Amendment of Circular CSSF 19/716 on the provision in Luxembourg of investment services or performance of investment activities and ancillary services in accordance with Article 32-1 of the LFS

CIRCULAR CSSF 20/743
1/23
Circular CSSF
20/743
Amendment of Circular
CSSF 19/716 on the provision in Luxembourg of investment services or performance of investment activities and ancillary services in accordance with
Article 32-1 of the LFS

CIRCULAR CSSF 20/743
2/23
Circular CSSF 20/743
Re: Amendment of Circular CSSF 19/716 on the provision in Luxembourg of investment services or performance of investment activities and ancillary services in accordance with Article 32-1 of the LFS Ladies and Gentlemen, The purpose of this circular is to amend Circular CSSF 19/716 in order to specify the concept of services provided “in Luxembourg” (principle of territoriality). The aim of Circular CSSF 19/716 was to operationalise Article 32-1 of the LFS and to clarify the procedure that third-country firms must comply with in order to benefit from the regime laid down in the second subparagraph of Article 32- 1(1) of the LFS. Like the MiFIR Regulation, Circular CSSF 19/716 did not address questions regarding the location of the services provided. The purpose of the amendments introduced by this circular is to clarify the concept of service provided “in Luxembourg” in relation to the investment services or the performance of investment activities and ancillary services in accordance with Article 32-1 of the LFS. To facilitate reading and understanding, the amendments are presented in track changes (Annex 1). Yours faithfully, Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director general Luxembourg, 1 July 2020 To all third-country firms that provide or wish to provide investment services, perform or wish to perform investment activities and that propose or wish to propose ancillary services in Luxembourg In case of discrepancies between the French and the English text, the French text shall prevail.

CIRCULAR CSSF 20/743
3/23
Annexe I
Circular CSSF 19/716 as amended by Circular CSSF 20/743 Re: Provision in Luxembourg of investment services or performance of investment activities and ancillary services in accordance with
Article 32-1 of the LFS
Ladies and Gentlemen,
The purpose of this circular is to lay out the different regimes that apply to third￾country firms that wish to provide, in Luxembourg, investment services or perform investment activities together with ancillary investment services in accordance with Article 32-1 of the Law of 5 April 1993 on the financial sector, as amended (LFS). In doing so, this circular clarifies the procedure that third￾country firms must comply with in order to benefit from the regime in Article 32-1(1), second subparagraph of the LFS. These clarifications became necessary with the entry into force of the Law of 30 May 2018 on markets in financial instruments which introduced a new Article 32-1 into the LFS in order to implement the relevant provisions of Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments (MiFID II)1 and Regulation (EU) No 600/2014 of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments (MiFIR)2. 1 https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex:32014L0065 2 https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32014R0600 Luxembourg, 1 July 2020 To all third-country firms that provide or wish to provide investment services, perform or wish to perform investment activities and that propose or wish to propose ancillary services in Luxembourg

CIRCULAR CSSF 20/743
4/23
TABLE OF CONTENTS
Part I – Introduction 5
Chapter 1 – Definitions 5
Chapter 2 - Context 7
Part II - Provision of investment services in Luxembourg 8
Chapter 1 - Provision of investment services to retail
clients or to professional clients on request 8
Chapter 2 - Provision of investment services to per
se professional clients or to eligible counterparties 8
Part III - Provision of investment services “in Luxembourg”
and reverse solicitation 12
Part IV - Entry into force 14
ANNEX I – Summary diagram (decision tree) 15
ANNEXE II – Application form for the provision of investment services by a third-country firm on the basis of the “third-country” national regime 16

