian law which, under the CCA, is not required to appoint a statutory auditor; ✓ appointed, pursuant to Article 430 of the Insurance Supervision Act, as statutory auditor of an insurance or reinsurance company subject to supervision at group level in accordance with Article 343 of the same legislation; ✓ appointed, pursuant to Article 431 of the Insurance Supervision Act, as statutory auditor of an insurance holding company or a mixed financial holding company governed by Belgian law included in the scope of supervision at group level performed by the National Bank of Belgium.

Circular - Page 8/53 NBB_2024_12 - 16 July 2024

“financial institution”: any institution mentioned in the scope of application set out in the
introduction to this circular;
“periodic prudential returns: all prudential reporting, specific to each type of financial institution
referred to in the various supervisory laws and/or the instructions issued by the supervisory authority, which must be subjected to a review at the end of the first half of the financial year and an audit at the close of the financial year in accordance with international standards on auditing (ISRE and ISA) and the supervisory authority’s instructions applicable to the review/audit of periodic prudential returns, by the accredited statutory auditor, with a report to the supervisory authority and which is used by the latter in the performance of its supervisory and prudential supervisory tasks. Annex 3 to this circular contains a list of periodic prudential returns for the various types of undertakings subject to supervision by the supervisory authority;
“branch”: a branch established in Belgium of a credit institution or stockbroking firm governed by
the law of a foreign country, or a foreign branch of a financial institution governed by Belgian law;
“European branch”: a branch established in Belgium of a credit institution or stockbroking firm
governed by the law of another European Economic Area (EEA) country;
“non-European branch”: a branch established in Belgium of a credit institution or stockbroking
firm governed by the law of a non-EEA country;
“management body”: in this circular, the term “management body” is used to refer to the
management committee or, in the absence of such a committee, senior management;
“statutory governing body”: in this circular, this term refers to the corporate organs that perform
the functions of the board of directors;
“IBR-IRE”: Instituut van de Bedrijfsrevisoren/Institut des Réviseurs d'Entreprises, a professional
association with legal personality;
“IREFI-IRAIF”: Instituut van de Revisoren Erkend voor de Financiële Instellingen/Institut des
Réviseurs Agréés pour les Institutions Financières, a non-profit association recognised as a professional association.

NBB_2024_12 - 16 July 2024 Circular - Page 9/53
2. PRUDENTIAL EXPECTATIONS FOR ACCREDITED AUDITORS
INTRODUCTION
This section lays out the Bank’s prudential expectations of accredited auditors (natural persons) and/or accredited audit firms, as regards accreditation and the performance of their specific duty to cooperate with the supervisory authority in prudential matters, in their capacity as an accredited statutory auditor. Accredited auditors and accredited audit firms are expected to meet at all times the accreditation requirements laid down in the Bank’s Accreditation Regulation, regardless of whether they have been appointed as accredited statutory auditor for one or more of the financial institutions referred to in this regulation. Compliance with these expectations is a factor taken into consideration by the Bank when renewing an accreditation (Article 6 of the Accreditation Regulation) and when granting prior approval for each new audit engagement (Article 18 of the Accreditation Regulation).
2.1. GRANT OF ACCREDITATION - RENEWAL OF ACCREDITATION - OVERSIGHT AND WITHDRAWAL OF
ACCREDITATION - APPOINTMENT TO PERFORM AN AUDIT ENGAGEMENT - RESIGNATION FROM AN AUDIT ENGAGEMENT
2.1.1. GRANT OF ACCREDITATION

Accreditation procedure
The Accreditation Regulation specifies the conditions auditors must meet in order to be accredited by the Bank for a period of six years for the purpose of carrying out an audit engagement for financial institutions covered by the Accreditation Regulation and this circular. The Accreditation Regulation also sets out the procedure followed by the Bank when examining applications for accreditation specific to each type of financial institution falling within its scope of application.
Updating of the accreditation file and ongoing compliance with the accreditation requirements
The accreditation requirements set out in the Accreditation Regulation must be complied with at all times (Article 2, second paragraph; Article 3, second paragraph; Article 3/1, second paragraph;
Article 12, second paragraph; Article 13, second paragraph; and Article 13/1, second paragraph of the
Accreditation Regulation).
Pursuant to Articles 5 and 14 of the Accreditation Regulation, accredited auditors and accredited audit firms shall provide the Bank without delay with all information needed to update their accreditation file, so as to enable the Bank to verify at all times that the accreditation requirements set out in the Accreditation Regulation are met. Any change that has an impact on the accreditation requirements must, to this end, be notified to the supervisory authority without delay. Such changes include, but are not limited to, the following: (i) change of audit firm by an auditor, (ii) change in the organisation or name of an accredited audit firm, (iii) temporary or permanent ban on the performance of audit activities, (iv) change in the number of accredited audit partners of an accredited audit firm (there must be at least two per sector of supervised activity - Articles 12, 13 and 13/1 of the Accreditation Regulation), and (v) resignation from an engagement as accredited statutory auditor. Each year, accredited audit firms must also submit to the Bank a summary, referred to as a “summary sheet” or “annual report”. In addition to general information on the organisation of the audit firm, this document shall include in particular (i) a description and assessment of the procedures and internal controls introduced by the accredited audit firm for the performance of engagements as an accredited

Circular - Page 10/53 NBB_2024_12 - 16 July 2024 statutory auditor and fulfilment of the duty of cooperation, (ii) the training programme put in place by the firm to provide the audit-related and prudential knowledge and experience necessary when acting as accredited statutory auditor for financial institutions subject to supervision by the Bank and ensure fulfilment of the duty of cooperation with prudential supervision, (iii) the definition, interpretation and results of the “coperation quality indicators” (see below), (iv) any other information useful for the Bank’s understanding of quality and organisational aspects, in accordance with the Accreditation Regulation, to ensure ongoing compliance with the accreditation requirements and compliance with the prudential expectations described in this circular (see section 2.2 below). The summary sheet is the channel through which additional information, as described below, is transmitted to the supervisory authority on an annual basis. The sheet must be submitted by accredited audit firms by 30 September of each year (reflecting the situation as of 30 June). The first such sheet is due on 30 September 2025. With regard to the maintenance of accreditation for insurance and reinsurance companies, accredited auditors shall inform the Bank of any engagements as accredited statutory auditor which they perform for mutual insurance funds (MIF) in the framework of their cooperation with the Office for the Oversight of Mutual Health Insurance Funds. This information shall include the start and end dates of the audit engagement(s) and any modifications made thereto. Mutual insurance funds covered by the Act of 6 August 1990 are insurance companies within the meaning of the Insurance Supervision Act. The Bank takes into account engagements as accredited statutory auditor for such funds when verifying compliance with the accreditation requirements. The aforementioned information must be submitted in writing to supolaudit@nbb.be. Accredited auditors are requested to inform the Bank prior to the occurrence of any substantial change. Based on this information, the Bank publishes a list of accredited auditors pursuant to Article 7 of the Accreditation Regulation and a list of accredited audit firms pursuant to Article 15 of the Accreditation Regulation. The latter list includes the names of the accredited auditors who are members of each firm.
2.1.2. RENEWAL OF ACCREDITATION
For information on the form and content of the application for renewal of accreditation, reference is made to Communication NBB_2018_26 of 21 September 2018 on the renewal of auditor accreditation. An application to renew the accreditation of an accredited auditor who is a natural person must be submitted no earlier than six months and no later than three months prior to expiry of the accreditation (Article 6, third paragraph, of the Accreditation Regulation). It is essential that the accredited auditor comply strictly with these deadlines as well as with the terms and conditions relating to the content of the application for renewal. Failure to do so may result in non-renewal of the accreditation and the termination thereof by operation of law at the end of the current six-year term (Article 8(3) of the Accreditation Regulation). Compliance with these deadlines is the responsibility of accredited auditors.
2.1.3. OVERSIGHT AND WITHDRAWAL OF ACCREDITATION
The Bank considers continual compliance with the accreditation requirements by accredited auditors (and audit firms) and the degree to which an accredited statutory auditor meets the prudential expectations described in this circular and in the Accreditation Regulation when monitoring the quality of an accredited statutory auditor’s cooperation with prudential supervision. This assessment plays a role not only in decisions to renew an accreditation but also to grant approval for the exercise of an engagement as accredited statutory auditor for a financial institution. The Bank may ask an accredited auditor and/or accredited audit firm whose cooperation with prudential supervision does not meet expectations to consult with it as soon as the auditor/audit firm learns that it may be entrusted with an engagement as accredited statutory auditor and, in any case, prior to the acceptance of a new engagement and/or the renewal of an existing one.

NBB_2024_12 - 16 July 2024 Circular - Page 11/53 In the event of a negative assessment of cooperation, the Bank shall inform the accredited statutory auditor concerned so that the latter may remedy the shortcomings noted as soon as possible. Where appropriate, the Bank shall set up a meeting with the auditor and, in more serious cases, send a letter with its observations, asking the accredited statutory auditor to respond to the findings and take the necessary corrective measures. The Accreditation Regulation authorises the Bank to revoke the accreditation of accredited auditors (and accredited audit firms) if the accreditation requirements are no longer met and/or if the duty to cooperate with the Bank has not been fulfilled with the necessary competency and diligence.
2.1.4. APPOINTMENT TO PERFORM AN AUDIT ENGAGEMENT
Article 18 of the Accreditation Regulation requires financial institutions to seek the prior approval of the
Bank before appointing an accredited statutory auditor. The request for approval shall be drawn up in accordance with the supervisory authority’s instructions and include the annual fees for the audit engagement proposed to the general meeting of shareholders or, where applicable, the general meeting of members. The second paragraph of Article 18 of the Accreditation Regulation specifies that, with a view to granting approval for the appointment of an accredited auditor to carry out a statutory audit engagement, the supervisory authority shall take into consideration any grounds relating to (i) the availability of the proposed accredited auditor having regard to any other audit functions performed, (ii) the size and organisation of the audit firm, (iii) the auditor’s professional knowledge and experience, having regard to the nature, size and complexity of the business of the financial institution for which the appointment is proposed, and the independence of the accredited auditor from the institution in question. A decision by an accredited audit firm to terminate the appointment of one or more of its permanent representatives requires the prior approval of the supervisory authority, pursuant to Article 19(3) of the Accreditation Regulation. The name of the new permanent representative(s) shall be submitted to the supervisory authority prior to appointment.
2.1.5. Resignation from an audit engagement
An accredited auditor that wishes to resign from an engagement as accredited statutory auditor must give prior notice to the supervisory authority, using the early warning function. The accredited statutory auditor shall confirm this resignation to the supervisory authority when submitting the communication required pursuant to Article 3:66 §2 CCA, in a letter setting out the reasons for the resignation, accompanied by a copy of the decision of the board of directors and the general meeting justifying the resignation or, where applicable, the auditor’s letter of resignation addressed to the financial institution. The Bank may request additional information on the factors leading to the resignation of the accredited statutory auditor, particularly if the resignation is due to difficulties encountered when performing the audit engagement under private and/or public law or the occurrence of an event likely to compromise compliance with the rules applicable to the profession, in particular the auditor’s independence or objectivity, if this has not been previously signaled via the early warning function. The aforementioned information shall be submitted in writing to (i) supolaudit@nbb.be and (ii) the persons in the relevant departments of the Bank who are responsible for prudential supervision of the financial institution(s) for which the engagement as accredited statutory auditor was performed.

Circular - Page 12/53 NBB_2024_12 - 16 July 2024
2.2. GENERAL PRUDENTIAL EXPECTATIONS
The general prudential expectations concern, on the one hand, certain aspects relating to ongoing compliance with the accreditation requirements and, on the other hand, the reports and communications expected from accredited statutory auditors further to their duty to cooperate with the supervisory authority when acting as accredited statutory auditor for one or more financial institutions. With regard to reporting and disclosure, it should be noted that this section deals with general aspects applicable to all financial institutions, while part 3 covers complementary and/or sector-specific technical aspects. The Bank expects accredited auditors to put in place, at the personal level or at the level of the accredited audit firm, appropriate procedures, and internal controls in order to meet the prudential expectations of the supervisory authority.
2.2.1. ONGOING COMPLIANCE WITH THE ACCREDITATION REQUIREMENTS
This section concerns certain aspects of ongoing compliance by accredited auditors with the accreditation requirements, namely:

in-depth knowledge of the nature and technical aspects of operations specific to the financial
institutions in question and the applicable system of public supervision (point 2.2.1.1);
ability to perform their duty of cooperation with prudential supervision independently, competently
and with the exercise of professional scepticism and professional judgment, taking into account any previous experience in this area (point 2.2.1.2);
an internal organisation appropriate to the performance of engagements as an accredited statutory
auditor and duties under public law (point 2.2.1.3).
2.2.1.1. In-depth knowledge of the nature and technical aspects of operations specific to financial
institutions and the system of public supervision - Continuing education For the performance of their duties under private law, accredited auditors must demonstrate that they undergo appropriate continuing education to acquire the knowledge and experience of the nature and technical specificities of the operations of financial institutions and of the system of public supervision required to carry out their engagements as an accredited statutory auditor.
2.2.1.2. Expectations in terms of independence, competency, professional scepticism and
professional judgment
The Accreditation Regulation requires that accredited auditors be “capable of carrying out, with independence, competency, professional scepticism and professional judgment, tasks in support of prudential supervision, taking into account, where appropriate, past experience in this field”.
Ethical rules and rules of professional responsibility to be respected by accredited auditors2
The Bank expects accredited auditors to comply scrupulously with the ethical rules and rules of professional responsibility applicable to their profession in the performance of their duties under both public and private law. If the rules of ethics and professional responsibility are not or are no longer respected and/or if violations of these rules are observed, accredited statutory auditors shall immediately inform the Bank in detail of: (i) the reasons for non-compliance, (ii) the (potential) impact on the audit of the financial statements of the financial institution(s) concerned, (iii) the (potential) impact on the performance of their duties under public law, and (iv) the corrective actions taken to remedy the shortcomings observed. 2 The International Code of Ethics for Professional Accountants (including International Independence Standards) (the “IESBA Code”) sets out the fundamental principles of professional ethics to be observed by all external auditors.

NBB_2024_12 - 16 July 2024 Circular - Page 13/53

Comments on the concepts of independence, professional scepticism and professional judgment
in the specific context of the duty to cooperate The Bank wishes to emphasise the importance of these concepts for cooperation with the prudential supervisor, it being understood that, unless otherwise stated, these concepts are to be understood, applied and documented in accordance with the relevant international professional standards:
✓ INDEPENDENCE - As part of their duty to cooperate with prudential supervision, the Bank expects accredited statutory auditors not to act as a representative of the financial institution but rather to distance themselves from it, while complying with the applicable professional standards. Likewise, the Bank expects accredited statutory auditors, in the performance of their duties and insofar as they possess information and tools enabling them to do so, to defend the position or requests of the supervisory authority vis-à-vis the institution (or, in the event of an opposing opinion, to discuss this in advance with the supervisory authority) and, where appropriate, to inform the supervisory authority accordingly. ✓ PROFESSIONAL SCEPTICISM – Professional scepticism is essential at every stage of cooperation with prudential supervision. In particular, this means questioning audit evidence, the reliability of documents, the choices made by management, the credibility of responses to requests for information or explanations and all information provided by the financial institution. This is particularly important where there are factors indicating a risk of material misstatement or fraud. ✓ PROFESSIONAL JUDGMENT – Recourse to professional judgment is very frequently required in the audit of periodic prudential returns, particularly given the complexity of the transactions and measurement valuation methods applied by financial institutions. The accredited statutory auditor’s cooperation is particularly important, especially when the situation requires the auditor to exercise professional judgment and the auditor reports on the matter to the supervisory authority (see below). Reference is made to section 3 for specific examples of situations in which the professional judgment of the accredited statutory auditor is of particular importance. It should be noted that the use of professional judgment is without prejudice to the obligation to substantiate any decision or conclusion, insofar as possible, with reference to facts and circumstances observed during the audit or sufficient and appropriate audit evidence.
2.2.1.3. Organisational aspects of accredited auditors and/or accredited audit firms
The Accreditation Regulation requires accredited auditors (both natural and legal persons) to have in place at all times an adequate organisation to audit the financial institutions concerned, including in particular: (i) a sufficient level of qualified human resources, (ii) a sound administrative and technical organisation, (iii) the application of appropriate audit methods, and (iv) a quality control system that meets professional standards (see above for information on the knowledge aspects). The Bank sets out below more detailed expectations for the implementation of and compliance with certain of these accreditation requirements. Accredited auditors and accredited audit firms are expected to implement and document the measures taken to ensure the allocation (within the firm) of sufficient resources to fulfil their duty of cooperation with prudential supervision, in particular having regard to the quality of the audit work performed, adequate and timely reporting to the supervisory authority (the content of reports, full respect for reporting deadlines and documented compliance with the supervisory authority’s instructions), and the availability of the accredited statutory auditor(s)/member(s) of the firm who represent(s) it.

