Circular CSSF 18/698: Authorization and Organization of Luxembourg Investment Fund Managers and AML/CFT Provisions

In case of discrepancies between the French and the English text, the French text shall prevail. Luxembourg, 23 August 2018 To all investment fund managers and entities carrying out the activity of registrar agent CIRCULAR CSSF 18/698 Re: Authorisation and organisation of investment fund managers incorporated under Luxembourg law Specific provisions on the fight against money laundering and terrorist financing applicable to investment fund managers and entities carrying out the activity of registrar agent Ladies and Gentlemen, This circular applies to investment fund managers incorporated under Luxembourg law (hereinafter “IFMs”). IFMs comprise the following:

management companies incorporated under Luxembourg law and subject to Chapter 15 of
the Law of 17 December 2010 relating to undertakings for collective investment (hereinafter “2010 Law”); these entities will be referred to hereinafter as “ManCos” or “IFMs”;
management companies incorporated under Luxembourg law and subject to Articles 125-
1 or 125-2 of Chapter 16 of the 2010 Law; these entities will be referred to hereinafter as “AIFMs” or “IFMs”;
Luxembourg branches of IFMs subject to Chapter 17 of the 2010 Law;
investment companies which did not designate a management company within the meaning
of Article 27 of the 2010 Law (hereinafter “SIAGs”);
alternative investment fund managers authorised under Chapter 2 of the Law of 12 July
2013 on alternative investment fund managers (hereinafter “2013 Law”); these entities will be referred to hereinafter as “AIFMs” or “IFMs”; as well as
internally managed alternative investment funds within the meaning of point (b) of Article
4(1) of the 2013 Law (hereinafter “FIAAGs”).

Circular CSSF 18/698 Page 2/96
This circular does not apply to IFMs referred to in Chapter 18 of the 2010 Law. The entities referred to in Article 3 of the 2013 Law and which are not included in the above definition of IFMs are also excluded from the scope of application of this circular. Circular CSSF 12/546, as amended, was applicable to management companies incorporated under Luxembourg law and subject to Chapter 15 of the 2010 Law as well as to SIAGs. The purpose of this circular is to replace Circular CSSF 12/546, as amended, in order to take into account the legislative developments regarding alternative investment funds and to specify in a single circular the conditions for obtaining and maintaining the authorisation for all IFMs as defined above. It also applies to branches and representative offices which an IFM has established in Luxembourg and/or abroad. As regards the activity of registrar agent, credit institutions, investment firms, professionals of the financial sector and IFMs incorporated under Luxembourg law as well as Luxembourg branches of foreign institutions must refer to Sub-chapter 5.4. Organisation of the fight against money laundering and terrorist financing, and in particular point 304. The purpose of the circular is to provide additional clarifications on certain conditions for authorisation, more particularly the shareholding structure, the minimum own funds requirements, the administrative bodies, the arrangements concerning the central administration and governance and the rules governing the delegation framework. Furthermore, the circular includes rules, with reference to CSSF Regulation N° 10-04 and Delegated Regulation (EU) 231/2013, regulating the compliance and internal audit functions as specified in Circulars CSSF 04/155 and IML 98/143. Consequently, Circulars CSSF 04/155 and IML 98/143 are no longer applicable to IFMs. Yours faithfully, COMMISSION de SURVEILLANCE du SECTEUR FINANCIER Jean-Pierre FABER Simone DELCOURT Claude MARX Director General

Circular CSSF 18/698 Page 3/96
TABLE OF CONTENTS
Part I. Definitions and abbreviations.............................................................................................. 8
Part II. Conditions for obtaining and maintaining the authorisation of an authorised
investment fund manager (IFM) who engages solely in the activity of management of UCIs as
laid down in Article 101(2) of the 2010 Law and Article 5(2) of the 2013 Law......................... 11
Chapter 1. Basic principles ............................................................................................................ 11
Chapter 2. Shareholding ............................................................................................................... 11
Sub-chapter 2.1. Initial authorisation....................................................................................... 11
Sub-chapter 2.2. Changes in the shareholding......................................................................... 13
Chapter 3. Own funds..................................................................................................................... 13
Sub-chapter 3.1. Required own funds....................................................................................... 13
Sub-chapter 3.2. Eligible capital................................................................................................ 15
Sub-chapter 3.3. Use of own funds............................................................................................ 15
Chapter 4. The bodies of the IFM ................................................................................................. 17
Sub-chapter 4.1. The members of the governing body or management body....................... 17
Section 4.1.1. Required number........................................................................................................17
Section 4.1.2. Requirements regarding the skills, experience and good repute and the composition of
the management body/governing body.............................................................................................17
Section 4.1.3. Conditions for performing multiple mandates...........................................................18
Section 4.1.4. Obligations regarding meetings and deliberations.....................................................19
Sub-chapter 4.2. Senior management ....................................................................................... 19
Section 4.2.1. Required number, presence in Luxembourg and contractual relationship with the IFM
..........................................................................................................................................................19
Section 4.2.2. Requirements regarding the skills, experience and the good repute of the senior
management ......................................................................................................................................20
Section 4.2.3. Organisation of the senior management.....................................................................20
Section 4.2.4. Obligations regarding meetings and deliberations.....................................................22
Sub-chapter 4.3. Procedure for the approval of the members of the management
body/governing body and the conducting officers................................................................... 22
Sub-chapter 4.4. Independence of the IFM’s bodies from the depositary............................. 23
Chapter 5. Arrangements regarding the central administration and internal governance..... 24
Sub-chapter 5.1. Arrangements regarding the central administration of the IFM.............. 24
Section 5.1.1. Clarifications on human resources.............................................................................24
Section 5.1.2. Clarifications on technical infrastructure, IT and business continuity.......................26
Section 5.1.3. Clarifications on the accounting function ..................................................................27
Section 5.1.4. Clarifications on the premises in Luxembourg ..........................................................27
Sub-chapter 5.2. General internal governance arrangements............................................... 27

Circular CSSF 18/698 Page 4/96
Sub-chapter 5.3. Internal control functions ............................................................................. 28
Section 5.3.1. Permanent risk management function........................................................................31
Sub-section 5.3.1.1. Obligations of IFMs regarding risk management.........................................31
Sub-section 5.3.1.2. Permanent risk management function..........................................................31
Sub-section 5.3.1.3. Person responsible for the permanent risk management function................32
Sub-section 5.3.1.4. Risk management policy ..............................................................................33
Sub-section 5.3.1.5. Risk management procedure (RMP) to be communicated to the CSSF ......34
Sub-section 5.3.1.6. Use of third-party experts.............................................................................35
Section 5.3.2. Permanent compliance function.................................................................................36
Sub-section 5.3.2.1. General principles ........................................................................................36
Sub-section 5.3.2.2. Operational arrangements and compliance charter ......................................36
Sub-section 5.3.2.3. Specific responsibilities and scope of the compliance function...................36
Sub-section 5.3.2.4. Person responsible for the permanent compliance function.........................38
Sub-section 5.3.2.5. Use of third-party experts or technical means..............................................39
Sub-section 5.3.2.6. Obligations regarding the drawing-up of reports.........................................40
Section 5.3.3. Permanent internal audit function ..............................................................................41
Sub-section 5.3.3.1. General principles ........................................................................................41
Sub-section 5.3.3.2. Operational arrangements and internal audit charter ...................................41
Sub-section 5.3.3.3. Specific responsibilities and scope of the internal audit function ................42
Sub-section 5.3.3.4. Person responsible for the permanent internal audit function......................43
Sub-section 5.3.3.5. Use of third-party experts or technical means..............................................43
Sub-section 5.3.3.6. Performance of the internal audit function according to an internal audit plan
......................................................................................................................................................44
Sub-section 5.3.3.7. Obligations regarding the drawing-up of reports.........................................45
Sub-chapter 5.4. Organisation of the fight against money laundering and terrorist financing 46
Section 5.4.1. Obligations applicable to every IFM referred to in this sub-chapter .........................46
Sub-section 5.4.1.1. General principles ........................................................................................46
Sub-section 5.4.1.2. Obligation to designate an AML/CFT Compliance Officer at senior
management level and drawing-up of a summary report on AML/CFT.......................................47
Sub-section 5.4.1.3. Internal audit control....................................................................................49
Section 5.4.2. Obligations applicable to the IFM according to the manner in which the relationship
with marketing intermediaries and the function of registrar agent is organised ...............................49
Sub-chapter 5.5. Requirements with respect to organisation and procedures ..................... 52
Section 5.5.1. Management Information and internal reporting system...........................................52
Section 5.5.2. Business continuity ....................................................................................................53
Section 5.5.3. Approval of new business relationships and new products........................................54