CIRCULAR CSSF 20/743
5/23
Part I – Introduction
Chapter 1 – Definitions
For the purpose of this circular, the following definitions apply:
1) “retail client” means a client as defined in Article 1(4) of the LFS, i.e. a client
who is not a professional client;
2) “professional client” means a professional client as defined in Article 1(5) of
the LFS, i.e. a client who possesses the experience, knowledge and expertise to make its own investment decisions and properly assess the risks that it incurs. In order to be considered a professional client, the client must comply with the criteria set out in Annex III of the LFS;
3) “per se professional client” means a client who is considered as a
professional client in accordance with Section A of Annex III of the LFS;
4) “professional client on request” means a client who, on its own request, is
treated as a professional client in accordance with Section B of Annex III of the LFS;
5) “eligible counterparty” means a client classified or recognised as eligible
counterparty in accordance with Article 37-7 of the LFS;
6) “investment firm” means any person as defined in point (1) of Article 4(1)
of MiFID II. In Luxembourg, these are the persons referred to in Part I, Chapter 2, Section 2, Sub-section 1 of the LFS, i.e. the persons whose regular occupation or business is the provision of one or more investment services to third parties and/or the performance of one or more investment activities on a professional basis;
7) “third-country firm” means a firm as defined in Article 1(9b) of the LFS, i.e.
any firm that would be a credit institution providing investment services or performing investment activities or an investment firm if its head office or registered office were located within the European Union;
8) “credit institution” means a credit institution as defined in point (1) of Article
4(1) of Regulation (EU) No 575/2013. In Luxembourg, this refers to legal persons the business of which is to take deposits or other repayable funds from the public and to grant credits for their own account, as well as any other person considered as credit institution under Part I, Chapter 1 of the LFS. The persons whose business consists in taking deposits or other repayable funds from the public and in granting credits for their own account may be called either credit institutions or banks;

CIRCULAR CSSF 20/743
6/23
9) “Member State” means a Member State as defined in Article 1(14) of the LFS,
i.e. a Member State of the European Union. The States that are contracting parties to the European Economic Area Agreement other than the Member States of the European Union are considered as equivalent to Member States of the European Union, within the limits set forth by this agreement and related acts;
10) “financial instruments” means financial instruments as defined in Article
1(19) of the LFS, i.e. instruments referred to in Section B of Annex II of the LFS;
11) “third country” means a third country as defined in Article 1(26) of the LFS,
i.e. a State other than a Member State. For the purposes of this circular, territories outside the European Union or the European Economic Area are considered as third countries;
12) “Regulation (EU) No 575/2013” means Regulation (EU) No 575/2013 of the
European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 648/2012; 12)13) “reverse solicitation” means the situation where a client established or situated in Luxembourg initiates at its own exclusive initiative the provision of an investment service or activity by a third-country firm; 13)14) “ancillary service” means any of the services referred to in Section C of
Annex II of the LFS;
14)15) “investment service” or “investment activity” means any of the services or activities referred to in Section A of Annex II of the LFS relating to any of the financial instruments listed in Section B of Annex II of the LFS. For the purpose of this circular, the term “investment service” shall refer to investment services or investment activities as well as ancillary services as defined in point (134) above. Without prejudice to the definitions above, the definitions included in Article 1 of the LFS shall apply to this circular.

CIRCULAR CSSF 20/743
7/23
Chapter 2 - Context
Before providing any investment service covered by the LFS in Luxembourg, a third-country firm must first identify:

• the type of service it intends to provide (investment service or any other
  service covered by the LFS); and
• the type of clients it intends to serve according to the client classification
  imposed by MiFID II as transposed in the LFS (retail client, per se professional client, professional client on request or eligible counterparty). Where the service provided is an investment service, a third-country firm must refer to Article 32-1 of the LFS and Article 46 et seq. of MiFIR to determine which regime may apply to it and according to which arrangements (establishment of a branch in Luxembourg or provision of services on a cross-border basis without establishing a branch in Luxembourg). This regime is determined according to the type of clients that the third-country firm intends to serve and according to the choices it makes among the different regimes available to it. To this end, third￾country firms must refer to Part II of this circular3.
  Article 32-1 of the LFS applies to investment services provided “in Luxembourg”.
  It should also be noted that, wWhere an investment service is provided covered based on by the LFS is provided at the client’s own exclusive initiative (reverse solicitation), the third-country firm is not required toexempted from requesting an authorisation in Luxembourg or to from establishing a branch in Luxembourg. As regards questions relating to the location of the investment service and reverse solicitation, third-country firms must refer to Part III of this circular. A decision tree summarising the foregoing is appended as Annex I to this circular. 3 It shall be noted that point 4 of Section II of CSSF Circular 11/515 no longer applies to third-country firms with regard to the provision of investment services.