Circular - Page 14/53 NBB_2024_12 - 16 July 2024 This represents an important commitment on the part of the management of accredited audit firms (“tone at the top”) and covers, in particular, the following aspects:

Policies and procedures specific to the fulfilment of duties under public law
Accredited statutory auditors are expected to draw up a memorandum3 describing the organisational measures and internal controls specific to the performance of their engagements as accredited statutory auditor for financial institutions subject to prudential supervision by the Bank and to cooperation with prudential supervision (duties under public law). These measures should highlight how the expectations of the supervisory authority, as set out in the supervisory laws, the regulatory framework, the supervisory authority’s instructions and this circular, are met. They should be circulated internally and regularly assessed and updated at least annually. A copy (possibly in abridged format) of this memorandum should be included in the annual summary sheet submitted to the Bank (see above).
Internal quality control by accredited audit firms
4 and quality control specific to duties under public law The International Auditing and Assurance Standards Board (IAASB) has adopted audit quality control principles and procedures. The Bank requests that this quality control framework be explicitly extended to the duty of cooperation with prudential supervision (“duties under public law”) and, in particular, to the Bank’s expectations as described in this circular and the Accreditation Regulation.
Cooperation quality indicators
The Bank recommends that, similar to the audit quality indicators provided for by international quality control standards, cooperation quality indicators (CQIs) be defined at the level of accredited audit firms and accredited auditors (natural persons) relating to the nature, scope, execution and timetable for performance of duties under public law, in accordance with the applicable prudential framework and as set out in particular in the standards relating to prudential supervision. It is recommended that the management of accredited audit firms ensure that these CQIs are robust and relevant and that they are monitored internally. The CQIs should be reported on and explained to the Bank via the summary sheet. The first reporting on these indicators is due on 30 September 2025, i.e. at the same time as the summary sheet.
Single point of contact (SPOC) per accredited audit firm
The Bank expects accredited audit firms to set up a single point of contact (SPOC) for communication with the supervisory authority. The SPOC should be systematically covered by the abovementioned annual summary sheet. The supervisory authority deems it essential that management and the quality control and/or risk managers of accredited audit firms (depending on their internal organisation) be involved in the organisation, implementation, and supervision of cooperation with prudential supervision. The SPOC should therefore be placed under the direct responsibility of a person with a high level of seniority within the firm and with in-depth knowledge of the duties under public law incumbent on accredited auditors. The purpose of the SPOC is not only to centralise (in particular via a single email account) all relevant communications, letters, instructions and emails from the Bank addressed to the accredited auditors representing the firm, but also to alert the firm’s management when important information is 3 Or any other relevant instrument; the form may be freely chosen. 4 If applicable, within the administrative organisation of the accredited statutory auditor for a natural person.

NBB_2024_12 - 16 July 2024 Circular - Page 15/53 exchanged with the Bank, in particular when a complaint is addressed to an accredited statutory auditor concerning the quality of their work or the cooperation with prudential supervision or for failure to meet reporting deadlines.

Availability of accredited statutory auditors
The availability of signatory accredited statutory auditors for interaction with the Bank is a fundamental factor that the Bank takes into consideration when deciding whether or not to approve the appointment of an accredited auditor and/or accredited audit firm to act as an accredited statutory auditor (Article 18 of the Accreditation Regulation). Availability throughout the performance of the accredited statutory auditor’s engagement is required, in particular for exchanges and communications with the supervisory authority. The concept of availability may vary considerably from one financial institution to another, having regard in particular to the priorities of prudential supervision, points for attention raised by the accredited statutory auditor on the auditor’s own initiative and, in general, when the supervised institution is in difficulty (solvency, profitability, liquidity, governance, etc.) and specific instructions or requests have been issued by the supervisory authority. The accredited statutory auditor’s availability is assessed quantitatively, notably based on the time budgeted and actually spent by the accredited statutory auditor and the audit team, including (internal and/or external) experts, on performance of the audit engagement. The time budget, in particular that of the signatory accredited statutory auditor, should, in agreement with the IREFI-IRAIF, be included in the pre-audit information to be transmitted to the supervisory authority at the start of the engagement; subsequently, an analysis of discrepancies between the budgeted time and the time actually spent should be reported on, with significant variations explained in the comprehensive report, if applicable. However, the availability of an accredited statutory auditor is not only expressed in terms of the number of hours spent on various activities. It is also a state of mind which the Bank expects accredited statutory auditors to have at all times. Availability, to which the Bank attaches great importance, is also assessed based on the quality of (i) the work carried out and (ii) the responses provided by the accredited statutory auditor within the deadlines set by the supervisory authority when a problem arises. The concept of availability thus extends to the responsiveness of an accredited statutory auditor when requests for information are made by the supervisory authority. In such cases, the accredited statutory auditor must analyse the supervisory authority’s request and identify and implement the necessary measures to obtain and/or prepare and analyse the requested information. The Bank expects the information requested from accredited statutory auditors to be submitted in a timely manner (by the deadlines set by the supervisory authority) and to be relevant, exhaustive, reliable, and understandable. The responses of accredited statutory auditors should preferably be in writing (except in urgent cases) and be accompanied, if necessary, by documentation of
the related work, including any necessary evidence.
Reliance on experts
The specific and regulatory characteristics of the financial institutions subject to supervision by the supervisory authority are complex and varied. It may therefore be necessary to involve experts in the audit work, in order to support the audit team. Depending on the circumstances and the subjects addressed (e.g. specific aspects of prudential regulation (COREP), IFRS 9 ECL, valuation of financial instruments, best estimates for the valuation of technical provisions, actuarial assumptions, accounting estimates that require a significant degree of judgment, IT systems, etc.), the accredited statutory auditor may thus call upon experts.

Circular - Page 16/53 NBB_2024_12 - 16 July 2024 The Bank reiterates that reliance on experts does not release the accredited statutory auditor from the obligation to have thorough knowledge and understanding of the subject matter, in accordance with the applicable professional standards.
2.2.2. GENERAL PRINCIPLES TO ENSURE HIGH-QUALITY COOPERATION
The cooperation between accredited statutory auditors and the supervisory authority is intended to enhance the effectiveness of prudential supervision. This cooperation is based, on the one hand, on the provision of written documents (audit plan, accredited statutory auditor’s reports, information reports, etc.) and, on the other hand, on organised exchanges between the supervisory authority and accredited statutory auditors. Before turning to the specific instructions on the implementation by accredited statutory auditors of tools to ensure effective communication with the supervisory authority, it is useful to recall some general principles based on guidelines issued by international or European bodies (Basel Committee, 5 the EBA, 6 the EIOPA7 and the IAASB8 ). The Bank asks accredited statutory auditors to familiarise themselves with these guidelines and to take them into account in the performance of their duty to cooperate with the prudential supervisor. PRINCIPLE #1 - Accredited statutory auditors are responsible for including in their audit approach the necessary procedures and checks to ensure compliance with the instructions and requests of the supervisory authority and to provide the latter with timely information relevant to the exercise of prudential supervision. Accredited statutory auditors should, based on their professional judgment, assess the nature, extent, relevance, and timeliness of the information they provide to the Bank, in writing or orally through interaction with the supervisory authority or by making use of the early warning function. The Bank encourages accredited statutory auditors to demonstrate professional scepticism and to be proactive in their communications with the supervisory authority. PRINCIPLE #2 - The supervisory authority may ask accredited statutory auditors to share information on their approach to the audit of financial statements and periodic prudential returns and on the conduct of the audit and to answer any questions about the audit approach the supervisory authority considers relevant to prudential supervision. In addition to the submission of an audit plan (at the start of the audit engagement) and a comprehensive report (at the end of the engagement), if applicable, the supervisory authority may, depending on the circumstances, request from the accredited statutory auditor additional information and/or documents relating to the audit procedures. These communications are covered by the Bank’s duty of professional secrecy and may only be used in the context of prudential supervision. Where appropriate, the supervisory authority shall define, in consultation with the accredited statutory auditor(s) concerned, procedures for the provision of such information (format, deadline, etc.). To structure, facilitate and plan the provision of this information, the parties shall pay close attention to the various phases of the audit work (planning, risk assessment and audit responses to risks, assessment,
and conclusion on the system of internal control, interim audit procedures, substantive audit work and procedures, conclusion, and preparation of various auditor’s reports). 5 Bank International Settlements - Basel Committee on Banking Supervision - External Audits of Banks – March 2014 and Guidelines - Supplemental Note to External Audits of Banks - Audit of Expected Credit Losses - December 2020. 6 European Banking Authority - EBA - Final Report on Guidelines on communication between competent authorities supervising credit institutions and the statutory auditor(s) and the audit firms(s) carrying out the statutory audit of credit institutions - EBA/GL/2016/05 - 26 July 2016. 7 EIOPA - Final Report on the Proposal for Guidelines on facilitating an effective dialogue between competent authorities supervising insurance undertakings and statutory auditor(s) and the audit firm(s) carrying out the statutory audit of those undertakings - EIOPA - 16/858 - 12 December 2016. 8 International Auditing Practice Statement 1004 - IAPS 1004 - The Relationship between Banking Supervisors and Banks’ External Auditors.

NBB_2024_12 - 16 July 2024 Circular - Page 17/53 PRINCIPLE #3 - Effective communication shall be established between the supervisory authority and accredited statutory auditors through appropriate channels, in order to exchange the information available to them on issues relevant to prudential supervision. Written communication is preferred where necessary to ensure understanding, clarity, and a record of communication and/or for matters involving complex technical issues. Meetings between the parties should be held to facilitate open and effective communication and ensure a proper understanding of shared documents. PRINCIPLE #4 - The parties shall ensure that they designate persons who are competent, knowledgeable, and authorised to communicate on their behalf. In order to guarantee high-quality, effective communication, the parties shall designate those persons most qualified to express the technical, regulatory, audit and prudential reporting positions and/or experts to take part in meetings. The signatory accredited statutory auditor shall always be available and present for such exchanges as well as, depending on the circumstances, the accredited statutory auditor’s management team for the audit. Depending on the subjects to be discussed, experts from both parties (valuation specialists, actuaries, experts in models, IFRS, Solvency II, prudential matters, IT, compliance, regulatory and legal matters, etc.) may be asked to attend. For significant credit institutions, meetings shall be held in the presence of representatives of the European Central Bank, whenever possible. Where appropriate, meetings with representatives of credit institutions may be organised. PRINCIPLE #5 - Communication between the supervisory authority and accredited statutory auditors shall take place with the frequency necessary to ensure the timely and effective sharing of relevant information. The dates on which written reports (other than special reports) required by the supervisory laws must be submitted and made available shall be determined by the supervisory authority (see below). Accredited statutory auditors bear primary responsibility for submitting their reports in accordance with the requirements (content, format, etc.) and within the deadlines set by the Bank. If, for any overriding reason, a deadline for reporting to the Bank cannot be met, the accredited statutory auditor shall immediately inform the Bank of the reasons for the delay and the expected submission schedule, making use of the early warning function (see below). Non-compliance with the deadlines for the submission of auditor’s reports affects the planning of the supervisory authority’s work and should be considered an exception for which a justification is required. The Bank and accredited statutory auditors shall assess on an ongoing basis whether there are emerging issues that require changes to the frequency and timing of reporting or the introduction of ad hoc disclosure.
2.3. AUDITOR’S REPORTS COMMON TO ALL FINANCIAL INSTITUTIONS
2.3.1. WRITTEN REPORTS FOR THE ATTENTION OF THE SUPERVISORY AUTHORITY
This section describes the supervisory authority’s expectations in terms of the preparation and submission of reports and written documents required by the various prudential supervisory laws. Over the course of the financial year, the following reports and documents are to be submitted:
(i) Audit plan and pre-audit information before the performance of the accredited statutory auditor’s engagement (2.3.1.1) (ii) Limited review of periodic prudential returns at the end of the first half of the financial year (2.3.1.2) (iii) Annual reports: audit report on periodic prudential returns at the end of the financial year, report on the system of internal control, where applicable, report on internal controls relating to

Circular - Page 18/53 NBB_2024_12 - 16 July 2024 investment activities and services, statement on special mechanisms and, finally, a comprehensive annual report (2.3.1.3). At any time, depending on the circumstances and needs, an accredited statutory auditor may also be called upon to submit one or more ad hoc special reports (2.3.1.4). Accredited statutory auditors are moreover required to provide a range of other documents, on a periodic or ad hoc basis (reports and presentations to the audit committee, special reports under the CCA, etc.) (2.3.1.5). The last section of this part (2.3.1.6) covers the NBB Supervision portal, through which reports and documents are submitted to the Bank. Accredited statutory auditors shall take into account the expectations described below for reports common to all supervised sectors as well as the sector-specific expectations detailed in part 3 of this circular. Auditor’s reports submitted to the supervisory authority concerning credit institutions subject to direct supervision by the European Central Bank may be drafted in English. 9
2.3.1.1 AUDIT PLAN AND PRE-AUDIT INFORMATION
The pre-audit information described below must be reported to the Bank in the form of a single document, via the NBB Supervision portal. It is therefore advisable to include a table of contents in this document in order to identify its various parts. For institutions that report on both a standalone (Belgian statutory accounts) and consolidated basis, the document containing pre-audit information need only be drawn up on a consolidated basis (indicating, where applicable, specific information relevant for prudential supervision on a standalone basis). (a) Audit plan10

Audit approach, prudential supervision priorities and adaptation of audit procedures
The Bank expects the regulatory and prudential aspects applicable to the audited financial institution to be taken into consideration, included, and detailed in the audit approach and audit plan. Due consideration of the supervisory authority’s expectations early in the audit process enables the accredited statutory auditor to pay particular attention to addressing these expectations and to allocate sufficient time to doing so. In addition, at the end of each financial half year, IREFI-IRAIF and the supervisory authority shall prepare a list of points for attention relating to the accounting and prudential situation at mid-year and at the end of the financial year. The supervisory authority expects accredited statutory auditors to integrate these points for attention into their audit strategy, if they are relevant for the financial institution concerned, and to include their analyses and conclusions thereon in the comprehensive report. The annual audit plan shall cover the following points: (i) the objectives of the planned audit procedures, (ii) a precise identification of significant, specific risks to which the financial institution is exposed (including any prudential priorities notified by the operational departments of the supervisory authority for the files concerned), (iii) the risk assessment procedures, (iv) the audit responses to identified risks, in particular the nature, scope and timetable of the procedures put in place by the financial institution to assess the internal controls, relating to their design, implementation and 9 Provided the SI concerned has agreed to the use of English in the context of direct supervision by the European Central Bank. 10 This circular replaces, with immediate effect, Communication NBB_2019_08 of 3 April 2019 - Expectations concerning the preparation of the audit plan and the comprehensive report.