Circular CSSF 18/698 Page 5/96
Section 5.5.4. Manual of procedures.................................................................................................54
Section 5.5.5. Claim and complaint handling ...................................................................................54
Section 5.5.6. Personal transactions..................................................................................................55
Section 5.5.7. Management of conflicts of interest...........................................................................55
Sub-section 5.5.7.1.: Conflicts of interest policy..........................................................................56
Sub-section 5.5.7.2.: Keeping a record of conflicts of interest.....................................................56
Sub-section 5.5.7.3.: Obligation to inform investors....................................................................57
Section 5.5.8. Rules of conduct.........................................................................................................57
Section 5.5.9. Remuneration policy..................................................................................................57
Section 5.5.10. Exercise of voting rights..........................................................................................58
Section 5.5.11. Obligations of the IFM to monitor compliance with the obligations under EMIR..58
Section 5.5.12. Obligations of the IFM to monitor compliance with the obligations under the MMFR
..........................................................................................................................................................59
Chapter 6. Specific organisational arrangements........................................................................ 60
Sub-chapter 6.1. Limits to the scope of delegation .................................................................. 60
Sub-chapter 6.2. Delegation framework................................................................................... 61
Section 6.2.1. Obligation to notify the CSSF....................................................................................62
Section 6.2.2. Obligation to draw up a contract................................................................................63
Section 6.2.3. Initial due diligence and ongoing monitoring of delegates........................................63
Sub-section 6.2.3.1. General principles ........................................................................................63
Sub-section 6.2.3.2. Establishment of a delegation framework procedure ...................................63
Sub-section 6.2.3.3. Details on the initial due diligence...............................................................64
Sub-section 6.2.3.4. Details on the ongoing monitoring...............................................................66
Sub-chapter 6.3. Organisation of the portfolio management function .................................. 67
Section 6.3.1. Specificities related to the internal performance of the portfolio management function
..........................................................................................................................................................67
Sub-section 6.3.1.1. Implementation of a portfolio management procedure ................................67
Sub-section 6.3.1.2. Details on the staff and IT systems ..............................................................68
Sub-section 6.3.1.3. Functioning of the portfolio management committee ..................................68
Sub-section 6.3.1.4. Use of investment advisers...........................................................................68
Section 6.3.2. Specificities related to the delegation of the portfolio management..........................69
Sub-section 6.3.2.1. Specific conditions.......................................................................................69
Sub-section 6.3.2.2. Due diligence and ongoing monitoring........................................................70
Sub-chapter 6.4. Organisation of the function of UCI administration .................................. 71
Section 6.4.1. General obligations....................................................................................................71
Section 6.4.2. Specificities related to the wholly or partially internal UCI administration function71
Section 6.4.3. Specificities related to the delegation of the UCI administration ..............................72

Circular CSSF 18/698 Page 6/96
Sub-section 6.4.3.1. Specific conditions.......................................................................................72
Sub-section 6.4.3.2. Due diligence and ongoing monitoring........................................................73
Sub-chapter 6.5. Organisation of the marketing function ...................................................... 73
Sub-chapter 6.6. Organisation of the valuation function (specific provisions applicable to
IFMs authorised as AIFM) ........................................................................................................ 74
Section 6.6.1. General obligations....................................................................................................74
Section 6.6.2. Specificities related to the internal performance of the valuation function ...............75
Section 6.6.3. Specificities related to the delegation of the valuation function ................................76
Chapter 7. External audit............................................................................................................... 76
Chapter 8. Information exchange between the IFM and the depositary................................... 76
Chapter 9. Programme of activity................................................................................................. 77
Part III. Conditions for obtaining and maintaining the authorisation of IFMs which exercise
activities of UCI management and management of portfolios of investments on a client-by-client
basis as referred to in Article 101(3) of the 2010 Law and Article 5(4) of the 2013 Law ......... 79
Part IV. The IFM and the principle of freedom of establishment and freedom to provide
services............................................................................................................................................. 80
Chapter 1. Freedom to establish a branch.................................................................................... 80
Sub-chapter 1.1. Obligation of notification .............................................................................. 80
Sub-chapter 1.2. Operating conditions..................................................................................... 81
Chapter 2. Freedom to provide services....................................................................................... 82
Chapter 3. General provisions regarding the freedom of establishment and the freedom to
provide services............................................................................................................................... 82
Part V. Principle of proportionality .............................................................................................. 83
Part VI. IFMs governed by Article 125-1 of Chapter 16 and IFMs governed by Chapter 17 of
the 2010 Law.................................................................................................................................... 83
Chapter 1. IFMs governed by Article 125-1 of Chapter 16 of the 2010 Law ............................ 83
Chapter 2. IFMs governed by Chapter 17 of the 2010 Law........................................................ 84
Part VII. The SIAG and the FIAAG............................................................................................. 84
Chapter 1. Conditions for obtaining and maintaining authorisation ........................................ 84
Chapter 2. Prudential supervision of SIAGs and FIAAGs......................................................... 86
Part VIII. Communication with the CSSF ................................................................................... 86
Part IX. Entry into force and various provisions......................................................................... 86
ANNEXES ....................................................................................................................................... 87
ANNEX 1: The risk management procedure of AIFs to be communicated to the CSSF......... 87

General section: governance and organisation of the risk management function......... 87
Specific complementary section: risk management policy in respect of strategies....... 90
Specific complementary section: exercise of discretionary management....................... 90

Circular CSSF 18/698 Page 7/96
ANNEX 2: Summary table of the arrangements for the communication to the CSSF according
to the nature of the change (non-exhaustive list) ......................................................................... 91

Changes subject to prior notification with a view to authorisation by the CSSF (nonexhaustive list):............................................................................................................................ 91
Changes subject to notification to the CSSF (non-exhaustive list):................................ 92
List of closing documents to be provided yearly, within five months following the end of
the financial year of the IFM at the latest, except the elements referred to in points 1 and 2 which must be submitted within one month after the ordinary general meeting that approved the annual accounts of the IFM and seven months following the closing date of the financial
year of the IFM at the latest: ..................................................................................................... 93
ANNEX 3: Specific information applicable to the SIAGs and the FIAAGs.............................. 94

Circular CSSF 18/698 Page 8/96
Part I. Definitions and abbreviations

For the purposes of this circular:

“EBA” means the European Banking Authority;
“EIOPA” means the European Insurance and Occupational Pensions Authority;
“ESMA” means the European Securities and Markets Authority;
“ML/TF” means money laundering and terrorist financing;
“Circular CSSF 07/290” means Circular CSSF 07/290, as amended by Circular CSSF 10/451
on the definition of capital ratios pursuant to Article 56 of the Law of 5 April 1993 on the financial sector, as amended, (the circular is currently being updated);
“Circular CSSF 17/661” means Circular CSSF 17/661 adopting the joint guidelines issued by
the three European Supervisory Authorities (EBA/ESMA/EIOPA) on money laundering and terrorist financing risk factors;
“Circular CSSF 11/512” means Circular 11/512 presenting the main regulatory changes in risk
management following the publication of CSSF Regulation 10-04 and ESMA clarifications, laying down further clarifications from the CSSF on risk management rules and defining the content and format of the risk management process to be communicated to the CSSF;
“CRR” means Regulation (EU) No 575/2013 of 26 June 2013 on prudential requirements for
credit institutions and investment firms and amending Regulation (EU) No 648/2012;
“delegate” means any third party carrying out on behalf of an IFM:

one or more functions included in the activity of collective portfolio management as
defined in Annex II of the 2010 Law as well as part of the risk management activities in accordance with point 222 or functions included in Annex I of the 2013 Law, respectively;
for an AIFM, the external valuer;

“AIFMD” means Directive 2011/61/EU of the European Parliament and of the Council of 8
June 2011 on Alternative Investment Fund Managers;
“UCITS Directive” means Directive 2009/65/EC of the European Parliament and of the
Council of 13 July 2009 on the coordination of laws, regulations and administrative provisions relating to undertakings for collective investment in transferable securities (UCITS);
“FTE” means full-time equivalent;
“AIF” means an alternative investment fund as defined in Article 1 of the 2013 Law including
the European long-term investment fund (ELTIF), the European social entrepreneurship fund (EuSEF) and the European venture capital fund (EuVECA);
“FIAAG” means a self-managed alternative investment fund: internally managed AIF within
the meaning of point (b) of Article 4(1) of the 2013 Law;
“key functions” means functions included in the activity of collective portfolio management
as defined in Annex II of the 2010 Law or functions included in Annex I of the 2013 Law, respectively, including monitoring delegates of the above-mentioned functions, permanent compliance, risk management and internal audit functions as well as, the valuation function for the AIFM;
“required own funds” means

the own funds required under Articles 101(4) and 102(1)(a) of the 2010 Law as well as
Article 8 of the 2013 Law;
where appropriate, the own funds referred to in Articles 12 to 15 of Delegated Regulation
(EU) 231/2013 for an AIFM;
where the IFM is also authorised to provide the services referred to in Article 101(3) of
the 2010 Law and/or in Article 5(4) of the 2013 Law, the own funds required under Circular CSSF 07/290;

“AIFM” means an alternative investment fund manager authorised under Chapter 2 of the
2013 Law;

Circular CSSF 18/698 Page 9/96
18) “senior management” means the persons who effectively conduct the business of an IFM
within the meaning of Article 102(1)(c) of the 2010 Law and Article 7(1)(c) of the 2013 Law;
19) “Law of 27 October 2010” means the Law of 27 October 2010 enhancing the anti-money
laundering and counter terrorist financing legal framework; organising the controls of physical transport of cash entering, transiting through or leaving the Grand Duchy of Luxembourg; implementing United Nations Security Council resolutions as well as acts adopted by the European Union concerning prohibitions and restrictive measures in financial matters in respect of certain persons, entities and groups in the context of the combat against terrorist financing;
20) “AML/CFT Law” means the Law of 12 November 2004 on the fight against money laundering
and terrorist financing, as amended;
21) “2010 Law” means the Law of 17 December 2010 relating to undertakings for collective
investment, as amended;
22) “2013 Law” means the Law of 12 July 2013 on alternative investment fund managers, as
amended;
23) “AML/CFT” means Anti-Money Laundering and Counter-Terrorist Financing;
24) “LFS” means the Law of 5 April 1993 on the financial sector, as amended;
25) “UCIs” include undertakings for collective investment in transferable securities (UCITS),
regulated and non-regulated alternative investment funds (AIFs), investment companies in risk capital (SICARs) which do not qualify as AIF and specialised investment funds (SIFs) which do not qualify as AIF;
26) “UCITS” means undertaking for collective investment in transferable securities subject to the
UCITS Directive;
27) “management body” means management body as defined in Article 1(26a) of the 2010 Law,
namely: a) as regards sociétés anonymes (public limited companies), the board of directors or the management board, as the case may be; b) as regards other types of companies, the body that represents the management company or the UCITS pursuant to the law and the instruments of incorporation;
28) “governing body” means the governing body as defined in Article 1 of Delegated Regulation
(EU) 231/2013, namely the body with ultimate decision-making authority in an AIFM, comprising the supervisory and the managerial functions, or only the managerial function if the two functions are separated;
29) “Joint Guidelines” means joint guidelines of ESMA, the EBA and EIOPA on the prudential
assessment of acquisitions and increases of qualifying holdings in the financial sector;
30) “Joint Guidelines (EBA/ESMA/EIOPA) on ML/TF risk factors” means joint guidelines issued
by the three European Supervisory Authorities (EBA/ESMA/EIOPA) on money laundering and terrorist financing risk factors;
31) “qualifying holding” means a direct or indirect holding in an undertaking which represents
10% or more of the capital or of the voting rights or which makes it possible to exercise a significant influence over the management of that undertaking;
32) “RMP” means risk management procedure;
33) “PRIIPs-KID” means key information documents for packaged retail and insurance-based
investment products, required under Regulation (EU) No 1286/2014 of the European Parliament and of the Council of 26 November 2014;
34) “Delegated Regulation (EU) 2016/438” means Commission Delegated Regulation (EU)
2016/438 of 17 December 2015 supplementing Directive 2009/65/EC of the European Parliament and of the Council with regard to obligations of depositaries;
35) “Delegated Regulation (EU) 231/2013” means Commission Delegated Regulation (EU) No
231/2013 of 19 December 2012 supplementing Directive 2011/61/EU of the European Parliament and of the Council with regard to exemptions, general operating conditions, depositaries, leverage, transparency and supervision;
36) “Delegated Regulation (EU) 241/2014” means Commission Delegated Regulation (EU) No
241/2014 of 7 January 2014 supplementing Regulation (EU) No 575/2013 of the European

Circular CSSF 18/698 Page 10/96
Parliament and of the Council with regard to regulatory technical standards for Own Funds requirements for institutions, as amended;
37) “EMIR” means Regulation (EU) No 648/2012 of the European Parliament and of the Council
of 4 July 2012 on OTC derivatives, central counterparties and trade repositories as well as the related delegated and implementing acts;
38) “MiFID II Regulation” means

Law of 30 May 2018 on markets in financial instruments and transposing Directive
2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU;
Regulation (EU) No 600/2014 on markets in financial instruments (MiFIR)
Grand-ducal Regulation of 30 May 2018 on the protection of financial instruments and
funds belonging to clients, product governance obligations and the rules applicable to the provision or reception of fees, commissions or any monetary or non-monetary benefits;
Commission Delegated Regulation (EU) 2017/565 of 25 April 2016 supplementing
Directive 2014/65/EU of the European Parliament and of the Council as regards organisational requirements and operating conditions for investment firms and defined terms for the purposes of that Directive; and
relevant delegated acts, implementing acts as well as guidelines and FAQs;

“MMFR” means Regulation (EU) 2017/1131 of the European Parliament and of the Council
of 14 June 2017 on money market funds as well as the relevant delegated acts, implementing acts and guidelines;
“CSSF Regulation 10-4” means CSSF Regulation N° 10-4 transposing Commission Directive
2010/43/EU of 1 July 2010 implementing Directive 2009/65/EC of the European Parliament and of the Council as regards organisational requirements, conflicts of interest, conduct of business, risk management and content of the agreement between a depositary and a management company;
“CSSF Regulation 12-02” means CSSF Regulation N° 12-02 of 14 December 2012 on the
fight against money laundering and terrorist financing;
“CSSF Regulation 16-07” means CSSF Regulation N° 16-07 relating to out-of-court
complaint resolution;
“SIAG” means self-managed investment company;
“UCITS-KIID” means key investor information documents, required under Commission
Regulation (EU) No 583/2010 of 1 July 2010 implementing Directive 2009/65/EC of the European Parliament and of the Council as regards key investor information and conditions to be met when providing key investor information or the prospectus in a durable medium other than paper or by means of a website.