CIRCULAR CSSF 20/743
8/23
Part II - Provision of investment services in
Luxembourg
Chapter 1 - Provision of investment services to retail clients or to
professional clients on request
In accordance with Article 32-1(2) of the LFS, third-country firms that wish to provide, in Luxembourg, investment services to retail clients or to professional clients on request are required to establish a branch in Luxembourg. In this case, the branch is subject to the same authorisation rules laid down in the LFS as credit institutions and investment firms incorporated under Luxembourg law and must comply notably with the provisions of Article 32(2) to (4) of the LFS and the provisions of Article 32-1(2) of the LFS. The authorised branch is subject to the supervision of the CSSF in accordance with Article 32-1(2) of the LFS. The branches of third-country credit institutions that are authorised in Luxembourg at the date of the entry in force of this circular are not required to apply for a new authorisation but are subject to the conditions laid down in Article 32-1(2), points (1) to (6) of the LFS.
Chapter 2 - Provision of investment services to per se
professional clients or to eligible counterparties Where a third-country firm provides its investment services to per se professional clients or to eligible counterparties in Luxembourg, it may choose to provide investment services:

• through a branch established in Luxembourg; or
• from the third country on a cross-border basis without establishing a
  branch in Luxembourg.
  Where the third-country firm establishes a branch, the rules and conditions for licensing mentioned in Article 32-1(1) of the LFS apply. Where the third-country firm provides its investment services from the third country on a cross-border basis without establishing a branch in Luxembourg, the LFS and MiFIR provide that the investment services may be provided:
• based on a decision by the CSSF (“national regime”); or
• based on an equivalence decision of the European Commission and
  registration in the register of third-country firms kept by the European Securities and Markets Authority (ESMA) (“European regime”).

CIRCULAR CSSF 20/743
9/23
Section 1 - National regime: Provision of investment services
based on a decision by the CSSF
In accordance with Article 32-1(1), second subparagraph of the LFS, by way of derogation to Section 2 hereafter, the national regime is possible where the European Commission has not yet taken an equivalence decision or where it has taken an equivalence decision in accordance with Section 2 and the third-country firms make the choice to benefit from the transitional period referred to in Sub￾section 4, paragraph (2) hereafter. The third-country firm may thus, without establishing a branch in Luxembourg, provide investment services on a cross-border basis to per se professional clients and eligible counterparties in Luxembourg where the CSSF has adopted an equivalence decision relating to the third country in which the firm has its central administration or its registered office and has informed the third-country firm that conditions under of Article 32-1(1), second subparagraph of the LFS are met (“national regime”). The national regime does not grant a European passport to the third-country firm and therefore does not provide access to the whole EU market. The national regime is open to a third-country firm only when the conditions laid out in Sub-sections 1 to 3 are met. Sub-section 1 - Condition relating to third￾country equivalence For the purposes of the national regime, the CSSF verifies that the firm is subject, in the third country, to supervision and authorisation rules that the CSSF deems to be equivalent to those of the LFS for the provision of investment services. Thus, the CSSF considers, in principle, that third countries that are not signatories of the IOSCO Multilateral Memorandum of Understanding4 are not equivalent. It also considers as non-equivalent those third countries that do not have adequate legislation and supervision with respect to the fight against money laundering and terrorist financing (AML/CFT). The CSSF assesses the condition of equivalence notably in light of the list of high-risk and/or non-cooperative jurisdictions established by the Financial Action Task Force (FATF) and the assessments performed by the latter.5 4 Cf. https://www.iosco.org 5 Cf. http://www.fatf-gafi.org/