NBB_2024_12 - 16 July 2024 Circular - Page 19/53 operating effectiveness, (v) the decision on whether to rely on the internal controls relevant for the review of periodic prudential returns and the financial statements, (vi) substantive audit procedures, sampling, analytical reviews, etc. The supervisory authority shall be informed of the most significant changes and the reasons underlying them as well as the (potential) impact on prudential supervision.

Applicable materiality thresholds
The issuance of a review report or an audit opinion on periodic prudential returns entails, according to international auditing standards, the application of materiality thresholds. Materiality thresholds for periodic prudential returns are determined based on the accredited statutory auditor’s professional judgment and are influenced by the nature of the periodic prudential returns in question and the information needs of the supervisory authority. When providing pre-audit information (see below), the accredited statutory auditor shall detail and justify the quantitative and qualitative criteria that have been used to determine the materiality thresholds applicable to, on the one hand, the financial statements (duties under private law) and, on the other hand, periodic prudential returns (duties under public law). 11 These criteria shall, to the extent possible, be discussed with the supervisory authority prior to performance of the audit work. If the materiality thresholds (in particular due to the use of a different percentage to calculate materiality) are changed during the course of the audit and this change has a significant impact on the nature, scope and timetable of the audit work for periodic prudential returns, the accredited statutory auditor shall ensure that the supervisory authority is informed of this fact (in particular the reasons for the change and the impact for prudential supervision).
Submission of the audit plan to the supervisory authority
The audit plan shall be systematically submitted to the Bank before the accredited statutory auditor proceeds to audit the annual periodic prudential returns. The supervisory authority expects the audit plan to be submitted to it after discussion within the audit committee and, at the latest, nine months from the start of the financial year to which it relates. In view of the foregoing, it is recommended that, insofar as possible given the timetable, contact be made with the supervisory authority prior to finalisation of the audit plan in order to ensure that the plan adequately covers all important points for attention, without this implying the need for formal validation of the audit plan by the supervisory authority. If, in the course of the audit work, it appears that the audit plan needs to be modified, the accredited statutory auditor shall inform the supervisory authority and justify the required modifications. (b) Other pre-audit information The pre-audit information submitted to the Bank shall include, in addition to the abovementioned audit plan, information on the following items (to the extent not covered by the audit plan):
the names, qualifications, and experience of the key people who, in addition to the accredited
statutory auditor, will be involved in carrying out the audit engagement;
the name and contact details of the person responsible for quality control within the accredited
statutory audit firm to which the accredited statutory auditor belongs;
the estimated number of hours budgeted for the audit of the financial institution, in particular the
estimated number of hours to be spent by the signatory accredited statutory auditor, covering both public and private law aspects of the engagement (duties under the public law and duties under private law); 11 For other matters, accredited statutory auditors should refer in particular to IREFI-IRAIF communication 2019/07 of 31 July 2019 - Notes relatives à la matérialité et à la fonction de signal for information on determination of the materiality thresholds for periodic prudential returns.

Circular - Page 20/53 NBB_2024_12 - 16 July 2024

the materiality thresholds applied to both duties under public law and duties under private law,
including a description of the method(s) used to determine these thresholds and the reasons for selecting this/these method(s); the accredited statutory auditor shall ensure that the quantitative and qualitative criteria used to determine the abovementioned thresholds are mentioned and explained in detail;
recourse to external experts, if any;
reliance on internal audit work to perform tasks and duties under public law during the audit
engagement;
a timetable for the audit procedures to be carried out;
the measures to be taken in the event fraud is detected.
The pre-audit information should be updated when significant changes occur prior to completion of the audit of periodic prudential returns and the other tasks of the accredited statutory auditor. Where appropriate, the accredited statutory auditor shall contact the supervisory authority on its own initiative to inform the latter of these changes and the consequences (further to the accredited statutory auditor’s early warning function - see below). These changes shall give rise to follow-up and updating of the reports of the accredited statutory auditor on periodic prudential returns at the end of the first half of the financial year and/or at the end of the financial year, as well as the comprehensive report, when such a report is required having regard to the type of financial institution.
2.3.1.1. REVIEW OF PERIODIC PRUDENTIAL RETURNS AT THE END OF THE FIRST HALF OF THE FINANCIAL YEAR
The review of periodic prudential returns shall be performed in accordance with the International Standard on Review Engagements (ISRE) 2410 - Review of Interim Financial Information Performed by the Entity’s Independent Auditor and with the directives and instructions of the supervisory authority. In the review report, in addition to a conclusion on the half-yearly review (limited assurance) of the periodic prudential returns, statutory auditors shall:
− confirm that they are not aware of any facts that would indicate that the periodic prudential returns were not, in all material respects, prepared in accordance with the instructions of the supervisory authority12 (statement expressed in a negative form in accordance with ISRE 2410); − confirm (statement expressed in a positive form) that the periodic prudential returns conform, as far as the accounting data are concerned, 13 in all material respects with the accounting records and inventories, in that they are:
o complete, i.e. include all data appearing in the accounting records and inventories on which they are based, and o correct, i.e. agree precisely with the accounting records and inventories on which they are based. − confirm that they are not aware of any facts that would indicate that the periodic prudential returns were not prepared in accordance with the recognition and valuation rules governing the preparation of financial statements (negative statement). Considering the limited nature of the review at the end of the first half of the financial year, the accredited statutory auditor shall ensure appropriate follow-up of:
(i) matters that the supervisory authority has formally requested be monitored; and 12 The instructions of the supervisory authority include, in particular, designation of the guidelines on the basis of which periodic prudential returns must be prepared and which may be either accounting related or strictly prudential (e.g. Solvency II, CRD/CRR, etc.). In the latter case, compliance with accounting standards alone is not sufficient. 13 For insurance and reinsurance companies, this confirmation should be interpreted as meaning that the inventories and accounts form the basis for the data valued in accordance with the Solvency II prudential framework.

NBB_2024_12 - 16 July 2024 Circular - Page 21/53 (ii) points for attention flagged in IREFI-IRAIF’s half-yearly “Attention Points” letter. If the accredited statutory auditor considers it necessary to draw the attention of the supervisory authority to a particular matter in the periodic prudential returns (or the financial statements) which, in the auditor’s professional judgement, is essential to a proper understanding of the periodic prudential returns, the auditor shall first do so by making use of the early warning function (see below).
2.3.1.2. ANNUAL REPORTS AT THE END OF THE FINANCIAL YEAR
Various reports must be submitted to the supervisory authority at the end of the financial year via the NBB’s Supervision portal (OneGate), in separate lines and in accordance with the timetable imposed by the supervisory authority. These include (i) audit reports on periodic prudential returns (on a standalone and/or consolidated basis), (ii) the auditor’s report on the assessment of internal control, (iii) other reports on internal controls relating to investment activities and services (and other activities and services, depending on the type of financial institution concerned), and (iv) the annual statement of the accredited statutory auditor/accredited auditor on special mechanisms. Lastly, the comprehensive report, which constitutes the cornerstone of the auditor’s annual reporting obligations, is submitted at the same time as the auditor’s report on periodic prudential returns at the end of the financial year, in accordance with the deadlines set by the supervisory authority (see section 4.1 below). 2.3.1.2.1.COMPREHENSIVE REPORT The accredited statutory auditor shall provide the supervisory authority with a comprehensive report on an annual basis for the following types of financial institutions:
✓ credit institutions governed by Belgian law; ✓ stockbroking firms governed by Belgian law; ✓ Belgian central securities depositories, institutions providing support to central securities depositories and custodian banks; ✓ authorised and designated financial holding companies and mixed financial holding companies governed by Belgian law; ✓ investment holding companies and mixed financial holding companies under Belgian law included in the scope of supervision on a consolidated basis or review of the capitalisation test of a group of investment companies carried out by the Bank; ✓ insurance or reinsurance companies governed by Belgian law; ✓ the entities 14 responsible for an insurance or reinsurance group within the meaning of Articles 339(2) and 343, paragraph 2(1) and (2), of the Insurance Supervision Act for which the Bank has been designated group supervisor within the meaning of Articles 407 and 408 of the aforementioned law. Structure and content of the comprehensive report The comprehensive report shall be drafted strictly in accordance with the structure and numbering set out in Annex 1 to this circular, taking into account the principles set out below. The following requirements repeal and replace Communication NBB_2019_08 of 3 April 2019 on the drafting of the audit plan and the comprehensive report. (i) The comprehensive report shall display the following characteristics:
a. sui generis: the comprehensive report shall be prepared and submitted as a stand-alone document rather than a compilation of other documents. However, it is imperative that the content of the comprehensive report be consistent with that of other relevant documents in 14 More specifically (i) insurance or reinsurance companies governed by Belgian law that hold a stake in at least one insurance or reinsurance company in the EEA or a third country, (ii) insurance or reinsurance companies whose parent company is a mixed holding company or a mixed financial holding company established in the EEA or in a third country, and (iii) insurance holding companies or mixed financial holding companies governed by Belgian law which are the parent company of an insurance or reinsurance company governed by Belgian law.

Circular - Page 22/53 NBB_2024_12 - 16 July 2024 order to avoid confusion due to a conflicting presentation of the same issue in different documents or reports; b. self-supporting: the comprehensive report shall include all information relevant to and important for prudential supervision. The accredited statutory auditor shall devote the necessary attention and care to ensuring that the items to be brought to the attention of the supervisory authority are described in a clear, complete, and precise manner in order to enable the reader to understand the ins and outs of the points raised by the accredited statutory auditor without having to refer to other documents;
c. exhaustive: the comprehensive report shall include all points for attention, problems
encountered, recommendations and conclusions to which the accredited statutory auditor considers it necessary to draw the supervisory authority’s attention, based on the auditor’s knowledge of the financial institution and the supervisory authority’s prudential expectations. The comprehensive report shall explicitly confirm that no matters other than those covered by the report are discussed in the other auditor’s reports required by the supervisory laws; d. consolidated: for institutions that report on both a standalone and consolidated basis, a single comprehensive report shall be drawn up, on a consolidated and sectoral basis (indicating, where appropriate, aspects specific to the stand alone basis). (ii) The comprehensive report shall be dated and signed by the accredited statutory auditor. It shall be submitted along with the other reports that must be provided to the supervisory authority at the end of the financial year: the audit report on periodic prudential returns, the report on the assessment of internal control, other reports on the safeguarding of third-party assets (where applicable) and the annual statement on special mechanisms. These various reports are to be uploaded to the supervisory authority’s portal separately, as is currently the case depending on the category of financial institution concerned. (iii) The comprehensive report may not have the effect of calling into question the opinion of the accredited statutory auditor on the periodic prudential returns. If this is the case, it is up to the accredited statutory auditor to review and modify the audit opinion. (iv) The comprehensive report shall be drafted in such a way as to clearly indicate the nature, stakes and impact of a problem, operation, transaction, specific event, etc., as well as the analysis and opinion of the accredited statutory auditor on the problem, operation, etc. The wording shall be express (not implied), concise and not buried in an array of general, abstract information. 15 Socalled boilerplate language should therefore be avoided in favour of information and comments specific to the financial institution and critical analyses and conclusions by the accredited statutory auditor. For example, the description of the asset valuation methods should not consist of a mere reproduction of the valuation rules, but rather indicate precisely the points to which the accredited statutory auditor considers it necessary to draw the supervisory authority’s attention, for instance the use of parameters or methods that derogate from normal market practices. This will be the case in particular where accounting and/or prudential estimates involve a large degree of judgment. 16 15 As the report is intended for readers who are well informed on the subjects covered, it is advisable to deal with more theoretical descriptions only insofar as they form the object of discussion (e.g. diverging or uncommon interpretations of a rule). 16 This is the case, for example, for the
assessment of expected credit losses in accordance with IFRS 9 - ECL, for the assessment of the “best estimate” for the technical provisions of insurance or reinsurance companies and for the assessment of the level of provisions established by a financial institution to cope with expected major litigation. By way of example, for expected credit losses (IFRS 9 - ECL), it is recommended that accredited statutory auditors implement and document the guidelines published in December 2020 by the Basel Committee, entitled “Supplemental Note to External Audits of Banks - Audit of Expected Credit Loss” (https://www.bis.org/bcbs/publ/d513.pdf) as well as the considerations included in the various EBA reports on

NBB_2024_12 - 16 July 2024 Circular - Page 23/53 (v) The abovementioned opinion should not be confused with an audit opinion expressed pursuant to professional standards (included elsewhere). The opinion referred to here is intended to explain to the supervisory authority how the accredited statutory auditor has analysed an issue under the relevant rules, principles or good practices and the auditor’s conclusion thereon, in terms of the corrective measures expected from the financial institution, follow-up measures decided on by the accredited statutory auditor, recommendations to the supervisory authority or, in extreme cases, a qualified audit opinion. Where appropriate, the accredited statutory auditor shall explain the impact on periodic prudential returns and the supervisory authority’s prudential expectations. (vi) The supervisory authority may, if necessary, ask the accredited statutory auditor to elaborate on a given point or to examine a problem specific to a supervised institution or sector of activity. 2.3.1.2.2.AUDIT REPORT ON PERIODIC PRUDENTIAL RETURNS AT THE END OF THE FINANCIAL YEAR The supervisory laws provide that accredited statutory auditors shall report to the supervisory authority on the results of their audit of the periodic prudential returns submitted by the financial institution to the Bank at the end of the financial year. This report takes the form of an audit opinion by the accredited statutory auditor on the periodic prudential returns. In the report prepared at the end of the financial year, in addition to an audit opinion (reasonable assurance) on the periodic prudential returns, the accredited statutory auditor shall:
− confirm that the year-end periodic prudential returns have been prepared, in all material respects, in accordance with the instructions of the supervisory authority (statement expressed in a positive form); − confirm (statement expressed in a positive form) that the periodic prudential returns comply in all material respects, as far as the accounting data are concerned, 17 with the accounting records and inventories in that they are:
o complete, i.e. mention all data contained in the accounting records and inventories on which they are based, and o correct, i.e. agree precisely with the accounting records and inventories on which they are based. − confirm that the periodic prudential returns were prepared in accordance with the accounting and valuation rules applicable to preparation of the annual financial statements (statement expressed in a positive form). The accredited statutory auditor shall carry out the audit of periodic prudential returns at the end of the financial year in accordance with the International Standards on Auditing (ISA). If the accredited statutory auditor considers it necessary to draw the attention of the supervisory authority to a particular matter in the periodic prudential returns (or the financial statements) which, in the auditor’s opinion, is of such importance that it is essential to an understanding of the periodic prudential returns, the auditor shall first do so by making use of the early warning function (see below). IFRS 9 issues, in particular the IFRS 9 Monitoring Reports published in November 2021 and November 2023 relating to high default portfolios (HDPs). 17 As far as insurance and reinsurance companies are concerned, this confirmation should be interpreted as meaning that the inventories and accounts form the basis of the information to be valued in accordance with the Solvency II framework.