Circular CSSF 18/698 Page 11/96
Part II. Conditions for obtaining and maintaining the authorisation of an
authorised investment fund manager (IFM) who engages solely in the activity of management of UCIs as laid down in Article 101(2) of the 2010 Law and Article 5(2) of the 2013 Law
Chapter 1. Basic principles
2. Access to the business of an IFM is subject to prior authorisation by the CSSF (in accordance with
Articles 101 and 125-2 of the 2010 Law and/or Article 6 of the 2013 Law, respectively).
3. The same applies when a Luxembourg IFM opens agencies in Luxembourg, representative offices
and branches in Luxembourg and/or abroad.
4. For an AIFM, the scope of responsibility of the AIFM vis-à-vis each managed AIF must be assessed
taking into account the compulsory or ancillary nature of the functions laid down in point (1) or (2) of Annex I of the 2013 Law and performed by the AIFM. However, this principle does not exempt the AIFM from complying with the provisions referred to in Sub-chapter 5.4. Organisation of the fight against money laundering and terrorist financing, and in point 516 of Sub-chapter 6.4. Organisation of the function of UCI administration
Chapter 2. Shareholding
Sub-chapter 2.1. Initial authorisation
5. The CSSF only grants authorisation to an IFM if it has been informed of the identities of the direct
and indirect1 shareholders or members, whether natural or legal persons, that have qualifying holdings, and of the amounts of those holdings. The CSSF must be satisfied that a holder of a qualifying holding is of good repute and suitable to exercise its powers so that the sound and prudent management of the IFM is ensured (Articles 103(1) of the 2010 Law and 7(1)(d) of the 2013 Law).
6. Moreover, the direct and indirect shareholding structure, including the persons with whom the IFM
has close links, must be clearly determined and organised so that the CSSF is not prevented from exercising supervision (Articles 102(2) of the 2010 Law and 7(3) of the 2013 Law).
7. Sound and prudent management is assessed in the light of the assessment criteria laid down in
Chapter 3 of the Joint Guidelines2
. The five criteria are:

reputation/good repute of the proposed acquirer;
reputation/good repute and professional experience of those who will direct the business
of the IFM;
financial soundness of the proposed acquirer3
;
compliance with prudential requirements of the IFM;
absence of suspicion of money laundering or terrorist financing by the proposed
acquirer.

1 “Indirect shareholders” means the ultimate shareholders and beneficial owners of the IFM’s shareholding structure. 2 JC/GL/2016/01 of 20 December 2016:
https://esas-joint-committee.europa.eu/Publications/Guidelines/JC_QH_GLs_EN.pdf 3 For the IFM which adopted the form of a société en commandite (limited partnership), the concept of acquirer includes both, the general partner and the limited partner.

Circular CSSF 18/698 Page 12/96
8. Provision applicable to ManCos: As regards the IFM governed by Chapter 15 of the 2010 Law, the
concept of sound and prudent management is assessed specifically in the light of the assessment criteria laid down in Article 108 of the 2010 Law which refers to Article 18 of the LFS.
9. The application file submitted for authorisation as provided for in point 2 of this circular must include
at least the information listed in Annex I of the Joint Guidelines.
10. The authorisation request must comprise a detailed organisation chart of the group to which the IFM
belongs. This chart must identify the direct shareholders and every indirect shareholder having a qualifying holding in the IFM. In any case, the final beneficial owner of the IFM must be identified. The organisation chart must highlight the possible holdings/subsidiaries and branches of the IFM and, in principle, all the entities which are part of the group.
11. Furthermore, the authorisation request must comprise, for each shareholder intending to have a
qualifying holding, the following information to be provided in one of the languages approved by the CSSF in accordance with Part VIII of this circular:

the declaration of honour of the shareholder(s), the template of which can be
downloaded on the CSSF website;
for each shareholder who is a natural person: a curriculum vitae dated and signed, a
copy of the ID documents, a recent extract of the criminal record, if available, or any other equivalent document and an up-to-date wealth declaration;
for each shareholder that is a legal person: the jurisdiction in which it is established, the
existence of prudential supervision and the nature of the authorisation(s) granted to the entities concerned, the articles of incorporation of the company and its annual accounts, if possible the audited annual accounts, regarding the three last financial years and the proof of existence of a legal obligation to have the annual accounts audited by a réviseur d'entreprises (statutory auditor) or an equivalent person.

The authorisation file must contain an adequate justification regarding the structure chosen for the
establishment of a Luxembourg IFM. The structuring cannot bypass the applicable requirements for the fight against money laundering and terrorist financing, as specified in Circular CSSF 17/650 on the application of the AML/CFT Law and Grand-ducal Regulation of 1 February 2010 providing details on certain provisions of the AML/CFT Law to predicate tax offences.
The request must also prove compliance with the following conditions:

the shareholder must, in principle, finance the incorporation of the IFM with his own
funds. The financing arrangements of the holdings in the IFM, notably the cash transfer mechanisms at group level, must be described;
the financing by the shareholder must, in principle, be carried out on behalf of the
shareholder himself and not on behalf of a third party;
the shares of the IFM held by the shareholders cannot, in principle, be pledged.

All direct shareholders of an IFM which are legal persons, must, in principle, have own funds that
are at least equivalent to the amount they intend to invest in the IFM and as recorded at cost after deducting the other holdings they have, where appropriate. The authorisation file must show compliance with this requirement.
In the case where the depositary has a direct or indirect qualifying holding in an IFM, the IFM must
identify the conflicts of interest which could result from this holding and strive to avoid them in accordance with the procedures provided for in the conflict of interest policy of the IFM.
In order to enhance compliance with the prudential requirements and rules of conduct, the CSSF may
request a lettre de patronage (sponsorship letter). The issuer of this letter provides assurance to the CSSF that the entity patronnée (sponsored) complies/will comply with the prudential requirements imposed by the applicable law, particularly regarding the own funds requirements. This letter may be requested:

Circular CSSF 18/698 Page 13/96

at the time of the authorisation process of the IFM;
at the time of changes in the shareholding of the IFM; and
during the lifetime of the IFM, when the financial soundness of the IFM and/or of the
existing shareholder(s) is not ensured any more.
Sub-chapter 2.2. Changes in the shareholding

In accordance with Article 108(1) of the 2010 Law and Article 9(1) of the 2013 Law, the IFM must
notify the CSSF beforehand of any changes regarding the holders of a qualifying holding and, in any case, as soon as it has knowledge thereof at the latest.
Specific provision applicable to ManCos: For the purpose of authorisation, the ManCo must inform
the CSSF in writing and prior to the operation in the following cases:

where a qualifying holding in a ManCo subject to Chapter 15 of the 2010 Law is
acquired, directly or indirectly, or this qualifying holding is increased so that the proportion of the voting rights or of the capital held reaches or exceeds 20%, 331/3% or 50% or so that the ManCo becomes a subsidiary;
where a qualifying holding in a ManCo subject to Chapter 15 of the 2010 Law is
disposed of, directly or indirectly, or this qualifying holding is decreased so that the proportion of the voting rights or of the capital held falls below 20%, 331/3% or 50% or so that the ManCo ceases to be a subsidiary.