CIRCULAR CSSF 20/743
10/23
The third-country firm is required to provide to the CSSF all the information it needs to assess equivalence. The CSSF may, where appropriate, request the third-country firm to establish and provide an independent legal advice on the equivalence to the LFS of the authorisation and supervisory rules of the third country in which the firm has its head office or its registered office for the provision of investment services. The list of countries that the CSSF considers as equivalent for the purposes of the national regime will be published by the CSSF and updated where so required based on the requests submitted by third-country firms. The CSSF may withdraw a third country from the list where the conditions for the granting of the equivalence are no longer met. Sub-section 2 - Condition relating to the cooperation between the CSSF and the third￾country supervisory authority For the purposes of the national regime, in accordance with the second subparagraph of Article 32-1(1), second subparagraph of the LFS, the CSSF verifies that the cooperation between the CSSF and the supervisory authority(ies) of the third country is must be ensured. This Ccooperation may notably takes the form of an agreement concluded with the supervisory authority(ies) in the form, in general, or of a memorandum of understanding (MoU) between the authorities or by the signature of an addendum to an existing MoU. Such an MoU is only possible where the third-country supervisory authority(ies) provide(s) assurance to the CSSF that cooperation and exchange of information with the competent third-country authorities in charge of prudential supervision, supervision of conduct of business rules, but also of AML/CFT supervision will take place. Sub-section 3 - Conditions relating to the third￾country firm The third-country firm must be authorised in the third country to provide the investment services it wishes to provide in Luxembourg in order to benefit from the national regime. The decision on the provision of investment services in Luxembourg is taken by the CSSF upon written application and after examination of the request submitted to the CSSF at direction@cssf.lu. Third-country firms must include the form in Annex II in their request, duly filled in and with the documents and other information needed for its assessment. The CSSF reserves the right to request any other document or information it deems useful or necessary for the processing of the request.

CIRCULAR CSSF 20/743
11/23
The application file must at least include a detailed description of the activities carried out in the home country and those contemplated or carried out in Luxembourg, as well as any relevant information and supporting documents allowing the CSSF to ensure that the activities are indeed covered by the scope of
Article 32-1 of the LFS, and that the prerequisites of the said article are fulfilled.
Moreover, the third-country firm could be requested, on demand, to provide the CSSF with statistical information or periodical reporting. In addition, t The CSSF's decision implies that third-country firms must notify the CSSF spontaneously in writing and in a complete, consistent and understandable form of any changes in relation to the substantial information submitted to the CSSF, and in particular when the third-country firm is aware that the conditions of Article 32-1 of the LFS are no longer fulfilled (for example when the third-country firm no longer has an authorisation or license in the third country). The CSSF will reconsider its decision vis-à-vis a third-country firm when the conditions of Article 32-1 of the LFS are no longer fulfilled, in particular when the third country is no longer considered as equivalent by the CSSF. Sub-section 4 - Other points of attention (1) Obligation to provide information to clients The third-country firm is required, pursuant to Article 46(5) MiFIR, and before offering any investment service, to inform its clients that it is not allowed to provide services to clients other than eligible counterparties and per se professional clients and is not subject to supervision in the European Union. The third-country firm must point out, in writing and in a prominent way, the name and address of the competent authority responsible for its supervision in the third country. (2) Transitional regime In a situation where the CSSF takes an equivalence decision relating to a third country in which the third-country firm has its head office or its registered office and, at a later stage, the European Commission takes an equivalence decision for the same third country in accordance with Section 2 above, Article 54(1) of MiFIR provides for a transitional regime. Hence, the third-country firm can continue to provide investment services in Luxembourg, in accordance with the national regime, up until three years after the adoption of the equivalence decision by the European Commission on the third country concerned. In other words, the third￾country firm can remain subject to the national regime for a maximum transitional period of three years.