Circular - Page 24/53 NBB_2024_12 - 16 July 2024 2.3.1.2.3.INTERNAL CONTROL

General framework
A financial institution must put in place a sound and appropriate internal organisation, including monitoring arrangements, to ensure its effective and prudent management, including with respect to its administration and accounting. The organisation and internal controls should be comprehensive and appropriate to the nature, scale, and complexity of the risks inherent in the financial institution’s business model and activities. Under oversight by the statutory governing body, the management body shall take the necessary measures to ensure that the provisions of the supervisory laws relating to internal control, including respect for the Bank’s instructions, circulars and communications, are complied with and implemented.
The concept of internal control
The supervisory laws and their implementing decrees, regulations and circulars define the concept of internal control and the internal audit function. For European branches of credit institutions and stockbroking firms, the management body’s assessment of internal control is limited to so-called “general good” provisions.
Management body’s report
At least once a year, the management body shall report18 to the statutory governing body, the accredited statutory auditor, and the supervisory authority on its assessment of the effectiveness of the financial institution’s organisation and its compliance with legal and regulatory obligations, as well as on the preventive measures taken to remedy any shortcomings detected. The report shall explain how these measures meet the legal and regulatory requirements. The management body’s report shall cover all aspects of internal control and include an assessment of the adequacy and functioning of the internal control framework within the financial institution. It shall enable the statutory governing body to check whether the abovementioned requirements are met and that the appropriate measures have been taken. In particular, the report shall assess the internal controls defined in the various supervisory laws and in the Bank’s instructions, circulars, and communications applicable to the financial institution concerned. Information shall be submitted to the supervisory authority and the accredited statutory auditor in accordance with the terms and conditions defined by the supervisory authority. If the accredited statutory auditor does not receive the management body’s report in a timely manner, the auditor shall formally request it from the management body. If this request is not answered, the accredited statutory auditor shall inform the supervisory authority. This fact shall be noted in the accredited statutory auditor’s reports. 18 In drawing up its report, the management body shall comply with the provisions and instructions of the supervisory authority as set out in Circular NBB_2011_09 of 20 December 2011 and the Bank’s uniform letter of 16 November 2015 on the assessment report of senior management on the system of internal control for financial institutions. These instructions are applicable to all types of financial institutions with the exception of insurance and reinsurance companies, to which circular NBB_2020_017 of 5 May 2020 updating the umbrella governance circular applies.

NBB_2024_12 - 16 July 2024 Circular - Page 25/53

The accredited statutory auditor’s engagement
✓ Description
The supervisory laws stipulate that the purpose of an accredited statutory auditor’s engagement is to assess the overall adequacy of the internal controls in order to provide reasonable assurance as to, on the one hand, the reliability of the financial and prudential reporting process and, on the other hand, control over operating activities. More specifically, as part of this engagement, the accredited statutory auditor is required to critically analyse the following aspects of internal control:
✓ the overall adequacy of the design of the internal control environment; ✓ the design of internal controls relating to financial reporting and periodic prudential returns; where considered relevant by the accredited statutory auditor in this area, tests to assess the effectiveness of these measures (i.e. whether they are implemented and operating effectively) shall be performed; ✓ senior management’s assessment of internal control with a view to commenting on the appropriateness of the methodology applied, the scope of management’s analysis and any inconsistencies between this assessment and the information and evidence gathered during the audit of the financial statements and the periodic prudential returns; and ✓ general good provisions, specific mechanisms, compliance, risk management, internal audit, etc. The accredited statutory auditor’s engagement does not constitute an opinion on the adequacy of internal control or on compliance with the applicable laws and regulations. However, the supervisory authority expects the (comprehensive) report to contain appropriate comments and conclusions on the aforementioned critical analyses. In carrying out this engagement, the accredited statutory auditor shall rely on, among other things, a critical assessment of the abovementioned report by the management body and of the documentation on which the abovementioned report is based, as well as on the implementation of internal controls by the management body. In this context, the following aspects shall be taken into consideration. (i) the setting of the financial institution’s objectives at different organisational levels and in a mutually consistent manner, including the definition of risk appetite and, where appropriate, the remediation plan drawn up by the financial institution; (ii) the extent to which the risk assessment identifies and analyses all risks liable to hinder the achievement of internal control objectives; the identified risks shall include non-compliance with the provisions of applicable regulations, implying that the financial institution must compile a list of all significant internal control requirements with which it is expected to comply; (iii) the extent to which planned but failed or unperformed controls that prove to be material (due to either their number or their impact) are taken into account; the aim here is to infer from the findings on the controls any problems relating to the collection, aggregation, processing and/or production of the data used to prepare the audited periodic prudential returns; (iv) the extent to which the risk assessment serves as a basis for determining how risks are managed; (v) the extent to which organisational measures contribute to appropriate monitoring of identified risks; and

Circular - Page 26/53 NBB_2024_12 - 16 July 2024 (vi) the extent to which the effective and ongoing application of organisational measures is followed up by the management body. ✓ Assessment of internal controls by the accredited statutory auditor (i) Internal controls to ensure the reliability of financial and prudential reporting With regard to its administrative and accounting procedures, each institution shall establish an adequate internal control system which provides reasonable assurance as to the reliability of the financial and prudential reporting process and which should, notably, make it possible to satisfy requests for information from the Bank, in general, and on prudential reporting, in particular. In the performance of their duties under private law, accredited statutory auditors are expected to acquire an understanding of the institution and its environment, including internal controls, sufficient to enable them to identify and assess the risk of material misstatement in the financial statements and to design and execute audit procedures. In conducting this risk assessment, the accredited statutory auditor shall take into account the system of internal control in order to define audit procedures that are appropriate to the circumstances. Although the purpose here is not to express an opinion on the effectiveness of the institution’s internal control system, the accredited statutory auditor shall identify weaknesses in internal control not only during this risk assessment process but also, if necessary, at any other stage of the audit engagement. Accredited statutory auditors shall apply this knowledge and supplement it in a way that is useful for the performance of their duties under public law to assess the design of internal controls implemented by the institution, in particular those intended to enhance the reliability of prudential reporting. (ii) Internal controls to monitor operating activities Moreover, the Bank expects accredited statutory auditors to analyse the management body’s assessment of the institution’s internal controls, other than those relating to the reliability of financial and prudential reporting, including general good provisions, governance, risk management, compliance, the actuarial function, the internal audit function, etc. With regard to the accredited statutory auditor’s duties relating to periodic prudential returns, this means that the auditor’s report shall include an assessment of the overall adequacy of the measures taken by the management body to ensure compliance with the applicable (European and national) prudential regulatory provisions, including circulars and communications issued by the supervisory authority. 19 If, based on the audit work, the accredited statutory auditor considers that the management body’s report does not allow/reflect compliance with the aforementioned provisions, a statement to this effect shall be included in the auditor’s report to the supervisory authority,
together with the auditor’s conclusions on the matter.

Assessment procedures
The most important sources for this assessment by accredited statutory auditors are the report by the management body, as well as the knowledge the auditor acquires and the documentation prepared in the performance of their duties under private law and public law, in particular on the internal control system and the financial reporting process. 19 Accredited statutory auditors are not responsible for preventing violations of laws and regulations and cannot be expected to detect all such violations. However, they shall take these laws and regulations into account in their risk assessment. In this context, accredited statutory auditors shall use professional judgment and professional scepticism to determine which aspects should be reported to the supervisory authority.

NBB_2024_12 - 16 July 2024 Circular - Page 27/53 To this end, accredited statutory auditors shall put in place procedures to ensure the following in particular:
✓ acquisition of sufficient knowledge of the financial institution and its environment in the performance of their duties under private law and public law; ✓ up-to-date knowledge of the system of public supervision; ✓ review and critical analysis of the internal control system in the context of their duties under private law and public law with regard to periodic prudential returns, as required in particular by the international standards on auditing; ✓ critical review of the minutes of meetings of the management body; ✓ critical review of the minutes of meetings of the statutory governing body and the audit committee, where such a committee has been set up; ✓ critical review of documents transmitted to the management body relating to provisions of the supervisory laws; ✓ critical review of documents transmitted to the management body relating to the provisions on internal control in the supervisory laws; ✓ critical review of documents relating to the provisions on internal control in the supervisory laws transmitted to the statutory governing body and/or the audit committee; ✓ requests to the management body and the assessment of information regarding the provisions on internal control in the supervisory laws; ✓ requests to the management body and the assessment of information on how it prepared its report and its assessment of internal control; ✓ critical review of documentation substantiating the management body’s report; ✓ critical analysis of the management body’s report in the light of knowledge acquired in the performance of the auditor’s duties under private law; ✓ critical analysis to ensure that the management body’s report is drawn up in accordance with Circular NBB_2011_09 and the Bank’s uniform letter of 16 November 2015 (or, where applicable, the latest version of the umbrella governance circular for insurance and reinsurance companies) and reflects the manner in which the management body carried out its review and its assessment of internal control; ✓ critical analysis to ensure compliance by the management body with the provisions of Circular NBB_2011_09 and the Bank’s uniform letter of 16 November 2015 and/or the umbrella governance circular for insurance and reinsurance companies and that particular attention has been paid to the methodology used and the documentation prepared in support of this report; ✓ critical analysis to ensure compliance by the financial institution with the provisions of Circular NBB_2017_27 setting out the Bank’s expectations regarding the quality of prudential and financial reporting, with particular attention paid to the application by the financial institution of internal controls intended to ensure the quality of periodic prudential returns and the results of the accredited statutory auditor’s work in this area; ✓ attendance, where appropriate, at meetings of the statutory governing body or the audit committee. If necessary, the accredited statutory auditor shall adapt this list of procedures to the
specific circumstances of the financial institution, exercising professional scepticism and professional judgment when doing so.

Auditor’s report to the supervisory authority
Although accredited statutory auditors do not express an opinion on the operating effectiveness of the financial institution’s system of internal control, they nevertheless assess the overall adequacy of the internal controls put in place by the management body, in the framework set out above. Accredited statutory auditors shall take care to report accurately and completely on their assessment of this adequacy. The supervisory authority expects the auditor’s report to include the abovementioned critical analyses.

Circular - Page 28/53 NBB_2024_12 - 16 July 2024 In their assessment report, accredited statutory auditors shall set out all relevant findings relating to the internal controls adopted by the financial institution. In other words, the report should contain all findings relating to the management body’s report, in particular as regards:
✓ the completeness and scope of the report;
✓ the manner in which the report was drafted and approved; ✓ the method used by the financial institution to assess internal control, including how this method is supported and applied; ✓ the documentation available for drafting the report; ✓ any discrepancies between the findings of the accredited statutory auditor and the management body’s report; ✓ shortcomings and weaknesses in the system of internal control relevant to prudential supervision and financial reporting. Accredited statutory auditors shall pay particular attention to those internal controls intended to enhance the reliability of financial and prudential reporting. If, as indicated above, weaknesses are identified in the assessment of the system of internal control conducted in the context of the audit of the financial statements and of the periodic prudential returns, accredited statutory auditors shall expressly indicate these weaknesses in their report. If no weaknesses are identified, it is recommended to include a mention to this effect. In the course of the accredited statutory auditor’s work, the following findings [non-exhaustive list] may be relevant to the exercise of prudential supervision by the supervisory authority:
✓ failure to comply with the provisions set out in the supervisory authority’s circulars on the structure and content of the management body’s assessment report on the internal controls adopted by the financial institution; ✓ observations and recommendations concerning the method used by the management body of the financial institution to assess the system of internal control and the documentation drawn up in this respect; ✓ findings relating to internal controls designed to ensure the reliability of financial and prudential reporting (in the light of the accredited statutory auditor’s own evaluation and/or assessment of these controls - see above), including all recommendations made by the accredited statutory auditor to senior management; ✓ shortcomings or deficiencies identified in internal control insofar as they are not mentioned in the recommendations of the accredited statutory auditor to senior management (see above); ✓ corrective measures developed by senior management of the financial institution and the timetable for the implementation thereof, including, where appropriate, the impact on the accredited statutory auditor’s audit strategy (for periodic prudential returns and financial statements), if any; ✓ inconsistencies in the reports issued by the heads of the internal control, risk management and compliance functions and those received from internal audit services (including those of subsidiaries and branches); ✓ internal audit findings on the assessment of the internal control system and the manner in which the management body has taken this information into account in its report; ✓ other findings and comments deemed relevant by the accredited statutory auditor for the exercise of prudential supervision by the supervisory authority; ✓ etc. Reference is also made to point 2.3.1.4 below regarding (i) the additional report referred to in
Article 11 of Regulation (EU) No 537/201420 which the accredited statutory auditor provides to the
20 Regulation (EU) No 537/2014 of the European Parliament and of the Council of 16 April 2014 on specific requirements regarding statutory audit of public-interest entities and repealing Commission Decision 2005/909/EC.

NBB_2024_12 - 16 July 2024 Circular - Page 29/53 audit committee, if such a committee has been established, or to the statutory governing body and (ii) the management letters relating to aspects of internal control. For Belgian branches of credit institutions or stockbroking firms governed by the law of non-EEA countries, the accredited statutory auditor may not have access to the persons concerned and/or the relevant documents and therefore may not be able to carry out the abovementioned procedures. In this case, the accredited statutory auditor shall assess the internal controls based on the information at the branch’s disposal. The accredited statutory auditor shall consider whether any serious shortcomings in the documentation and/or internal controls should be reported to the lead auditor in accordance with the International Standards on Auditing (ISA). The accredited statutory auditor shall inform the supervisory authority of any communication with the lead auditor. 2.3.1.2.4.ANNUAL STATEMENT BY THE ACCREDITED STATUTORY AUDITOR/ACCREDITED AUDITOR ON SPECIAL MECHANISMS On this point, reference is made to the Bank’s uniform letter of 6 July 2021 to accredited statutory auditors concerning their obligations regarding special mechanisms. Accredited statutory auditors shall also pay particular attention to compliance with the NBB’s circulars of 6 July 2021, NBB_2021_16 on special mechanisms and NBB_2021_17 on prevention policy in tax matters. IREFI-IRAIF has developed a template for the annual statement on special mechanisms21 which must be used by accredited statutory auditors for reporting to the supervisory authority. The latter calls on accredited statutory auditors to adapt this statement to the specific circumstances and their findings (or those of the accredited auditor in the case of a branch), exercising professional scepticism and professional judgment. Where appropriate, accredited statutory auditors shall make use of the early warning function in the event problems and/or violations are detected and notify the Bank of their findings rather than await submission of the aforementioned annual statement.
2.3.1.3. SPECIAL REPORTS
The supervisory laws allow the supervisory authority to request special reports from accredited statutory auditors. At the supervisory authority’s request, accredited statutory auditors shall provide special reports on the organisation, activities, and financial structure of financial institutions or any other subject relevant to the exercise of prudential supervision by the supervisory authority. When the supervisory authority requests a special report from the accredited statutory auditor, it shall do so in writing, with a copy of its request to the financial institution concerned. The letter by which the supervisory authority entrusts the accredited auditor with the engagement shall include at least the following information:
✓ the purpose of the engagement;
✓ a description of the management body’s responsibility for the area(s) to which the engagement relates; ✓ the scope of the engagement having regard to the applicable legislation, regulations, and circulars; ✓ the form of the special report; ✓ the deadline for submission of the special report to the supervisory authority. Before entrusting an accredited statutory auditor with a special engagement in writing, the supervisory authority shall contact the accredited statutory auditor and discusses the appropriate wording. Depending on the type and nature of the special report, the supervisory authority and the accredited statutory auditor shall agree on the professional standards to be applied by the accredited statutory auditor in order to carry out the engagement. 21 See the IBR-IRE’s website - Notice 2021-11 to accredited auditors (www.ibr-ire.be).