The CSSF expects that the AIFM also informs the CSSF in the cases referred to under point 18 above.
The notification file referred in point 17 above must include a detailed and up-to-date organisation
chart of the group to which the acquirer belongs, the target organisation chart of the group following the operation as well as an update of the documents laid down in Sub-chapter 2.1. (Initial authorisation) above. In case of acquisition by a new shareholder which intends to redirect the strategy of the IFM, the file must comprise an updated version of the programme of activity referred to in Chapter 9.
As regards changes in the number of units or shares held by an existing shareholder who is a natural
person, the copy of the ID documents, the curriculum vitae and the extract of the criminal record will, in principle, not be requested.
In case of a change affecting the shareholding structure of an IFM not covered under points 17 and
18 of this circular, as for example, some restructurings of the group to which the IFM belongs, the direct or indirect acquisition/disposal of a non-qualifying holding, the increase/decrease of a holding without exceeding however the thresholds referred to in point 18, the IFM must inform the CSSF thereof.
In case of a change affecting the organisation chart of the group, the IFM must provide an updated
organisation chart of the group, highlighting, in particular, the entities subject to supervision by a supervisory authority as well as the entities whose securities are admitted to listing on a market.
Chapter 3. Own funds
Sub-chapter 3.1. Required own funds
Every IFM must have suitable and sufficient financial means in relation to its activities.
At the moment of its incorporation, the IFM other than a SIAG or FIAAG must have an initial capital
of at least EUR 125,000 or a fully paid-up equivalent amount in another currency which is at least as high as this amount.
The SIAG and the FIAAG must have an initial capital of at least EUR 300,000 or a fully paid-up
equivalent amount in another currency which is at least as high as this amount.

Circular CSSF 18/698 Page 14/96
27. The CSSF does not, in principle, accept contributions in kind, such as receivables, either at the time
of the incorporation of the IFM, or in the case of capital increase during its lifetime.
28. Every IFM whose authorisation exclusively covers UCI management within the meaning of Article
101(2) of the 2010 Law and/or Article 5(2) of the 2013 Law must at any time be able to prove an amount of own funds which is at least equal to the greater of the two following amounts:

EUR 125,000, supplemented by an additional amount of own funds equal to 0.02% of
the amount by which the value of the portfolios of the IFM exceeds EUR 250 million. The total initial capital and additional amount required in view of the value of the managed portfolios do however not exceed EUR 10 million. To this end, the value of the managed portfolios corresponds to the sum of the net asset values of all managed UCIs, including non-regulated AIFs and UCIs not qualifying as AIF. Where a UCI invests in other UCIs managed by the same external manager, this investment may be excluded from the calculation of the assets under management of the IFM;
one quarter of the preceding year’s fixed overheads as provided for Article 102(1)(a),
third indent, of the 2010 Law and Article 8(5) of the 2013 Law, with reference to Article 97 of the CRR. In accordance with Article 97(2) of the CRR, the CSSF reserves the right to adjust the own funds requirements if there is a significant change in the business of the IFM since the preceding year.

Upon authorisation of the IFM, the minimum amount of own funds is calculated on the basis of
estimated indications of the fixed overheads for the first financial year.
The methods for the determination of the fixed overheads within the meaning of Article 97 of the
CRR are specified in Articles 34b and 34d of Delegated Regulation (EU) 241/2014.
The IFM must calculate the fixed overheads of the preceding year using the subtraction approach.
For this purpose, and pursuant to Article 34b(2) of Delegated Regulation (EU) 241/2014, the fixed overheads are calculated based on the amount of total expenses after deducting the distribution of profits to shareholders in its most recent audited annual financial statements from which several specific variable expenses are subtracted so that only fixed expenses recurring every financial year are retained. The items listed in points (a) to (h) of Article 34b(2) of Delegated Regulation (EU) 241/2014 are deducted where these items are relevant to an IFM. It is worth mentioning that the distribution of the IFM’s profits is not considered as a charge and cannot therefore be deducted.
The CSSF would like to indicate that the fees paid by the IFM and which correspond to the
remuneration for the services provided by delegates on behalf of the managed UCIs are not considered as fixed overheads within the meaning of Article 97 of the CRR and may thus be deducted.
Within the limits of the provisions of Article 102(1)(a) of the 2010 Law and Article 8(6) of the 2013
Law, an IFM does not have to provide up to 50% of additional own funds calculated according to the value of the managed portfolios exceeding EUR 250 million, if it benefits from a guarantee of the same amount given by a credit institution or an insurance undertaking which has its registered office in a Member State, or in a third country where it is subject to prudential rules considered by the CSSF as equivalent to those laid down in EU law.
The provision or withdrawal of such a guarantee as well as any change regarding the conditions of
this guarantee must be notified beforehand to the CSSF.
Irrespective of the above, the IFM which is also authorised to provide the services referred to in
Article 101(3) of the 2010 Law and/or Article 5(4) of the 2013 Law must, in addition, comply with
the Luxembourg regulations transposing Directive 2013/36/EU of 26 June 2013 regarding capital adequacy.

Circular CSSF 18/698 Page 15/96
36. The CSSF publishes on its website4 details on the methods for calculating the required own funds of
IFMs.
Specific provisions applicable to AIFMs:
37. To cover potential professional liability risks resulting from the activities the AIFM may carry out
pursuant to the 2013 Law, the AIFM and the FIAAG must either:

have additional own funds which are appropriate to cover potential liability risks arising
from professional negligence; or
hold a professional indemnity insurance against liability arising from professional
negligence which is appropriate to the risks covered.
To this end, every AIFM and every FIAAG must comply with the provisions laid down in Articles 12 to 15 of Delegated Regulation (EU) 231/2013.

The AIFM which decided to cover the liability risks arising from professional negligence through
additional own funds must have an additional amount of own funds of at least 0.01% of the value of the portfolios of managed AIFs. Where an AIF invests in other AIFs managed by the same external manager, this investment cannot be excluded from the calculation of assets under management of the IFM for the purposes of calculating the additional own funds requirements referred to in this point.
The AIFM which has a professional indemnity insurance in accordance with the provisions of Article
15 of Delegated Regulation (EU) 231/2013 must notify the CSSF, as soon as it has knowledge thereof, of any changes in the insurance policy, particularly with respect to the amount of the defined excess and the covered amounts as referred to in paragraphs 3 and 4 of Article 15 of Delegated Regulation (EU) 231/2013. Sub-chapter 3.2. Eligible capital
The composition of and conditions for the eligibility of the IFMs’ own funds are set out in Article 25
to 88 of the CRR.
Eligible capital is composed of:

Tier 1 capital referred to in Article 25 of the CRR which consists of:
Common Equity Tier 1 capital (defined in Articles 26 to 50 of the CRR) after
deducting the items referred to in Articles 36 to 49; and
Additional Tier 1 capital (defined in Articles 51 to 61 of the CRR) after deducting
the items referred to in Articles 56 to 60;
Tier 2 capital referred to in Articles 62 to 71 of the CRR.