CIRCULAR CSSF 20/743
12/23
Section 2 - European regime: Provision of investment services based
on an equivalence decision of the European Commission and registration in the register of third-country firms kept by ESMA In accordance with Article 32-1(1), second subparagraph of the LFS and Article 46 et seq. of MiFIR, the third-country firm can, without establishing a branch in Luxembourg, provide investment services on a cross-border basis to per se professional clients and eligible counterparties in Luxembourg where the European Commission has adopted beforehand an equivalence decision relating to the third country in which the firm has its head office or its registered office and where the firm is registered in the relevant register kept by ESMA. Registration in the register kept by ESMA gives access to the whole EU market to the third-country firm and is, as a consequence, similar to a European passport. The information to be provided in the context of the application for registration in the register kept by ESMA, as well as the format of this information are specified in Delegated Regulation 2016/2022 of 14 July 20166. Registration in the register is subject to certain conditions verified by ESMA. The third-country firm is required, pursuant to Article 46(5) of MiFIR, and before offering any investment service, to inform its clients that it is not allowed to provide services to clients other than eligible counterparties and per se professional clients and is not subject to supervision in the European Union. The third-country firm must point out, in writing and in a prominent way, the name and address of the competent authority responsible for its supervision in the third country.
Part III - Provision of investment services at
the own exclusive initiative of the client“in Luxembourg” and reverse solicitation
Article 32-1 of the LFS applies to investment services provided “in Luxembourg”,
i.e. on the territory of Luxembourg.
The CSSF considers that the investment service is considered to be provided in Luxembourg where one of the following conditions is fulfilled:
6 Commission Delegated Regulation (EU) 2016/2022 of 14 July 2016 supplementing Regulation (EU) No 600/2014 of the European Parliament and of the Council with regard to regulatory technical standards concerning the information for registration of third-country firms and the format of information to be provided to the clients: https://eur-lex.europa.eu/legal￾content/EN/TXT/PDF/?uri=CELEX:32016R2022&from=EN

CIRCULAR CSSF 20/743
13/23

• the third-country firm has an establishment (e.g. a branch) in Luxembourg;
• the third-country firm provides an investment service to a retail client
  established or situated in Luxembourg; or
• the place at which the “characteristic service” is supplied, i.e. the essential
  service for which payment is due, is Luxembourg.
  Thus, there are particular situations where, although the third-country firm provides investment services to a client other than a retail client, established or situated in Luxembourg, the service can be considered as not being provided “in Luxembourg”. The firm is responsible for making the analysis above before providing any service, for documenting and for retaining the analysis. Where an investment service is provided based on reverse solicitation, In accordance with Article 32-1(3) of the LFS, where a client established or situated in the European Union initiates at its own exclusive initiative (reverse solicitation) the provision of an investment service by a third-country firm, Article 32-1(1) and (2) of the LFS does not apply. In such a case, tThe third-country firm can then provide the investment service without being required to fulfil the conditions laid out in Chapters 1 and 2 of Part II above, i.e. without having to establish a branch or without having to obtain a decision of the CSSF and irrespective of the client’s classification (retail client, per se professional client, professional client on request or eligible counterparty). An equivalence decision of the third country is not required either. The situation as regards reverse solicitation must be assessed by the third-country firm for every service and on a case-by-case and continuous basis, notably by taking into account the Questions and Answers published by ESMA in this respect.7 Reverse solicitation by a client does not entitle the third-country firm to market new categories of investment products or investment services to this client. 7 These Questions and Answers are published on ESMA’s website and are regularly updated (Questions and Answers On MiFID II and MiFIR investor protection and intermediaries topics).