Circular - Page 30/53 NBB_2024_12 - 16 July 2024 The auditor’s fee for drafting the abovementioned special report and carrying out the necessary procedures shall be borne by the financial institution. The accredited statutory auditor shall negotiate this fee with the financial institution in advance; the fee shall be paid directly to the auditor by the financial institution. The supervisory authority shall receive a copy of the fee statement. The accredited statutory auditor shall send a copy of the special report to the financial institution’s management. The report is protected by a duty of professional secrecy pursuant to Article 35 of the Act of 22 February 1998 laying down the organic statute of the National Bank of Belgium.
2.3.1.4. OTHER DOCUMENTS TO BE SUBMITTED TO THE SUPERVISORY AUTHORITY
The following documents must also be submitted to the supervisory authority in accordance with the latter’s instructions, in the various lines provided to this end in the NBB Supervision portal (OneGate) so as to enable the supervisory teams to verify that all necessary documents have been submitted.

the additional report referred to in Article 11 of Regulation (EU) No 537/2014 to be submitted by
the accredited statutory auditor on an annual basis to the audit committee, if such a committee has been set up, or to the statutory governing body;
the management letters prepared by the accredited statutory auditor setting out findings and
recommendations (including a timetable for the implementation of corrective measures by the management body) to strengthen and/or improve the internal control framework or other aspects of the financial institution; and
auditor’s reports drawn up in accordance with the Code of Companies and Associations
(CCA).
22,
23
2.3.1.5. NBB SUPERVISION PORTAL
The NBB Supervision portal24 enables all institutions subject to supervision by the Bank and their accredited statutory auditors to keep track of their prudential supervision reporting obligations (Communication NBB_2022_14 dated 28 June 2022). The portal provides financial institutions and accredited statutory auditors with a complete view, per institution, of the reporting expected by the supervisory authority (in the form of a “reporting sheet”) as well as the reporting deadlines. Accredited statutory auditors are asked to log in to the portal to identify, for each financial institution, the type, nature, and timetable for the submission of reports to the Bank. The supervisory authority expects accredited statutory auditors to comply strictly with the reporting timetable, so as to facilitate the performance of its prudential supervisory tasks.
2.4. INTERACTION BETWEEN THE SUPERVISORY AUTHORITY AND ACCREDITED STATUTORY AUDITORS
Cooperation by accredited statutory auditors with prudential supervision by the supervisory authority forms part of an exchange of information, the aim of which is to strengthen synergies between supervisory actions by the supervisory authority and by accredited statutory auditors. 22 For public interest entities (PIEs), key audit matters, as referred to in International Standard on Auditing (ISA) 701 - Communication of Key Audit Matters in the Independent Auditor’s Report, shall also be included in the comprehensive report submitted by the accredited statutory auditor to the supervisory authority (see Annex 1). Key audit matters are “those matters that, in the auditor’s professional judgment, were of most significance in the audit of the periodic prudential returns of the current period”. 23 If an unqualified audit opinion is not issued, the accredited statutory auditor must justify this fact and include references to explanatory paragraphs, points for attention, the basis for the opinion and any limitations. 24 Practical information on NBB Supervision can be found on the Bank’s website: NBB Supervision Portal Helpdesk | nbb.be. In the event of access problems, accredited statutory auditors are advised to read the FAQ before contacting the Bank.

NBB_2024_12 - 16 July 2024 Circular - Page 31/53 Three aspects of this interaction are discussed below:
✓ The early warning function;
✓ Communications made on the supervisory authority’s own initiative ✓ Other periodic exchanges and consultations
2.4.1. EARLY WARNING FUNCTION

The various supervisory laws applicable to financial institutions subject to prudential supervision
by the supervisory authority provide that: “As part of their duties, accredited statutory auditors shall report to the supervisory authority on their own initiative as soon as they become aware of:
(a) decisions, facts or developments that significantly influence the financial situation of the institution or its administrative and accounting procedures or internal control; (b) decisions or facts that could constitute violations of the Code of Companies and Associations, the institution’s articles of association, the supervisory laws and their implementing decrees and regulations; (c) other decisions or facts likely to lead to a refusal to certify or qualifications with regard to certification of the accounts.”
It is incumbent on accredited statutory auditors, as part of the early warning function, to adopt an
approach to their engagement that focuses on prevention, not only in the short term (as is the case for the certification of financial statements and of periodic prudential returns) but also in the medium and long term (prudential supervisory objective). Consequently, they shall provide the supervisory authority with any information deemed relevant from a prudential point of view and/or likely to require urgent action by the supervisory authority of which they become aware in the performance of their duties (both under private law and under public law).
The supervisory authority expects accredited statutory auditors to exercise professional judgment
and to comply strictly with the requirements for the timely and appropriate exercise of the early warning function.
Accredited statutory auditors may not be held liable for informing the supervisory authority in
good faith in accordance with the scheme described above.
The statutory and regulatory provisions expressly state that accredited statutory auditors:
✓ shall make use of the early warning function; ✓ shall report to the supervisory authority on their own initiative; ✓ shall immediately disclose their findings to the supervisory authority, without waiting for submission of their half-yearly or annual report; ✓ shall report to the supervisory authority in accordance with the applicable statutory and regulatory provisions (see below). The aforementioned significant decisions, facts, or developments concern both the financial institution itself and any entities related to it (subsidiaries or affiliates) for which the accredited statutory auditor performs an audit engagement.
As regards the arrangements for communication between the supervisory authority and
accredited statutory auditors, it is agreed that:
✓ accredited statutory auditors shall provide information spontaneously, either orally or in writing; it is recommended that an oral communication be followed as quickly as possible by written confirmation; ✓ priority shall be given to the timeliness (speed) of communications rather than their accuracy or completeness; ✓ in their communications to the supervisory authority, accredited statutory auditors shall explicitly indicate: (i) the actual or potential problems identified; (ii) if possible, the causes of these problems; and (iii) their reasoned opinion on the matter;

Circular - Page 32/53 NBB_2024_12 - 16 July 2024 ✓ communications by accredited statutory auditors using the early warning function cover the following areas (non-exhaustive list):

Communication of information that has or may have a material impact on the financial
and prudential situation of the audited institution o impossibility to confirm the periodic prudential returns or when the report at the end of the first half of the financial year and/or the audit opinion at the end of the financial year on periodic prudential returns contains additional texts that impact the type of conclusion and/or audit opinion issued (see below, qualified opinion, adverse opinion, disclaimer of opinion); o significant and persistent delays in the submission of the auditor’s reports and a justification for the delays, a remediation plan, and a schedule for reporting as soon as possible in agreement with the operational departments; 25 o significant errors in financial and/or prudential reporting; o serious risk assessment issues, depending on the nature and activities of the financial institution; o fraud likely to result in significant losses; o the granting of an interim dividend by a financial institution with insufficient or barely sufficient capital; o significant new or as yet undisclosed litigation or significant litigation with an unfavourable outcome (significant litigation known to the supervisory authority); o serious financial difficulties within a branch or (foreign) subsidiary; o application of Articles 7:228 and 7:229 CCA (loss of share capital and alarm bell procedure); o a significant loss of depositors likely to give rise to liquidity problems; o a significant redemption of insurance contracts likely to give rise to liquidity problems; o application of Articles 7:96 (director with a conflict of interest) and 7:97 (related-party transaction) CCA and noncompliance by the financial institution with the provisions of the CCA; o serious facts likely to give rise to a report to the statutory governing body pursuant to
Article 3:69 CCA;
o problems with the way in which permanent inventories are kept up to date; o etc.
Communication of information that has or may have a significant impact on the
administrative and accounting procedures and internal control of the audited institution o significant developments within the internal governance of the financial institution; o major reorganisation; o major conflict within the management body and/or the statutory governing body and/or the audit committee; 25 If the delay encountered by an accredited statutory auditor in reporting to the supervisory authority is attributable to the financial institution, the supervisory authority expects these problems to be addressed in the auditor’s report on the assessment of internal control and particularly in the comprehensive report, with a detailed description of the problems encountered, the (organisational and/or internal control) reasons for the delay in providing information to the accredited statutory auditor, and the remedial measures taken by the financial institution to provide the necessary documents and information as soon as possible so as to enable the accredited statutory auditor to report thereon within the deadlines imposed by the supervisory authority.

NBB_2024_12 - 16 July 2024 Circular - Page 33/53 o serious difficulties within the independent control functions (internal audit, compliance, and risk management functions; the actuarial function for insurance companies); o serious difficulties in managing the risks inherent in the financial institution; o frequent and significant overruns of internal limits; o change in the general policy of the financial institution, in particular the sudden development of a new activity in the absence of adequate means of control; o the unexpected departure of a key employee; o major events within foreign branches and subsidiaries; o important questions raised during the audit engagement with regard to compliance with provisions on investment activities and services; o information and findings relating to the existence of special mechanisms as defined in the various supervisory laws; o information and findings relating to non-compliance with laws, regulations, and European and international guidelines on the prevention of money laundering and terrorist financing applicable to financial institutions; o etc.

Communication of information that could constitute a violation of the Code of
Companies and Associations, the audited entity’s articles of association, the supervisory laws and their implementing decrees and regulations
Prior communication of the reasons for the resignation of an accredited statutory auditor
(see point 2.1.5 above).
Communication of information that may lead to: the modification of an unqualified audit
opinion that requires the inclusion of (an) explanatory paragraph(s) and/or other specific point(s) for attention; an adverse opinion; a disclaimer of opinion; a qualified opinion with a justification for the qualification(s) or any other grounds modifying the audit opinion and/or confirmations required by the supervisory laws (for periodic prudential returns) from accredited statutory auditors on the annual and/or consolidated accounts and related periodic prudential returns.
Facts arising between two audit reports that could significantly alter the information previously
reported shall be notified without delay to the supervisory authority making use of the early warning function referred to in the various sector-specific supervisory laws.
2.4.2. COMMUNICATIONS MADE ON THE SUPERVISORY AUTHORITY’S INITIATIVE TO ACCREDITED STATUTORY
AUDITORS
The supervisory authority shall inform the accredited statutory auditor of any changes to the
contact persons in the Bank’s departments responsible for prudential supervision of the financial institution and, where applicable, within the JST.
The supervisory authority shall forward to the accredited statutory auditor a copy of any
correspondence it addresses to the financial institution and which, in its opinion, may be of interest to the accredited statutory auditor in performance of the statutory audit engagement.
Where appropriate, the supervisory authority shall invite the accredited statutory auditor to attend
its discussions with the financial institution and/or shall keep the auditor informed of the content and outcome of these discussions.
The accredited statutory auditor shall be informed of the conduct and nature of inspections at the
financial institution. During an inspection, the inspectors may approach the accredited statutory

Circular - Page 34/53 NBB_2024_12 - 16 July 2024 auditor for bilateral talks on the subject of the inspection, if they consider this to be useful or necessary. A copy of the final inspection report shall be sent to the accredited statutory auditor. Reference is made to Circular NBB_2023_09 of 14 November 2023 on inspections carried out by the Bank. In principle, the supervisory authority monitors the follow-up of its recommendations. However, in certain cases, it may request the assistance of the accredited statutory auditor to ensure that deadlines are met and that its recommendations are effectively implemented.
2.4.3. OTHER PERIODIC EXCHANGES AND CONSULTATIONS
In addition to the provision of information on their own initiative and the periodic reports described above, the supervisory authority aims to encourage and develop regular additional exchanges with accredited statutory auditors. The purpose of cooperation between accredited statutory auditors and the supervisory authority is to enhance the effectiveness of prudential supervision. In this regard, the Joint Supervisory Teams (JST) act as an interface for credit institutions subject to direct supervision by the European Central Bank. Where appropriate, representatives of financial institutions may be invited to participate in the discussions (trialogue). In this case, the positions of the supervisory authority and the accredited statutory auditor should be coordinated prior to the meeting with the financial institution concerned. Periodic consultation is without prejudice to the respective responsibilities of the accredited statutory auditor and the supervisory authority. FREQUENCY OF MEETINGS ✓ For significant credit institutions (SIs) and other significant financial institutions, a meeting shall be held annually, but this frequency may be reviewed in the light of certain criteria (specific risks, prudential points for attention, emerging issues, etc.) and in accordance with the Bank’s instructions. In addition to this annual meeting, the Bank may organise a trialogue with the audited institution, the accredited statutory auditor, and the supervisory authority. ✓ For other institutions (LSIs or smaller), it is recommended that at least one meeting per year be held between the supervisory authority and the accredited statutory auditor. The holding of such an annual meeting is left to the discretion of the supervisory authority or the accredited statutory auditor. If deemed appropriate, formal minutes of the periodic meeting shall be drawn up by the supervisory authority. These minutes shall be sent to the accredited statutory auditor for approval. Periodic consultation between the accredited statutory auditor and the supervisory authority is without prejudice to the accredited statutory auditor’s early warning function, any disclosures made by the accredited statutory auditor to the supervisory authority under the supervisory laws, and communications by the supervisory authority to the accredited statutory auditor as detailed above. Finally, exchanges between the accredited statutory auditor and the supervisory authority may also be organised in the context of inspections carried out by the latter. EUROPEAN BRANCHES The cooperation of accredited auditors in the supervision exercised by the supervisory authority over European branches of credit institutions and stockbroking firms is based on an exchange of information which is, however, limited to those areas for which the supervisory authority is responsible or which forms part of the cooperation with the supervisory authorities of the home country.

NBB_2024_12 - 16 July 2024 Circular - Page 35/53 This exchange of information between the supervisory authority and accredited auditors may take the following forms:

Communications made on the initiative of accredited auditors to the supervisory authority through
the early warning function pursuant to Article 326 §2, subparagraphs 1(4) and 2, of the Banking Act 26 For European branches, the principles and procedures set out in section 2.4.1 above apply by analogy to the early warning function.
Other communications made on the initiative of accredited auditors to the supervisory authority
✓ Article 326 § 2, subparagraph 3, last sentence, of the Banking Act 27 - Accredited auditors shall provide the supervisory authority with a copy or inform it of the content of the main reports and letters they send to senior management of branches. ✓ Article 326 § 2, subparagraph 6, of the Banking Act 28 - Where accredited auditors, at the request and expense of the competent authorities of the home state of the branch, carry out verifications relating to certain matters for the purpose of providing assistance, they shall inform the supervisory authority of the results of such verifications, insofar as they relate to matters falling under its responsibility.

SPECIFIC EXPECTATIONS BY SECTOR OF ACTIVITY
3.1. CREDIT INSTITUTIONS
3.1.1. AUDITOR’S REPORTS ON PERIODIC PRUDENTIAL RETURNS
Please see point 2.3.1.2.2 of this circular.

List of applicable statutory provisions
Article 225, paragraph 1(2), of the Banking Act
Periodic prudential returns
The periodic prudential returns to be reported on by the accredited statutory auditor in accordance with
Article 225, paragraph 1(2), of the Banking Act are listed in Annex 3.
In cooperation with the supervisory authority, each credit institution shall prepare a so-called reporting sheet, available in the NBB Supervision portal, listing all tables the credit institution is required to submit to the supervisory authority. The tables mentioned on the reporting sheet constitute the periodic prudential returns referred to in Articles 106 §2 and 225, paragraph 1(2), of the Banking Act. However, a specific audit approach for the periodic prudential returns of credit institutions has been developed, which includes a risk analysis and a three-year revolving audit plan (see Annex 3). 26 See the corresponding provisions:
Article 216 of the Brokerage Supervision Act;
Article 36 of the Royal Decree of 26 September 2005, which indirectly refers to Article 31 of the same
decree.
27 See also Article 11 §1, third subparagraph, last sentence, of the Royal Decree of 20 December 1995, as well as Article 36 of the Royal Decree of 26 September 2005 which indirectly refers to Article 31 of the same decree. 28 See also Article 598 in conjunction with Article 326 §2, sixth subparagraph of the Banking Act.

Circular - Page 36/53 NBB_2024_12 - 16 July 2024 Depending on prudential or economic developments, the Bank may request that more attention be paid to certain tables. In this case, it shall consult with the accredited statutory auditor and/or IREFIIRAIF in advance on this subject during its regular contacts with them. In order to carry out their duties, accredited statutory auditors shall request from the management committee the statement referred to in Article106 §2, second subparagraph, of the Banking Act.