The accounting value of possible holdings of the IFM as shown in the balance sheet of the IFM is
notably deducted from eligible capital.
It should be borne in mind that any changes in the share capital of the IFM is subject to prior approval
by the CSSF.
The IFM must implement procedures that allow it to calculate at any time its minimum amount of
own funds required under the applicable laws and regulations (i.e.: required own funds) as well as its eligible capital as referred to in this sub-chapter. Sub-chapter 3.3. Use of own funds
In accordance with Articles 102(1)(b) of the 2010 Law and 8(8) of the 2013 Law, the CSSF requires
the minimum required own funds pursuant to the legal and regulatory requirements to be maintained at permanent disposal of the IFM and invested in its own interest in order to ensure the continuity and regularity of the activities and the services provided by the IFM.

4 Point 17 of https://www.cssf.lu/en/document/faq-alternative-investment-fund-managers/

Circular CSSF 18/698 Page 16/96
46. It is permissible for the required own funds to be invested in liquid assets or assets easily convertible
into liquid short-term assets and not containing any speculative positions.
47. In this context, the IFM must implement a treasury management policy. The surplus own funds
required under the legal and regulatory requirements may be invested in non-liquid assets, provided that these assets do not pose a substantial risk for the required own funds of the IFM and do not jeopardise the sound and prudent management of the IFM. The acquisition of units/shares of UCIs by the IFM, for example during the launch of UCIs or of classes of units/shares in managed UCIs (seeding), must be financed by the IFM’s surplus own funds in relation to the required own funds.
48. The own funds of the IFM required under the legal and regulatory requirements can neither be used
for investment in the shareholder of the IFM nor be used for granting a loan to this shareholder. Arrangements with respect to holdings and creation of subsidiaries
49. Any holding of an IFM in another company, as well as any creation or acquisition of a subsidiary
within the meaning of Article 1(18) of the 2010 Law or Article 1(44) of the 2013 Law must be notified beforehand to the CSSF in writing.
50. The IFM must be able to demonstrate that the holding or subsidiary activity remains in line with the
activities which may be carried out by an IFM.
51. The file must include at least:

the reasons for the acquisition and the expected synergies;
the post-acquisition organisation chart of the group;
the articles of incorporation of the target company and a description of its activities;
the amount of the share capital of the target company;
the financing arrangements for the acquisition of the target company;
the analysis of the impact of the acquisition on the compliance with the own funds
requirements of the IFM;
the annual accounts, if possible audited annual accounts, of the last three financial years
of the target company (if available); if not, the financial situation and the profit and loss account of the last three financial years of the target company or, in case of a newly incorporated company, its projected accounts (profit and loss account and balance sheet) for the next three financial years as well as the development assumptions;
the confirmation that the IFM’s procedures regarding compliance with AML/CFT
obligations apply to the subsidiary;
the update of the IFM’s internal audit and compliance programmes in order to include
the subsidiaries;
the pro forma consolidated accounts of the IFM post-acquisition.

In accordance with Article 102(1)(b) of the 2010 Law and Article 8(8) of the 2013 Law, the
acquisition must be financed solely by the surplus of own funds that the IFM has at the time of the incorporation or acquisition of the target company in relation to the required own funds.
Consequently, borrowing or any other type of advance is, in principle, not authorised.
The IFM must analyse the risks of conflicts of interest arising from the holding or the subsidiary and
take all necessary measures to prevent or manage these conflicts of interest pursuant to the provisions laid down in Section 5.5.7. (Management of conflicts of interest) of this circular.
The IFM must provide the CSSF upon request with the annual accounts, if possible audited annual
accounts, of the subsidiary or company in which it has a holding.
In order to enhance compliance with the prudential requirements, the CSSF requests the IFM to
provide the half-yearly financial situation of the IFM, its subsidiaries and its qualifying holdings. To this end, the standard consolidation methods (for example, the global integration or equity method) must be applied. An undertaking need not be included in the consolidated accounts where it is not

Circular CSSF 18/698 Page 17/96 material. This document must be sent to the CSSF via email at opc@cssf.lu within two months following the end of the calendar half year.
57. The compliance and internal audit functions must also cover the activity of the subsidiaries owned
by an IFM, where appropriate.
Chapter 4. The bodies of the IFM
Sub-chapter 4.1. The members of the governing body or management body
58. This sub-chapter applies to the members of the governing body or management body. Where a legal
person is appointed as member of the governing body or management body, this sub-chapter applies to the permanent representative of the legal person. The supervisory board must also comply with the provisions referred to in this sub-chapter.
Section 4.1.1. Required number
59. There must be at least three members of the management body/governing body. However, in case of
a two-tier system in which the supervisory and management functions are separated, the supervisory board must be composed of three members at least and the management board must be composed of two members at least.
Section 4.1.2. Requirements regarding the skills, experience and good repute and the
composition of the management body/governing body
60. The members of the management body/governing body must possess sufficient skills and
professional experience having regard to the type(s) of UCI(s) concerned and to the investment strategies of the managed UCIs, particularly the strategies referred to in Annex IV of Delegated Regulation (EU) 231/2013 for which the AIFM is authorised, where appropriate.
61. With regard to sufficient experience, the members of the management body/governing body must
have adequate professional experience gained, for example, through having already carried out similar activities at a high level of responsibility and autonomy.
62. Every member of the management body/governing body must prove to be of good professional
repute.
63. The composition of the members of the management body/governing body as a whole must be
appropriate so that the management body/governing body can fully meet its responsibilities. The appropriateness refers in particular to professional skills (knowledge, understanding and experience), as well as personal qualities of the members of the management body/governing body. Thus, the management body/governing body, as collective body, must have a complete understanding of all the activities, risks incurred by the IFM and managed UCIs, as well as of the economic and regulatory environment in which the IFM operates. Every single member of the management body/governing body must have a complete understanding of the internal governance arrangements and his/her responsibilities within the IFM.
64. The members of the management body/governing body must ensure that their personal qualities
enable them to properly perform their mandate as member of the management body/governing body, with the required commitment, availability, objectivity, critical thinking and independence. In this respect, the management body/governing body cannot have a majority of persons among its members who take on an executive role within the IFM (conducting officers or other employees of the IFM, with the exception of staff representatives) unless adequately justified.
65. Moreover, with respect to the management of UCIs which adopted the form of a company, it is
recommended that the management body/governing body of the IFM and of the UCI concerned do not mainly consist of the same persons.

Circular CSSF 18/698 Page 18/96
66. In case a member of the management body/governing body is part of the IFM’s senior management,
s/he may, in addition to his/her mandate as member of the management body/governing body, assume the position of the Compliance Officer, the AML/CFT Compliance Officer or the person responsible for risk management. In case a member of the management body/governing body is part of the IFM’s senior management, s/he may, in addition to his/her mandate as member of the management body/governing body, assume the position of the person responsible for internal audit in accordance with the provision under point 97 below.
Section 4.1.3. Conditions for performing multiple mandates
67. The members of the management body/governing body must ensure that their mandate is and remains
compatible with their other professional occupations. They must inform the management body/governing body of the mandates they have outside the IFM. The IFM must then identify the conflicts of interest which could result from this organisation and strive to avoid them in accordance with the procedures provided for in the conflict of interest policy of the IFM.
68. Furthermore, every member of the management body/governing body of the IFM must dedicate the
required time and attention to his/her duties. Consequently, each one of them must ensure that s/he limits the number of other professional engagements to the extent necessary in order to perform his/her tasks correctly. “Mandate” means any position as member of a management body/governing body or of a supervisory function or of the senior management within regulated or non-regulated entities. The mandates for which an approval request which was submitted to a supervisory authority is being analysed must also be included.
69. As a result, every candidate for the position of member of the IFM’s management body/governing
body must ensure compliance with the following requirements:
a) the number of hours spent fulfilling professional engagements cannot exceed 1920 hours per year; and b) the number of mandates in regulated entities and in operating companies cannot exceed 20 mandates.
70. For the purposes of determining the number of performed mandates referred to in point 69(b) above,
the CSSF may consider the mandates within the entities that are part of the structure of some managed UCIs (such as, for example, the UCI’s mandates performed in special purpose vehicles or in the UCI itself) or the mandates of UCIs with the same initiator or the mandates in entities belonging to the same group and subject to supervision by an authority (such as, for example, the IFMs belonging to the same group) as one single mandate in order to assess the total number of mandates performed pursuant to the provisions of point 69(b) above. In that case, the candidate must justify such combination by demonstrating the synergies resulting from the performance of these combined mandates.
71. Where one of the thresholds referred to in point 69 above is exceeded, taking into account the
application of point 70, the candidate must enclose with his/her authorisation request a description of the measures implemented to ensure his/her additional mandate receives the required time and attention. This description must include, in particular, justifications on how the candidate intends to organise himself/herself to fulfil his/her responsibilities by taking into account the existing and future workload. The number of managed UCIs/compartments, the size, the volume, the nature, the scale and complexity of the managed UCIs/compartments and operating entities, where appropriate, must also be taken into account. The file must detail, in particular, the technical and administrative support the candidate requires or will require.
72. The thresholds referred to in point 69 must be revised downwards when the nature, scope or
complexity of the activities of the above-mentioned entities so justify or when the candidates’ work time is reduced.
73. Every member of the management body/governing body of the IFM is responsible for continuously
ensuring compliance with the principles laid down in this section.