CIRCULAR CSSF 20/743
14/23
Part IV - Entry into force
This circular shall apply with immediate effect.
Successive updates:

• Circular CSSF 20/743
  Yours faithfully,
  COMMISSION de SURVEILLANCE du SECTEUR FINANCIER Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director general Annexes
  Annex I - Decision tree
  Annex II - Application form for the provision of investment services by a third￾country firm without establishment of a branch following an equivalence decision
  by the CSSF

CIRCULAR CSSF 20/743
15/23
ANNEX I – Summary diagram (decision tree)

CIRCULAR CSSF 20/743
16/23
ANNEXE II – Application form for the provision of investment services by a third-country firm on the basis of the “third-country” national regime This form is to be used by third-country firms (hereinafter, the “firms”) that are looking to provide investment services without establishing a branch in Luxembourg on the basis of the “third-country” national regime contemplated under article 32- 1(1), 2nd sub-paragraph of the LFS, as further described in the CSSF Circular 19/716. All terms not otherwise defined herein shall have the meaning assigned to such terms in the CSSF Circular 19/716. Please choose one of the options below:
New application (please complete the fields No 1. to 4. below and provide the documents listed in the field No 5.) Update of information (please complete below the information to be updated and provide if necessary the relevant documents) Withdrawal request (please provide a separate explanation)

1. Contact information
   1.1 Denomination of the firm
   1.2 Third country in which the firm
   is established
   1.3 Registration number of the
   firm in the third country
   Name of register
   1.4 Address of the firm in the third
   country from which documents may be obtained
   1.5 Legal Entity Identifier code
   1.6 Is the firm already providing
   financial services in
   Luxembourg?
   Yes. Please indicate below which ones.
   No.
   1.7 Date on which the firm intends
   to commence its activities in
   Luxembourg

CIRCULAR CSSF 20/743
17/23
1.8 Telephone number
1.9 E-mail address
1.10 Website address
1.11 Name, title, division, email
address, phone number of the contact person(s) for the purpose of this application
1.12 Description of the
shareholding structure of the firm
1.13 Information on the persons
directing the business of the firm
2. Information regarding the legal framework applicable to the firm
2.1 License in the third country
2.1.1. Name of the prudential authorit(y)(ies) in charge of its supervision.
If more than one authority is in charge of the supervision, please explain how those authorities share the responsibilities for the supervision.
2.1.2 Name of the firm’s license in the third country.
2.1.3 Description of the services/activities for which the firm is licensed
in the third country, so that it can be ascertained that the firm is already authorised in the third country for the services or activities that it plans to provide or to carry out in Luxembourg.
2.2 Conduct of business rules applicable in the third country
Summary of the legal framework for the conduct of business rules applicable in the third country to the firm in relation to the provision of services and the activities in Luxembourg.

CIRCULAR CSSF 20/743
18/23
2.3 Organisational requirements
2.3.1 Summary of the organisational requirements to which the firm is
subject in relation to the provision of services and the activities in Luxembourg.
2.3.2 Details of the person responsible for dealing with complaints in
relation to the provision of services and the activities in Luxembourg.
2.4 Anti-money laundering and fight against terrorism (AML-CFT)
Summary of the AML-CFT rules applicable in the third country to the firm in relation to the provision of services and the activities in Luxembourg.
3. Information regarding the firm’s plans in Luxembourg
3.1 Description of the main objectives and business strategy of the
firm providing investment services in Luxembourg and an explanation of how the provision of investment services in Luxembourg will contribute to the strategy of the firm and, where applicable, of its group. Please provide an estimate of the expected volume of business to be generated.
3.2 Description of the expected number and types of clients, as well
as a description of the types of counterparties with which the firm will be dealing in Luxembourg in connection with the investment services. Please classify the clients according to the MiFID II classification (‘per se’ professional clients and eligible counterparties).

CIRCULAR CSSF 20/743
19/23
3.3 List of the investment services and activities, as well as ancillary
services, that the firm intends to carry out in Luxembourg.
Please refer to Sections A and B of Annex I to Directive 2014/65/EU of the European Parliament and of the Council (), when referring to the financial instruments provided for in
Section C of Annex I of that Directive.
Financial instruments
Investment services and activities Ancillary services A1 A2 A3 A4 A5 A6 A7 A8 A9 B1 B2 B3 B4 B5 B6 B7 C1 C2 C3 C4 C5 C6 C7 C8 C9 C10 C11 Note 1: Row and column headings are references to the relevant section and item number in Annex I to Directive 2004/39/EC (e.g. A1 refers to point 1 of
Section A of Annex I). For example, if the firm plans to provide Service A1 in
relation to Financial instruments C1, cell A1/C1 must be checked. () Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU (recast) (MiFID II).