Clarifications regarding compliance with regulatory standards and obligations under the Capital
Requirements Regulation (CRR) and Article 98 of the Banking Act In the case of a model-based approach, i.e., a credit institution directly calculates its own funds using internal models or uses models as input to calculate its own funds requirement (such as the PD, LGD and/or EAD models for credit risk), 29 the accredited statutory auditor cannot develop or validate the model, having regard to the independence required of auditors in the performance of their statutory duties. If a credit institution wishes to call upon an accredited auditor to develop or validate the models it uses, this individual must be completely independent of its accredited statutory auditor. 30 Verifying compliance with the conditions for the approval of internal models, as defined in the regulatory standards, is not the responsibility of the accredited statutory auditor, without prejudice to the specific tasks provided for by Article 225, paragraph 1(3), of the Banking Act31 and the following paragraph. The term “conditions for approval” refers in particular to the initial approval of models, the monitoring of certain quality requirements and the annual review. The accredited statutory auditor shall ensure that the capital calculation methodology used to prepare periodic prudential returns is correct under the applicable regulations, with the exception of the methodologies for calculation of the PD, LGD and CCF parameters which have been approved by the supervisory authority. Thus, the accredited statutory auditor shall ensure that the results of the model-based approach are correctly reflected in the periodic prudential returns and that all positions are taken into account in the calculation of own funds requirements (e.g. all outstanding loans for credit risk models). Also, for the NI approach, the accredited statutory auditor shall ensure that the institution includes all outstanding loans and all credit risk mitigation techniques in the own funds “calculator”, together with all other necessary factors provided for by regulation (nature of the counterparty - other credit institutions, public authorities, etc.; nature of the exposure - balance sheet, derivative, etc.; amount, rating/PD, LGD, maturity, a CCF for off-balance sheet transactions and the formula used to calculate the exposure). For a non-model-based approach to the calculation of capital requirements, the accredited statutory auditor shall confirm the following:
− operational risk: the correctness and completeness of the calculation insofar as it is based on the accounts or on analytical accounting that can be reconciled with the accounts, as well as the correctness and completeness of the reporting obligations for losses arising from the materialisation of an operational risk; 29 Insofar as this has an impact on the periodic prudential returns. 30 The desired degree of independence implies in particular that the accredited statutory auditor and/or the accredited audit firm (regardless of who represents it) engaged to audit the accounts and the standalone or consolidated periodic prudential returns may not develop models on behalf of the institution or participate in the internal validation of these models. The same restriction applies to external experts called upon by the accredited statutory auditor or accredited audit firm in connection with the audit engagement. The foregoing is without prejudice to the prohibitions and limitations on non-audit services set out in Regulation (EU) No 537/2014 of the European Parliament and of the Council of 16 April 2014 on specific requirements regarding statutory audit of public-interest entities and repealing Commission Decision 2005/909/EC. 31 For central securities depositories, organisations providing support to central securities depositories and custodian banks, Article 31, paragraph 1(3), of the Royal Decree of 26 September 2005.

NBB_2024_12 - 16 July 2024 Circular - Page 37/53 − market risk: the adequacy of the calculation and the valuation of positions (verification that all positions have been taken into account as prescribed by the CRR and that the own funds requirements have been calculated correctly and completely [as defined in the applicable supervisory laws] on the basis of the calculation tables); − credit risk: see the table in Annex 2. As regards reporting on IRRBB (interest rate risk in the banking book), the instructions on the use of internal models to calculate the capital requirements apply mutatis mutandis. This means that the accredited statutory auditor does not validate the calculation method but rather ensures that the credit institution applies the methodology correctly using the rate scenarios, the assumptions on behaviourdependent items such as savings deposits and sight deposits, other required parameters, the EBA regulatory technical standards (EBA/RTS/2022/10), and Circulars NBB_2023_07 and NBB_2023_17. More specifically, the accredited statutory auditor shall examine whether all interest-bearing positions in the banking book are included in the calculations in the manner specified by the present circular. If the institution uses the standard method or simplified standard method, the accredited statutory auditor shall validate its compliance with the criteria set out in EBA/RTS/2022/09. The accredited statutory auditor shall ensure that the credit institution correctly applies the reporting requirements specified in Circular NBB_2023_17 of 19 December 2023 and its annexes, setting out the reporting obligations related to interest rate risk and credit spread risk for non-trading activities, and by EBA/ITS/2023/03. The accredited statutory auditor shall also issue positive confirmation of the correctness and completeness of the COREP tables relating to the leverage ratio and liquidity risk. The definition of stable and other retail deposits and operational deposits, as well as compliance with the general and operational rules for liquid assets in accordance with the instructions, are points for attention in relation to the liquidity risk tables. Further to the quantitative reporting obligation for proprietary trading activities (on a consolidated basis) provided for by Circular NBB_2022_20 of 14 September 2022, 32 the accredited statutory auditor shall verify whether the institution reports, in accordance with the aforementioned circular, in FINREP F01.01, F01.02 and F10.00 tables on all derivatives and balance sheet items held for trading purposes (as defined in Article 4.1(85) CRR). In particular, the accredited statutory auditor shall check that the institution reports on the materiality thresholds for proprietary trading activities in accordance with the provisions of Annex 1 to Circular NBB_2022_20. Further to the quantitative reporting obligation for proprietary trading activities (on a company basis) provided for by Circular NBB_2022_20
of 14 September 2022, the accredited statutory auditor shall verify whether the institution allocates in full positions in securities held for trading purposes to the trading portfolio rather than to the investment portfolio, taking into account the requirements in effect as mentioned in the Royal Decree of 23 September 1992 on the annual accounts of credit institutions, investment firms and management companies of undertakings for collective investment. The accredited statutory auditor shall examine whether the institution considers all derivatives that do not constitute hedging transactions, based on the implementing rules of the aforementioned royal decree, to be derivatives held for trading purposes. In particular, the accredited statutory auditor shall verify whether the institution reports on the materiality thresholds for proprietary trading activities in accordance with the provisions of Annex 1 to the aforementioned Circular NBB_2022_20. 32 Circular NBB_2022_20 of 14 September 2022 - Periodic qualitative and quantitative reporting requirements for proprietary trading

Circular - Page 38/53 NBB_2024_12 - 16 July 2024 The financial information reported using Schedule A and the FINREP tables is very important for the prudential supervision of credit institutions. In the context of their engagement, accredited statutory auditors shall therefore pay particular attention to the following issues:

The correct classification of financial assets in the accounting portfolios, whether under IFRS or
Belgian accounting standards. Particular attention shall be paid to the implementation of concepts involving a greater degree of judgment (such as the SPPI test or the definition of business models under IFRS 9 - Financial Instruments).
Valuation of assets and/or liabilities at fair value or market value where this is required by Belgian
accounting standards or IFRS. Particular attention shall be paid to valuations using a model-based approach or non-market data.
The valuation of financial asset impairments, in particular in the context of implementing and
applying the expected credit losses approach provided for by IFRS 9 - Financial Instruments. In this respect, the accredited statutory auditor shall also examine whether the credit institution has adequately and fully taken into account EBA guidelines (BCBS/EBA guidelines implemented by the Bank).
The accounting treatment of income and expenses.
Circular NBB_2021_20 of 5 October 2021 on the application of Article 36bis of the Royal Decree of
23 September 1992 on the annual accounts of credit institutions sets out the conditions and formalities to be fulfilled by credit institutions in order to obtain and maintain an authorisation from the Bank for macro-hedging strategies. The data quality of periodic prudential returns is crucial for prudential supervision by the Bank (at both the national and European levels) and, as such, demands particular attention. As specified in Circular NBB_2017_27 of 12 October 2017 on the Bank’s expectations regarding the quality of reported prudential and financial information, the verification of compliance with these requirements in terms of the quality of prudential and financial data forms part of the duties of accredited statutory auditors and shall be carried out in accordance with procedures agreed in consultation with IREFIIRAIF.
3.1.2. AUDITOR’S REPORTS ON THE ASSESSMENT OF INTERNAL CONTROL AND OF INTERNAL CONTROLS
RELATING TO INVESTMENT SERVICES AND ACTIVITIES
List of applicable statutory provisions
Article 225, paragraph 1(1) and (5), of the Banking Act:
33 the accredited statutory auditor’s engagement Articles 21, 41, 42, 65, 65/1 and 66 of the Banking Act: internal organisation
3.1.2.1. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROL
Please see point 2.3.1.2.3 of this circular. With regard to branches of credit institutions governed by the law of another European Economic Area (EEA) country, this report deals only with “general good” provisions, as published on the Bank’s website.
3.1.2.2. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROLS RELATING TO INVESTMENT
SERVICES AND ACTIVITIES
Where the audited financial institution is (i) a credit institution, (ii) a stockbroking firm, (iii) a Belgian branch of a credit institution or stockbroking firm governed by the law of an EEA or non-EEA country, (iv) a central securities depository, organisation providing support to central securities depositories, or custodian bank, (v) an authorised or designated financial holding company governed by Belgian law, (vi) an authorised or designated mixed financial holding company governed by Belgian law, (vii) an investment holding company or a mixed financial holding company governed by Belgian law falling 33 For branches of credit institutions governed by the law of non-EEA countries, see also Article 338, paragraph 3, of the Banking Act.

NBB_2024_12 - 16 July 2024 Circular - Page 39/53 within the scope of supervision on a consolidated basis or review of the capitalisation test for a group of investment firms by the Bank, the accredited statutory auditor shall carry out an assessment of the internal controls relating to investment services and activities, in particular based on the management body’s assessment of these subjects. This assessment falls within the framework described in
section 2.3.1.2.3 above.
For investment services and activities by the aforementioned firms, the accredited statutory auditor’s engagement includes assessment of the operational risks explicitly mentioned by law: (i) measures to prevent conflicts of interest, (ii) measures to ensure the continuity of investment services and activities, (iii) risk mitigation measures where the performance of essential operational tasks is entrusted to a third party, (iv) the retention of data relating to investment services and activities carried out by the financial institution, (v) measures to protect the rights of clients in the event of insolvency of the institution when it holds financial instruments belonging to its clients, and (vi) measures designed to prevent the use by the financial institution, acting on its own behalf, of client financial instruments (except with the client’s express consent). To this end, the accredited statutory auditor shall at least carry out the procedures described in the
section of the auditor’s report on the management body’s assessment of internal controls.
3.2. STOCKBROKING FIRMS
3.2.1. AUDITOR’S REPORTS ON PERIODIC PRUDENTIAL RETURNS
Please see point 2.3.1.2.2 of this circular.

List of applicable statutory provisions
For “large stockbroking firms” as defined in Article 3(5) of the Brokerage Supervision Act: Article 198 §2 of the Brokerage Supervision Act in conjunction with Article 225, paragraph 1(2), of the Banking Act. For other stockbroking firms, including “class 2 and class 3 stockbroking firms”: Article 198 §1(2) of the Brokerage Supervision Act.
Periodic prudential returns
Periodic prudential returns mean the comprehensive prudential information and other figures referred to in the relevant Belgian and European texts, including certain information that stockbroking firms must submit to the supervisory authority in the context of prudential supervision of compliance with regulatory standards and obligations pursuant to Regulation (EU) 2019/203334 of 27 November 2019, hereinafter the IFR, and the Brokerage Supervision Act. In cooperation with the supervisory authority, each stockbroking firm shall prepare a reporting form, available in the NBB Supervision portal, listing all tables the firm is required to submit to the supervisory authority. The periodic prudential returns to be reported on by the accredited statutory auditor shall be prepared in accordance with the following provisions:
✓ for “large stockbroking firms”: Article 109 §6 of the Brokerage Supervision Act in conjunction with
Article 106 §2 of the Banking Act;
✓ for “class 2 and class 3 stockbroking firms”: Article 109 §2 of the Brokerage Supervision Act. 34 Regulation (EU) 2019/2033 of the European Parliament and of the Council of 27 November 2019 on the prudential requirements of investment firms and amending Regulations (EU) No 1093/2010, (EU) No 575/2013, (EU) No 600/2014 and (EU) No 806/2014.

Circular - Page 40/53 NBB_2024_12 - 16 July 2024 To fulfil the audit engagement, accredited statutory auditors shall request from the management committee the statement referred to in Article 109 §2, second subparagraph, of the Brokerage Supervision Act.

Compliance with regulatory standards and obligations pursuant to Regulation No 575/2013 (CRR)
and Article 108 of the Brokerage Supervision Act in conjunction with Articles 94-105 of the Banking Act for “large stockbroking firms” and the IFR and Articles 106 and 107 of the Brokerage Supervision Act for “class 2 and class 3 stockbroking firms”. The Bank specifies below the information the accredited statutory auditor is required to confirm for purposes of compliance with regulatory standards and obligations under the CRR and the Banking Act and, where applicable, the IFR and the Brokerage Supervision Act (referred to as the regulatory tables or, where applicable, the COREP tables). The accredited statutory auditor shall provide positive confirmation that the total own funds for compliance with solvency requirements is complete and accurate. For a model-based approach, i.e. one in which the stockbroking firm calculates its own funds directly using models, 35 the accredited statutory auditor shall refer to the work to be carried out as described in the model-based approach defined above for credit institutions. The monitoring of compliance with the conditions for the approval of internal models, as defined in the regulatory standards, is not the responsibility of the accredited statutory auditor, without prejudice to the specific tasks provided for by Article 198 §2 of the Brokerage Supervision Act, Article 225, paragraph 1(3) of the Banking Act, and the following paragraph for “large stockbroking firms” and
Article 198 §1(3) of the Brokerage Supervision Act and the following paragraph for “class 2 and class 3
stockbroking firms”. The term “conditions for approval” should be understood as referring in particular to the initial approval of models, the monitoring of certain quality requirements and the annual review by the supervisory authority. The accredited statutory auditor shall ensure that the results of the model-based approach are correctly reflected in the periodic prudential returns and that all positions are taken into account in the calculation of own funds requirements (e.g. all market risk positions for VaR models). For a non-model based approach to the calculation of own funds requirements for “large stockbroking firms” (classes 1A and 1B), the accredited statutory auditor shall confirm, as regards:
operational risk: the correctness and completeness of the calculation insofar as it is based on the
accounts or on analytical accounting that can be reconciled with the accounts, as well as the correctness and completeness of the reporting obligations relating to losses arising from the materialisation of operational risk;
market risk: the adequacy of the calculation and the valuation of positions (verification that all
positions have been taken into account as prescribed by the CRR and that the own funds requirements have been calculated correctly and completely on the basis of the calculation tables);
credit risk: see the table in Annex 1.
For a non-model-based approach to the calculation of capital requirements for “class 2 and class 3 stockbroking firms”, the accredited statutory auditor shall refer to provisions applicable to investment firms set out in Regulation (EU) 2019/2033 of 27 November 2019 (IFR). The data quality of periodic prudential returns is crucial for prudential supervision by the Bank (both at the national and European levels) and, as such, demands particular attention. As specified in 35 Insofar as this has an impact on the periodic prudential returns.