Circular CSSF 18/698 Page 19/96
Section 4.1.4. Obligations regarding meetings and deliberations
74. The management body/governing body must meet regularly, and at least once every quarter, in order
to efficiently perform its duties. The frequency of the meetings must be proportionate to the nature, scale and complexity of the IFM’s activities. Video conferencing or any other means of remote telecommunication allowing the identification of the participants and ensuring the effective participation in the meeting of the management body/governing body is also accepted.
75. The work of the management body/governing body must be documented in writing. This
documentation must include the agenda of the meeting, the minutes of the meeting recording the decisions and measures taken by the management body/governing body. These minutes must be available or accessible in the premises of the IFM in Luxembourg. Sub-chapter 4.2. Senior management
Section 4.2.1. Required number, presence in Luxembourg and contractual relationship with
the IFM
76. “Senior management” means the persons who effectively conduct the business of the IFM within the
meaning of Article 102(1)(c) of the 2010 Law and Article 7(1)(c) of the 2013 Law (hereinafter the “conducting officers”) irrespective of the form or legal structure of the IFM. In case of a two-tier system, if one or more members of the management board are also members of the senior management, then these members must comply with the provisions of this sub-chapter.
77. Points 78 to 80 as well as points 84 and 85 set out the general principles regarding the required
number, the presence in Luxembourg and the contractual relationship with the IFM. Points 81 to 83 concern the specific requirements in the application of these principles according to the value of the portfolios managed by the IFM.
78. The number of conducting officers must be at least two.
79. For the accomplishment of their tasks, the conducting officers must, in principle, be permanently
located in Luxembourg. This does not however prevent the conducting officers from having their domicile in a place allowing them, in principle, to come to Luxembourg every day.
80. The IFM must employ at least two conducting officers in Luxembourg (i.e. bound to the IFM by an
employment contract and employees of the IFM) who spend an FTE on the duties in the IFM. The CSSF may accept that one or more conducting officers (including the legally required conducting officers) are made available or seconded, provided that there is an agreement precisely defining their rights and obligations and, where appropriate, the reporting lines, in accordance with the specific requirements referred to in points 81 and 82 below.
81. Where the value of the portfolios managed by the IFM as defined in Articles 102(1)(a) of the 2010
Law, 8(7) of the 2013 Law and the second subparagraph of Article 14(2) of Delegated Regulation (EU) 231/2013 is less than one billion five hundred million euros (EUR 1,500,000,000), the following conditions must apply:
a) the conducting officers cannot perform more than two mandates as conducting officer in IFMs; b) the CSSF may authorise, based on a prior and duly supported request for derogation, that only one of the legally required conducting officers is permanently located in Luxembourg, provided that the IFM employs sufficient and competent staff in Luxembourg in order to support the conducting officer who is not permanently located in Luxembourg in his/her duties and that this conducting officer can regularly come to Luxembourg to demonstrate that the provisions of Section 4.2.3. (Organisation of the senior management) and of point 118 are complied with; c) if the IFM has more than two conducting officers, the provisions of point 81 must also apply to these additional conducting officers.

Circular CSSF 18/698 Page 20/96
82. Where the value of the portfolios managed by the IFM as defined in Articles 102(1)(a) of the 2010
Law, 8(7) of the 2013 Law and the second subparagraph of Article 14(2) of Delegated Regulation (EU) 231/2013 exceeds one billion five hundred million euros (EUR 1,500,000,000), the following conditions must apply:
a) the two legally required conducting officers cannot perform other mandates as conducting officers of IFMs; b) if the IFM has only two conducting officers, then these two conducting officers must be permanently located in Luxembourg in accordance with point 79; c) if the IFM has more than two conducting officers, then the CSSF may authorise, based on a prior duly supported request for derogation, that one or more of these additional conducting officers are not permanently located in Luxembourg and/or spend less than an FTE on their duties, provided that the IFM employs sufficient and competent staff in Luxembourg in order to support these conducting officers in their duties and that they can regularly come to Luxembourg to demonstrate that the provisions of Section 4.2.3. (Organisation of the senior management) and of point 118 are complied with.
83. In accordance with the provisions referred to in points 81 and 82(c) above, a person performing more
than one mandate as conducting officer must be able to satisfactorily demonstrate to the CSSF that a second mandate as conducting officer does not and is not likely to prevent him/her from discharging soundly, honestly and professionally any of his/her functions with the necessary time and due attention. Moreover, the IFM must identify the conflicts of interest which could result from this organisation and strive to avoid them in accordance with the procedures provided for in the conflict of interest policy of the IFM.
84. The CSSF must be able to contact each conducting officer directly. These persons must be able to
provide all information that the CSSF deems essential for its supervision.
85. Furthermore, the conducting officers must benefit from appropriate support in their daily work
provided by qualified staff that are sufficient in number and working in Luxembourg (Section 5.1.1. Clarifications on human resources). The staff employed in one or more branches of the IFM may be taken into account. In any case, every IFM must employ at least three people full-time at the head office in Luxembourg (i.e.: senior management and/or staff) who perform key functions in accordance with point 123.
Section 4.2.2. Requirements regarding the skills, experience and the good repute of the senior
management
86. The conducting officers of the IFM must possess sufficient skills and professional experience having
regard to the type(s) of UCI(s) concerned and to the investment strategies of the managed UCIs, particularly the strategies referred to in Annex IV of Delegated Regulation (EU) 231/2013 for which the AIFM is authorised, where appropriate.
87. With regard to required experience, the conducting officers must have adequate professional
experience gained, for example, through having already carried out similar activities at a high level of responsibility and autonomy.
88. Each conducting officer must demonstrate his/her good repute.
89. The conducting officers, both individually and collectively, must have the necessary professional
skills (expertise, understanding and experience), good repute and personal qualities to fulfil their duties so as to ensure a sound and prudent management of the IFM.
Section 4.2.3. Organisation of the senior management
90. The conducting officers of every IFM must be members of the executive committee. The members
of this committee work together in close partnership to take all actions falling within the scope of their responsibilities.

Circular CSSF 18/698 Page 21/96
91. The executive committee, under the ultimate responsibility of the management body/governing body,
must, among other things:

implement strategies and guiding principles for central administration and internal
governance referred to in Chapter 5 below through specific written internal policies and procedures;
implement adequate internal control mechanisms (i.e. permanent risk management,
compliance and internal audit functions);
ensure that the IFM has the technical infrastructure and human resources necessary to
exercise its activity.