CIRCULAR CSSF 20/743
20/23
4. Information regarding investors’ protection
Summary of the arrangements for safeguarding client money and assets. Indication of whether clients are covered by an investor protection scheme. Please provide details on the name and contact of the investor protection scheme and the maximum coverage of the investor protection scheme in the third country.
5. Information and documentation to be provided by the firm

• an up-to-date version of the article of association of the firm;
• the three last audited financial statements (if available);
• a copy of the license or any other official document confirming the activities
  or services that the firm is authorised to carry out/provide in the third country;
• a written confirmation of the firm that it will not provide in Luxembourg
  services to clients other than eligible counterparties and ‘per se’ professional clients.

CIRCULAR CSSF 20/743
21/23
PRIVACY STATEMENT
This Privacy Statement shall be without prejudice to any subsequent policy or procedure available on the CSSF website with respect to data protection. The Commission de Surveillance du Secteur Financier (CSSF) is a public institution which supervises the professionals and products of the Luxembourg financial sector. Its address is 283, route d’Arlon L-1150 Luxembourg, Grand Duchy of Luxembourg. Its missions and scope of competence are defined by the modified organic law of 23 December 1998. The CSSF performs its duties of prudential supervision and supervision of the markets for the purposes of ensuring the safety and soundness of the financial sector, solely in the public interest. In collecting this information, the CSSF is acting as a data controller and is legally required (Regulation EU 2016/679 of the European Parliament and the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR)) to provide you with information about it, about why and how it uses your data, and about the rights you have over your data. The processing of personal data is based on, as applicable, Article 6(1)(a), (b), (c), (e) or (f) of GDPR. The CSSF processes the personal data solely to achieve the specific purpose for which they are collected through the form (i.e. this form is to be used to assess whether third-country firms that are looking to provide investment services without establishing a branch in Luxembourg on the basis of the third-country national regime contemplated under article 32-1(1), 2nd sub-paragraph of the LFS, as further described in the CSSF Circular 19/716). Personal data are only shared on a need-to-know basis with staff who are responsible for achieving the purpose of the collection. This data may be shared with people outside the CSSF when this appears necessary in order to achieve the purpose of the collection or in cases provided for by the law. The data processed by the CSSF for the exercise of its public-interest tasks and of the public authority with which the CSSF is entrusted will be kept for as long as you provide investment services in Luxembourg, or for as long as the natural or legal person with which you work or hold a position provides investment services in Luxembourg. The CSSF can store your data for a longer time, for example insofar as the data may again become pertinent for the exercise of its mandates or as part of potential liability claims.

CIRCULAR CSSF 20/743
22/23
The CSSF implements technical and organisational means to protect your personal data and to prevent any destruction, loss, alteration or modification, as well as any unauthorised access or disclosure of an accidental or illegal nature. Without prejudice to the limitations provided by the GDPR, data subjects whose personal data has been collected have a right of access, rectification and, under certain conditions, erasure and limitation. To submit a request regarding your personal data, please contact our DPO by mail or email to the following address:
Mail: CSSF
Data Protection Officer
283, route d’Arlon
L-1150 Luxembourg
Email: dpo@cssf.lu
If you have a complaint about our use of your information, please first contact us directly, so that we can address your complaint. However, you can also contact the Commission nationale pour la protection des données (CNPD) via their website at www.cnpd.lu or write to them at:
Commission nationale pour la protection des données Service des plaintes 1, avenue du Rock'n'Roll L-4361 Esch-sur-Alzette

CIRCULAR CSSF 20/743
23
/23
Commission de Surveillance du Secteur Financier 283, route d’Arlon L-2991 Luxembourg (+352) 26 25 1 - 1 direction@cssf.lu www.cssf.lu