NBB_2024_12 - 16 July 2024 Circular - Page 41/53 Circular NBB_2017_27 of 12 October 2017 on the Bank’s expectations regarding the quality of reported prudential and financial data, the verification of compliance with requirements regarding the quality of prudential and financial data forms part of the duties of the accredited statutory auditor and shall be carried out in accordance with procedures agreed in consultation with IREFI-IRAIF.
3.2.2. AUDITOR’S REPORTS ON THE ASSESSMENT OF INTERNAL CONTROL AND OF INTERNAL CONTROLS
RELATING TO INVESTMENT SERVICES AND ACTIVITIES

List of applicable statutory provisions
The accredited statutory auditor’s engagement
✓ For “large stockbroking firms”: Article 198 §2 of the Brokerage Supervision Act in conjunction with
Article 225, paragraph 1(1) and (5) of the Banking Act.
✓ For “class 2 and class 3 stockbroking firms”: Article 198 §1(1) and (5) of the Brokerage Supervision Act. Internal organisation ✓ For “large stockbroking firms”: Articles 21, 41, 42, 65, 65/1 and 66 of the Banking Act. ✓ For “class 2 and class 3 stockbroking firms”: Articles 17, 37, 38, 69, 70 and 73 of the Brokerage Supervision Act.
3.2.2.1. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROL
Please see point 2.3.1.2.3 of this circular.
For branches of a stockbroking firm incorporated under the law of another European Economic Area (EEA) country, this report relates only to “general good” provisions, as published on the Bank’s website (see Article 221 §2 of the Brokerage Supervision Act).
3.2.2.2. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROLS RELATING TO INVESTMENT
SERVICES AND ACTIVITIES
Section 3.1.2.2 of this circular applies in full to stockbroking firms. The accredited statutory auditor
shall refer to that section to determine the nature of the work to be carried out for the management body’s report on the assessment of internal controls relating to investment services and activities.
3.3. PAYMENT INSTITUTIONS
3.3.1. AUDITOR’S REPORTS ON PERIODIC PRUDENTIAL RETURNS
Please see point 2.3.1.2.2 of this circular.
List of applicable statutory provisions
Article 115 §3 of the Act of 11 March 2018
Periodic prudential returns
Periodic prudential returns mean the detailed financial statements and other figures referred to in
Article 77 of the Act of 11 March 2018. This term also covers certain information that payment
institutions are required to submit to the Bank to comply with regulatory standards and obligations pursuant to Article 33 §2 of the Act of 11 March 2018. The periodic prudential returns to be reported on by the accredited statutory auditor are listed on the “reporting sheet” for the payment institution concerned.

Circular - Page 42/53 NBB_2024_12 - 16 July 2024 To fulfil the audit engagement, the accredited statutory auditor shall request from the institution’s management committee the statement referred to in Article 78 of the Act of 11 March 2018.

Compliance with regulatory standards and obligations pursuant to Article 33 §2 of the Act of 11
March 2018
The Bank specifies below the periodic prudential returns that the accredited statutory auditor is required to confirm for purposes of compliance with regulatory standards and obligations pursuant to
Article 33 §2 of the Act of 11 March 2018 (tables for monitoring compliance with the own funds
regulation).
The accredited statutory auditor shall provide positive confirmation that the following periodic prudential returns are correct and complete:
✓ Table 2.1 - Capital adequacy of payment institutions; ✓ Table 2.2.A, 2.2.B or 2.2 C - Capital requirements, according to the calculation method imposed by the Bank; and ✓ the tables in Section 1.5 - General statistical data on payment services. The aforementioned tables form the basis for the calculation of capital/own funds, on the one hand, and, on the other, include both total capital/own funds and legally required capital/own funds, as well as the capital requirements resulting from the various methods provided by the Regulation of 10 April 2018 on the own funds of payment institutions authorised by the Royal Decree of 27 April 2018 approving the Bank’s Regulation of 10 April 2018 on the own funds of payment institutions. 36
3.3.2. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROL AND OTHER REPORTS ON INTERNAL
ORGANISATION
List of applicable statutory provisions
Article 115 §§2 and 6 of the Act of 11 March 2018: the accredited statutory auditor’s engagement
Articles 21, 38 §1, subparagraph 2(1), 34, 35, 41 and 42 §§1 and 2 of the Act of 11 March 2018:
internal organisation
3.3.2.1. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROL
Please see point 2.3.1.2.3 of this circular.
3.3.2.2. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROLS ADOPTED TO SAFEGUARD FUNDS
RECEIVED FROM USERS OF PAYMENT SERVICES AND FROM HOLDERS OF ELECTRONIC MONEY
Funds received from payment service users by payment institutions or payment institutions of
limited size governed by Belgian law and funds received from e-money holders by electronic money institutions or electronic money institutions of limited size governed by Belgian law (hereinafter, “the institutions”) must be safeguarded in accordance with Articles 42 and 194 of the Act of 11 March 2018. Circular NBB_2024_01 of 23 January 2024 - Protection des fonds pour l’exécution d’opérations de paiement et des fonds en échange de monnaie électronique clarifies the requirements set out in Article 42 §1(2)(a) and (c) and (3) and Article 194 §1(2)(a) and (c) and (3) of the Act of 11 March 2018 on the safeguarding of funds intended for the execution of payments or funds received in exchange for electronic money that are still held at the end of the business day following that on which they were received.
The aforementioned circular recommends that institutions, pursuant to Article 115 §6 or
Article 213(4) of the Act of 11 March 2018, as applicable, submit the documents and information
mentioned in sections 1, 2 and 3 of the circular to the accredited statutory auditor so that the 36 Circular NBB_2018_31 of 19 October 2021 on periodic reporting by payment institutions.

NBB_2024_12 - 16 July 2024 Circular - Page 43/53 latter can include and assess, in the annual auditor’s report, the appropriateness of the measures taken by the institution to safeguard funds received from payment service users or in exchange for the issuance of electronic money. In particular, the accredited statutory auditor shall rely on a critical assessment of the report drawn up by senior management in accordance with the provisions of Article 36 or Article 180, as the case may be, of the Act of 11 March 2018. Circular NBB_2020_27 of 8 July 2020 specifies that this report is separate from the report on internal control.

To this end, the accredited statutory auditor shall:
✓ implement at least mutatis mutandis the procedures described in the section relating to the auditor’s assessment of internal controls and the adequacy of procedures relating to compliance with the aforementioned Circular NBB_2024_01 of 23 January 2024; and ✓ provide positive confirmation that the data and annexes, contained in the tables in
Section 1.7 - Safeguarding of funds received for the execution of payments, are correct and
complete.
3.3.2.3. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROLS ADOPTED WHEN THE INSTITUTION
RELIES ON OUTSOURCING
In accordance with Article 36 or 180 of the Act of 11 March 2018, as the case may be, senior
management shall take the necessary measures to ensure compliance with and implementation of Article 38 or 195, which refers to Article 38 - Outsourcing, as applicable, and shall report once a year to the statutory governing body, the accredited statutory auditor, and the Bank. Circular NBB_2020_27 of 8 July 2020 specifies that this report is separate from that on the assessment of internal control.
To this end, the accredited statutory auditor shall at least implement mutatis mutandis the
procedures described in the section on the auditor’s assessment of internal controls. Circular NBB_2019_19 of 19 July 2019 - Guidelines of the European Banking Authority (EBA) of 25 February 2019 on outsourcing arrangements specifies the Bank’s approach to outsourcing. In accordance with Article 21 of the Act of 11 March 2018, each institution must have an adequate system of business organisation to ensure efficient and prudent management. Pursuant to Articles 38 and 195 of the aforementioned legislation, an institution that outsources operational functions, activities or tasks retains full responsibility for them. Such outsourcing may not have any of the following consequences: compromising the quality of the organisation, in particular undermining the quality of internal control; unduly increasing operational risk; or compromising the Bank’s ability to verify that the institution complies with its obligations under, or pursuant to, the Act of 11 March 2018.
The Bank has agreed that accredited statutory auditors need not issue a separate report on these
aspects of outsourcing, without prejudice to the inclusion of a critical assessment of the report by senior management and an assessment of the measures taken in relation to outsourcing in a separate section of the auditor’s report on the adequacy of internal control. The Bank expects accredited statutory auditors to assess the adequacy of the measures taken by institutions in connection with outsourcing.

Circular - Page 44/53 NBB_2024_12 - 16 July 2024
3.4. ELECTRONIC MONEY INSTITUTIONS
3.4.1. AUDITOR’S REPORTS ON PERIODIC PRUDENTIAL RETURNS
Please see point 2.3.1.2.2 of this circular.

List of applicable statutory provisions
Article 213 of the Act of 11 March 2018
Periodic prudential returns
Periodic prudential returns mean the detailed financial statements and other figures referred to in
Article 197 §2 of the Act of 11 March 2018. This term also covers certain returns that electronic money
institutions are required to submit to the Bank in order to comply with regulatory standards and obligations pursuant to Article 182 §2 of the same legislation. The periodic prudential returns to be reported on by the accredited statutory auditor are, more specifically, those listed on the reporting sheet of the electronic money institution concerned. To fulfil the audit engagement, the accredited statutory auditor shall request from the management committee the statement referred to in Article 197 §3 of the Act of 11 March 2018.
Compliance with regulatory standards and obligations pursuant to Article 182 §2 of the Act of
11 March 2018
The Bank specifies below the information that the accredited statutory auditor is required to confirm for purposes of compliance with regulatory standards and obligations pursuant to Article 182 §2 of the Act of 11 March 2018, namely the Bank’s Regulation of 2 October 2018 on the own funds (capital) of electronic money institutions and the investment of funds received in exchange for electronic money, approved by the Royal Decree of 21 March 2019 (tables for monitoring compliance with the own funds regulation ). The accredited statutory auditor shall provide positive confirmation that the data in tables 2.1 (available capital/own funds) and 2.2 (capital/own funds requirements) are complete and correct. These tables include both total capital/own funds and legally required capital/own funds, as well as the capital requirements resulting from the various methods proposed in the aforementioned regulation on the own funds of electronic money institutions. 37
3.4.2. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROL AND OTHER REPORTS ON INTERNAL
ORGANISATION
List of applicable statutory provisions
Article 213 (115 §§2 and 6) of the Act of 11 March 2018: the accredited statutory auditor’s
engagement
Articles 176, 194 and 195 of the same legislation: internal organisation
3.4.2.1. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROL OVER FINANCIAL REPORTING
Please see point 2.3.1.2.3 of this circular.
37 Circular NBB_2019_10 of 19 October 2021 on prudential periodic returns reporting by electronic money institutions.

NBB_2024_12 - 16 July 2024 Circular - Page 45/53
3.4.2.2. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROLS ADOPTED TO SAFEGUARD FUNDS
RECEIVED FROM USERS OF PAYMENT SERVICES AND FROM HOLDERS OF ELECTRONIC MONEY
3.4.2.3. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROLS ADOPTED WHEN THE INSTITUTION
RELIES ON OUTSOURCING
Sections 3.3.2.2 and 3.3.2.3 of this circular are fully applicable to electronic money institutions. The accredited statutory auditor shall refer to these sections to determine the nature of the audit work to be carried out in relation to the management body’s report on the assessment of internal controls adopted to safeguard funds received from electronic money holders and when the electronic money institution relies on outsourcing.
3.5. CENTRAL SECURITIES DEPOSITORIES, INSTITUTIONS PROVIDING SUPPORT TO CENTRAL SECURITIES
DEPOSITORIES AND CUSTODIAN BANKS
3.5.1. AUDITOR’S REPORTS ON PERIODIC PRUDENTIAL RETURNS
Please see point 2.3.1.2.2 of this circular.

List of applicable regulatory provisions
Article 31, paragraph 1(2), of the Royal Decree of 26 September 2005
Periodic prudential returns
The periodic prudential returns to be reported on by the accredited statutory auditor are those listed on the reporting sheet for the institution concerned. To fulfil the audit engagement, the accredited statutory auditor shall request the statement described in Article 38, paragraph 2, of the Royal Decree of 26 September 2005 from senior management and, if applicable, the management committee.
Compliance with regulatory standards and obligations pursuant to Article 13 of the Royal Decree
of 26 September 2005
For this part, reference is made to section 3.1.1 of this circular (“Auditor’s reports on periodic prudential returns” of credit institutions), specifically the subsection entitled “Compliance with regulatory standards and obligations pursuant to the CRR and Article 98 of the Banking Act”, which applies mutatis mutandis to central securities depositories, organisations providing support to central securities depositories and custodian banks.
3.5.2. AUDITOR’S REPORTS ON THE ASSESSMENT OF INTERNAL CONTROL AND OF INTERNAL CONTROLS
RELATING TO INVESTMENT SERVICES AND ACTIVITIES
List of applicable statutory provisions
Article 31, paragraph 1(1), of the Royal Decree of 26 September 2005: the accredited statutory
auditor’s engagement
Articles 10 and 10bis of the same decree: internal organisation
3.5.2.1. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROL
Please see point 2.3.1.2.3 of this circular.
3.5.2.2. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROLS RELATING TO INVESTMENT
SERVICES AND ACTIVITIES
Section 3.1.2.2. above applies in its entirety to central securities depositories, organisations providing
support to central securities depositories and custodian banks. The accredited statutory auditor shall

Circular - Page 46/53 NBB_2024_12 - 16 July 2024 refer to that section to determine the nature of the audit work required for the management body’s report on the assessment of internal controls relating to investment services and activities.
3.6. AUTHORISED AND DESIGNATED FINANCIAL HOLDING COMPANIES GOVERNED BY BELGIAN LAW
3.6.1. AUDITOR’S REPORTS ON PERIODIC PRUDENTIAL RETURNS
Please see point 2.3.1.2.2 of this circular.

List of applicable statutory provisions
Article 210 §2(2) of the Banking Act
Periodic prudential returns
The periodic prudential returns to be reported on by the accredited statutory auditor are those listed on the reporting sheet for the institution concerned. To fulfil the audit engagement, the accredited statutory auditor shall request the statement referred to in Article 208 of the Banking Act from senior management and, if applicable, the management committee.
Compliance with regulatory standards and obligations pursuant to Article 98 of the Banking Act
For this part, reference is made to section 3.1.1 of this circular “Auditor’s reports on periodic prudential returns” of credit institutions”, specifically the subsection entitled “Compliance with regulatory standards and obligations pursuant to the CRR and Article 98 of the Banking Act”, which applies mutatis mutandis to financial holding companies incorporated under Belgian law.
3.6.2. AUDITOR’S REPORTS ON THE ASSESSMENT OF INTERNAL CONTROL AND OF INTERNAL CONTROLS
RELATING TO INVESTMENT SERVICES AND ACTIVITIES
List of applicable statutory provisions
Article 210 §2(1) of the Banking Act: the accredited statutory auditor’s engagement
Articles 21, 41, 42 and 66 of the Banking Act: internal organisation Articles 65 and 65/1 of the Banking Act: investment services and activities
3.6.2.1. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROL
Please see point 2.3.1.2.3 of this circular.
3.6.2.2. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROLS RELATING TO INVESTMENT
SERVICES AND ACTIVITIES
Section 3.1.2.2 of this circular applies in its entirety to financial holding companies incorporated under
Belgian law. The accredited statutory auditor shall refer to that section to determine the nature of the audit work required for the management body’s report on the assessment of internal controls relating to investment services and activities.
3.7. AUTHORISED AND DESIGNATED MIXED FINANCIAL HOLDING COMPANIES GOVERNED BY BELGIAN LAW
3.7.1. AUDITOR’S REPORTS ON PERIODIC PRUDENTIAL RETURNS
Please see point 2.3.1.2.2 of this circular.

NBB_2024_12 - 16 July 2024 Circular - Page 47/53

List of applicable statutory provisions
Article 210 §2(2) of the Banking Act
Articles 433 and 434 of the Insurance Supervision Act
Periodic prudential returns
The periodic prudential returns to be reported on by the accredited statutory auditor are those listed on the reporting sheet for the institution concerned. To fulfil the audit engagement, the accredited statutory auditor shall request the statement referred to in Article 208 of the Banking Act from senior management and, if applicable, the management committee.
Compliance with regulatory standards and obligations pursuant to Articles 190 §1,
subparagraph 1(1), 191 §3, and 192 §3 of the Banking Act [Articles 457, paragraph 1(1), and 460 §2 of the Insurance Supervision Act] For information that the accredited statutory auditor is required to confirm for purposes of compliance with the regulatory standards laid down by or pursuant to Article 190 §1, paragraph 1(1), [Article 457, paragraph 1(1)] (own funds requirements that are always at least equal to solvency requirements),
Article 191 §3 [Article 460 §2] (norms or equivalent supervisory measures to monitor risk concentration
at the level of a financial services group) and Article 192 §3 [Article 462 §2] (norms or equivalent supervisory measures to achieve the objectives of supplementary supervision of the group with respect to intra-group transactions), and a return indicating the significant risk concentrations and significant intra-group transactions referred to in Article 191 §1, subparagraph 2(1) [Article 459, paragraph 1(1)] (identification and reporting of significant risk concentrations) and Article 192 §1, subparagraph 2(1) [Article 461, paragraph 1(1)] (identification and reporting of significant intra-group transactions), the accredited statutory auditor shall provide positive confirmation that the various amounts mentioned in the returns in question and the indication of significant risk concentrations and significant intra-group transactions are correct and complete.
3.7.2. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROL
List of applicable statutory provisions
Article 210 §2(1) of the Banking Act: the accredited statutory auditor’s engagement
Article 194 of the Banking Act: internal organisation
Please see point 2.3.1.2.3 of this circular.
3.8. FINANCIAL HOLDING COMPANIES AND MIXED FINANCIAL HOLDING COMPANIES GOVERNED BY FOREIGN
LAW
For:
financial holding companies governed by foreign law and
mixed financial holding companies governed by foreign law,
accredited statutory auditors are requested to contact the Bank to determine the terms and conditions for their cooperation with the latter with respect to their report on periodic prudential returns and their assessment of internal control.

Circular - Page 48/53 NBB_2024_12 - 16 July 2024
3.9. INVESTMENT HOLDING COMPANIES AND MIXED FINANCIAL COMPANIES GOVERNED BY BELGIAN LAW
INCLUDED WITHIN THE SCOPE OF SUPERVISION ON A CONSOLIDATED BASIS OR REVIEW OF THE CAPITALISATION TEST OF A GROUP OF INVESTMENT FIRMS CARRIED OUT BY THE NATIONAL BANK OF BELGIUM Investment holding companies governed by Belgian law falling withing the scope of supervision on a consolidated basis or review of the capitalisation test of a group of investment companies carried out by the Bank, as referred to in Article 159 §2(6) of the Brokerage Supervision Act. Mixed financial holding companies governed by Belgian law falling within the scope of supervision on a consolidated basis or review of the capitalisation test of a group of investment companies carried out by the Bank, as referred to in Article 159 §2(8) of the Brokerage Supervision Act. Consolidated supervision: Article 163 of the Brokerage Supervision Act. Rules applicable to holding companies: Article 182 of the Brokerage Supervision Act. Comments ✓ The definition of a large stockbroking firm covers both class 1A and class 1B firms. Class 1 stockbroking firms are credit institutions (Article 1 §3 of the Banking Act). ✓ A holding company owning a class 1A stockbroking firm (subject to the CRR and part of the CRD) is a stockbroking holding company. ✓ A holding company owning a class 1B stockbroking firm (a subsidiary of a credit institution, subject to the CRR and the CRD) is a bank holding company.
3.10. INSURANCE AND REINSURANCE COMPANIES
3.10.1. AUDITOR’S REPORTS ON PERIODIC PRUDENTIAL RETURNS
Please see point 2.3.1.2.2 of this circular.

List of applicable statutory provisions
Articles 332 and 333 of the Insurance Supervision Act
Periodic prudential returns
The periodic prudential returns that do not need to be reported on by the accredited statutory auditor are listed in Annex 3.
Clarifications regarding confirmation
For purposes of confirmation, the accredited statutory auditor shall take into account the following points in particular (non-exhaustive list):

Points for attention relating to the valuation of technical provisions

Data quality
Assumptions underlying the calculation of technical provisions: (i) justification, (ii) uncertainties
and (iii) changes in the assumptions used
Calculation methods and modelling choices
With regard specifically to the last two points above:
✓ respect for contract boundaries;
✓ future discretionary benefits;
✓ policyholder behaviour;

NBB_2024_12 - 16 July 2024 Circular - Page 49/53 ✓ contract options and financial guarantees as well as future discretionary benefits (profitsharing, rebates, etc.); ✓ the taking into account of management activities and future management actions and their consistency with other assumptions (such as, for example, the costs associated with policyholder behaviour and consideration of future discretionary benefits); ✓ expected future developments in the external environment; ✓ in the case of hospitalisation insurance, the assumptions used regarding future pricing; ✓ where appropriate, the calculation of technical provisions as a whole; ✓ projections of future parameters and scenarios and, where appropriate, the suitability and calibration of the ESG (economic scenario generator) used; ✓ cost modelling, including cost allocation; ✓ the granularity of the calculations, with particular attention paid to:

approximations and simplifications, as well as considerations relating to materiality and
proportionality;
the segmentation and homogeneous risk groups of insurance commitments taken into
consideration;
grouping of policies according to assets, liabilities, and maturity;
non-modelled items: part of the business or other non-modelled items.
Comparison with data drawn from experience (back-testing) of the best estimate and the
parameters and assumptions used to calculate it;
With regard to calculation of the risk margin, the extent to which forecasts of future solvency
capital requirements adequately reflect the nature, scale and complexity of the risks posed by insurance and reinsurance obligations;
Amounts recoverable under reinsurance contracts and from securitisation vehicles (including
taking into account the possibility of default by the third party);
Documentation of technical provisions;
Conclusions and recommendations of the actuarial functions.

Points for attention relating to the valuation of solvency capital requirements

Data quality
Quantification of the requirements, including that of modules and sub-modules and their
aggregation, with particular attention paid to:
✓ compliance with the conditions and criteria governing the use of specific capital charges in relation to, for example, long-term equity, the spread risk for bonds backed by regional and local authorities, infrastructure-type investments, strategic holdings, internal assessment of the credit quality step for certain bonds and loans, the “look through” approach, etc; ✓ calculation of the value of future discretionary benefits, taking into account the effect of the scenario on future earnings and the impact on capital requirements; ✓ the valuation and impact of the use of risk mitigation techniques, including reinsurance, on the insurer’s balance sheet and capital requirements; ✓ the valuation of and compliance with principles relating to recognition of the loss absorption capacity of deferred taxes, in accordance with Circular NBB_2022_27 of 2 November 2022. Where applicable, for the companies concerned:
✓ Circular NBB_2020_040 on guidelines on the use of company-specific parameters of 22 December 2020 sets out the Bank’s expectations in terms of the data quality criteria to be taken into account when calculating own parameters and the monitoring of ongoing compliance with the requirements relating to the use of such parameters. The Bank expects accredited statutory auditors to pay particular attention to company-specific parameters during their review of Solvency II reporting, by checking, on the basis of up-to-date data, the calculation of these parameters and the tests carried out by the company to demonstrate compliance with the prudential requirements relating to their use.

Circular - Page 50/53 NBB_2024_12 - 16 July 2024 ✓ accredited statutory auditors may neither develop nor validate the internal models used to calculate Solvency Capital Requirements (SCR), given the independence required of them in the performance of statutory audit engagements. If an insurance or reinsurance company wishes to call on an auditor to develop or validate the (partial) models it uses, the auditor must be completely independent from the company’s accredited statutory auditor. The accredited statutory auditor is not responsible for the initial approval of models or for compliance with the approval conditions for regulatory purposes. However, as part of the review and audit of the periodic prudential returns, the accredited statutory auditor shall ensure the correctness and completeness of the data used to feed the internal model (input) and the correct inclusion of the model’s output in the periodic prudential returns submitted to the supervisory authority.
3. Points for attention relating to the valuation of capital / own funds

Compliance with the eligibility criteria for coverage of the Solvency Capital Requirement (SCR)
and the Minimum Capital Requirement (MCR) for each tier of capital/own funds and its classification
Correct recognition of items to be deducted from eligible own funds

Points for attention relating to the valuation of balance sheet asset items

Data quality
Valuation methods; if applicable, (i) justification for the assumptions underlying the valuation, (ii)
uncertainties and (iii) changes in the assumptions used.
In the light of prudential and/or economic developments, the supervisory authority may update the abovementioned list of points for attention. It shall consult with IREFI-IRAIF in advance on this subject during its regular contacts with the latter.
3.10.2. AUDITOR’S REPORT ON THE ASSESSMENT OF INTERNAL CONTROL
Please see point 2.3.1.2.3 of this circular.
List of applicable statutory provisions
Article 331 of the Insurance Supervision Act: the accredited statutory auditor’s engagement
Article 42 §1 of the Insurance Supervision Act: system of governance
Clarifications regarding the accredited statutory auditor’s report
In the report on the assessment of internal control, the accredited statutory auditor shall set out all findings relating to the internal controls adopted by the insurance or reinsurance company. Significant findings relating to the management committee’s report on the effectiveness of the system of governance and any findings arising from the accredited statutory auditor’s work and assessment of the system of internal control and procedures relating to compliance with Circular NBB_2016_31 (revised May 2020) shall also be taken into account.
3.11. BELGIAN INSURANCE AND REINSURANCE GROUPS
This section describes the role of the accredited statutory auditor in the framework of the supervision of insurance and reinsurance groups as defined in Articles 339 and 343 of the Insurance Supervision Act.

NBB_2024_12 - 16 July 2024 Circular - Page 51/53 The accredited statutory auditor in charge of group audits shall be:
✓ either the accredited statutory auditor of the insurance holding company governed by Belgian law, where this is the parent company with ultimate responsibility for the group, or ✓ the accredited statutory auditor of the participating insurance or reinsurance company governed by Belgian law, where the latter has been authorised by the Bank to be designated as the “entity responsible for the group”, possibly in lieu of the ultimate parent company. Where the term “accredited statutory group auditor” is used hereafter, it should be understood to mean, depending on the structure of the group concerned, one of the abovementioned accredited statutory auditors. The statutory framework for the audit of insurance and reinsurance groups is set out in Articles 430 to 440 of the Insurance Supervision Act.
3.11.1. POINTS FOR ATTENTION WHEN ASSESSING GROUP SOLVENCY
✓ Identification of the companies included in the group audit, the collection of data and the recognition and valuation of balance sheet items in the consolidation process. ✓ The choice of and justification for the method used to calculate the group’s solvency capital requirement, with particular attention to: (i) data quality and (ii) quantification of the requirements, including that of the modules and sub-modules as well as their aggregation. ✓ The availability of capital, the eligibility of own funds items, reconciliation at group level and the treatment of specific group risks.
3.11.2. AUDITOR’S REPORT ON GROUP PERIODIC PRUDENTIAL RETURNS
Please see point 2.3.1.2.2 of this circular.
In accordance with Articles 430 (in conjunction with 332 and 333), 433 and 434 of the Insurance Supervision Act, the accredited statutory group auditor shall report to the Bank on:
✓ standalone periodic prudential returns at the end of the first half year and at the end of the financial year for an insurance holding company governed by Belgian law or mixed financial holding company governed by Belgian law; and ✓ consolidated periodic prudential returns at the end of the first half year and at the end of the financial year at the level of an insurance or reinsurance group. More specifically, the periodic prudential returns concerned are those listed in Annex 3.
3.11.3. AUDITOR’S REPORT ON THE ASSESSMENT OF THE GROUP GOVERNANCE SYSTEM
Please see point 2.3.1.2.3 of this circular.
In accordance with Articles 430 (in conjunction with 331) and 432 of the Insurance Supervision Act, the accredited statutory group auditor “assesses the adequacy at group level of the internal controls referred to in Article 42 §1(2)” and reports on these findings to the Bank. In practice, this means that the accredited statutory group auditor must assess the internal controls put in place at group level to meet the requirements relating to the system of governance for groups, which mainly cover two types of requirements:
✓ “individual” requirements applicable to insurance holding companies incorporated under Belgian law pursuant to Article 443 of the Insurance Supervision Act; and ✓ “group” requirements applicable to insurance and reinsurance groups pursuant to Articles 392 to 398 of the Insurance Supervision Act.

Circular - Page 52/53 NBB_2024_12 - 16 July 2024 The “individual” requirements applicable to holding companies are specified in point 13.1.1 of Circular NBB_2016_31, updated by Communication NBB_2020_017 of 5 May 202038 concerning the Bank’s prudential expectations with regard to the system of governance for the insurance and reinsurance sector, and relate essentially to matters of (i) share ownership, (ii) fit & proper, (iii) establishment of a management committee and (iv) transactions with managers. The “group” requirements are specified in points 13.1.2 to 13.1.4 of Circular NBB_2016_31, as updated by the aforementioned Communication NBB_2020_017 of 5 May 2020, and relate to (i) the group management structure, (ii) the group risk management system (including risk concentration aspects) and (iii) the organisation of the group (including aspects relating to intra-group transactions). For the report on the group’s internal control, the accredited statutory group auditor shall rely in particular on the report prepared by the management committee of the entity responsible for the group on its assessment of the effectiveness of the group’s governance system, the content of which is specified in Annex 1, Part II of the aforementioned Circular NBB_2016_31, as well as all findings resulting from the audit work and the auditor’s assessment of internal controls and procedures relating to compliance with Circular NBB_2016_31, as updated by Communication NBB_2020_017 of 5 May 2020.
4. REPORTING TO THE SUPERVISORY AUTHORITY
4.1. DEADLINES FOR THE SUBMISSION OF AUDITOR’S REPORTS ON PERIODIC PRUDENTIAL RETURNS
The deadlines for the submission of auditor’s reports on periodic prudential returns to the supervisory authority are as follows:

Reports at the end of the first half of the financial year
✓ For insurance or reinsurance companies and groups, no later than four weeks from the end of the maximum period afforded to such companies for reporting to the Bank. ✓ For institutions not engaged in insurance or reinsurance activities, no later than three months from the end of the first half-year.
Reports at the end of the financial year
✓ Institutions and groups active in insurance or reinsurance: no later than six weeks from the end of the maximum period afforded to insurance and reinsurance companies for reporting to the Bank; 39 ✓ Financial institutions not engaged in insurance or reinsurance: no later than fifteen working days prior to the general meeting of shareholders or members; 40 ✓ Belgian branches of foreign (EEA and non-EEA) institutions (credit institutions and stockbroking firms): no later than three months from the end of the financial year; ✓ Branches of (non-EEA) insurance and reinsurance companies: no later than five months from the end of the financial year. These are the final deadlines. The supervisory authority expects to receive reports sooner. If an accredited statutory auditor is unable to meet a deadline, the auditor shall notify the supervisory authority in a timely manner, stating the reason(s) for the delay. The Bank insists on respect for these 38 The Bank is currently in the process of revising this circular. 39 Each year, the Bank issues a communication relating to the insurance and reinsurance sector, setting out the timetable for the submission of reports by accredited statutory auditors. For the 2023 financial year, this is Communication NBB_2022_22 of 5 October 2022. 40 The accredited statutory auditor shall ensure that the audit opinion submitted to the general meeting of shareholders or partners on the annual accounts and, where applicable, the consolidated accounts or, for Belgian branches of credit institutions and stockbroking firms governed by foreign law, the report on the certification of accounting information to be published, is appended to the reports on periodic prudential returns at the end of the financial year.

NBB_2024_12 - 16 July 2024 Circular - Page 53/53 deadlines and expects accredited statutory auditors to document in detail (in particular in their reports on the assessment of internal control) the reasons for any delay as well as, if the problem results from an organisational or internal control issue within the institution concerned, the action plan implemented by the financial institution and/or the accredited statutory auditor in order to comply with these deadlines. The terms and conditions for the submission of auditor’s reports take into account the fact that some reports must be made available to the FSMA. Thank you for your cooperation. Yours faithfully, Pierre Wunsch Governor

Annexes

Annex 1: Template for the structure and content of the comprehensive report
Annex 2: Assessment of CRR tables prepared by institutions that calculate their capital
requirements for credit risk using the standardised approach
Annex 3: List of periodic prudential returns to be reported on by accredited statutory auditors

Lineage: No known changes

Similar documents from other regulators