Moreover, the executive committee of the IFM must:

ensure and verify on a regular basis that the general investment policy and strategy
implemented comply with and reflect appropriately the prospectus and, where appropriate, the UCITS-KIID and/or the PRIIPs-KID of each UCI and that the general investment policy and strategy are described in a transparent manner in the prospectus and, where appropriate, in the UCITS-KIID and/or in the PRIIPs-KID;
implement the general investment policy for each UCI managed by the IFM, as defined,
where applicable, in the prospectus, fund rules or instruments of incorporation of the UCI pursuant to Article 10(2)(a) of CSSF Regulation 10-4 and Article 60(2)(a) of Delegated Regulation (EU) 231/2013;
oversee the approval of the investment strategies for each UCI managed by the IFM
pursuant to Article 10(2)(b) of CSSF Regulation 10-4 and Article 60(2)(b) of Delegated Regulation (EU) 231/2013;
ensure and verify on a regular basis that the general investment policy, the investment
strategies and the risk limits of each managed UCI are properly and effectively implemented and complied with, even if the risk management function is performed by third parties pursuant to Article 10(2)(d) of CSSF Regulation 10-4 and Article 60(2)(e) of Delegated Regulation (EU) 231/2013;
approve and review on a regular basis the adequacy of the internal procedures for
undertaking investment decisions for each managed UCI, so as to ensure that such decisions are consistent with the approved investment strategies pursuant to Article 10(2)(e) of CSSF Regulation 10-4 and Article 60(2)(f) of Delegated Regulation (EU) 231/2013;
approve, pursuant to Article 10(2)(f) of CSSF Regulation 10-4 and Article 60(2)(g) of
Delegated Regulation (EU) 231/2013, and review on a regular basis the risk management policy and the arrangements, processes and techniques for implementing that policy as referred to in Article 43 of CSSF Regulation 10-4 and Article 40 of Delegated Regulation (EU) 231/2013, including the risk limit system for each managed UCI;
implement and follow up the marketing policy and the distribution network of UCIs
managed by the ManCo and/or, where appropriate, by the AIFM;
establish and apply a remuneration policy in line with Article 111b of the 2010 Law
and/or Annex II of the AIFMD, respectively, pursuant to Article 60(2)(h) of Delegated Regulation (EU) 231/2013.

Specific provisions applicable to AIFMs: Pursuant to Article 60(2)(c) of Delegated Regulation (EU)
231/2013, the senior management of an AIFM must also ensure that the valuation policies and procedures are established and implemented in accordance with Article 19 of the AIFMD.
In the context of the operation of the executive committee and irrespective of the legal form or
structure of the IFM, each conducting officer is assigned specific areas of responsibility, notably with regard to the following functions/activities:

investment management;

Circular CSSF 18/698 Page 22/96

risk management;
administration of UCIs;
marketing;
compliance;
internal audit;
claim and complaint handling;
AML/CFT;
valuation;
IT function; and
accounting function.

The composition of the executive committee must be adapted having regard to the size of the IFM
and the nature, scale and complexity of its activities. Thus, in order to provide the executive committee with appropriate collective skills and experience in view of the size of the IFM, the nature, scale and complexity of its activities, the IFM must consider the appointment of more than two conducting officers.
The distribution of tasks between the conducting officers must be organised so as to avoid conflicts
of interest. Thus, the functions of risk-taking and independent control of these same risks cannot be assigned to the same conducting officer. For example, the performance and/or control of the risk management function and the performance and/or control of the investment management function cannot be ensured by the same conducting officer.
The conducting officer in charge of the internal audit function cannot exercise the function of the
Compliance Officer, of the AML/CFT Compliance Officer or of the person in charge of risk management and cannot be assigned to one of the above-mentioned functions or activities.
Every new application for authorisation of an IFM must include a description of the responsibilities
and the operating mode of the executive committee.
In addition, the CSSF must be informed beforehand in order to approve a change in the allocation of
the areas of responsibility among the conducting officers.
Section 4.2.4. Obligations regarding meetings and deliberations
In order to fulfil its responsibilities, the executive committee must work according to an operating
mode adapted to the activities of the IFM. Thus, for example, the conducting officers must be in regular contact with each other and hold periodic meetings in Luxembourg on a monthly basis at least or more frequently having regard to the size and organisation of the IFM and the nature, scale and complexity of its activities.
These meetings must be formalised in written minutes which record, among others, the decisions and
measures taken by the IFM. These minutes must be available in the premises of the IFM in Luxembourg.
The executive committee regularly informs the management body/governing body, in an exhaustive
manner and in writing, on the activities of the IFM and the UCIs it manages.
Sub-chapter 4.3. Procedure for the approval of the members of the management body/governing body and the conducting officers
This sub-chapter applies to the members of the management body/governing body and to the
conducting officers of the IFM. It also applies to members of the management board in the case where the IFM has adopted a two-tier system. The supervisory board must also comply with the provisions referred to in this sub-chapter.
The identity of the members of the management body/governing body and the conducting officers as
well as every person succeeding them in office must be notified beforehand to the CSSF for approval.

Circular CSSF 18/698 Page 23/96
105. This notification must be accompanied by the following pieces of information and any other
document which the CSSF may request subsequently:

a recent curriculum vitae, signed and dated;
a copy of the passport/identity card;
a declaration of honour, as may be downloaded on the CSSF website (www.cssf.lu);
a recent extract of the criminal record, if available, or any other equivalent document;
a table listing the professional activities and the mandates performed in the regulated
and non-regulated entities, including, among others, the mandates for which an approval was requested from a supervisory authority, and detailing the time spent on each activity or mandate, respectively. To this end, the candidates are requested to use the form which can be downloaded on the CSSF website (www.cssf.lu).

The IFM must report to the CSSF in writing and as soon as possible, on the revocations and
resignations of these persons by giving the grounds for the revocation or the resignation.
The IFM must communicate to the CSSF, on an annual basis, an updated table listing, for each
member of its management body/governing body and for each conducting officer, the professional activities and mandates performed as referred to in point 105 above. The CSSF must receive this list within five months following the end of the financial year of the IFM. Sub-chapter 4.4. Independence of the IFM’s bodies from the depositary
Insofar as every IFM must have solid governance arrangements, its shareholder or its shareholders
must take the independence principles into account when composing the management body/governing body of the IFM.
The principle of independence of the IFM from the depositary prevents a conducting officer of the
IFM from being employed by the depositary of a UCI which the IFM manages.
Specific provisions applicable to ManCos:
The IFM subject to Chapter 15 of the 2010 Law must comply with the provisions referred to in
Chapter 4 of Delegated Regulation (EU) 2016/438 as clarified by the CSSF in its FAQs published
on its website5
.
Thus, the ManCo with a one-tier system must ensure that no member of its board of directors or any
other management body is also a member of the management body or an employee of the depositary of UCITS it manages. It must also ensure that none of its employees are also members of the management body of the depositary of UCITS it manages. The ManCo with a two-tier system must comply with Article 21(d) and (e) of Delegated Regulation (EU) 2016/438.
Moreover, where a group link exists between the ManCo and the depositary with which assets of
UCITS managed by the ManCo are deposited, the ManCo must ensure the independence of the management bodies of the two entities and, where appropriate, of their supervisory function in accordance with Article 24 of Delegated Regulation (EU) 2016/438.
In addition, the ManCo must comply with the provisions of Article 23 of Delegated Regulation (EU)
2016/438 on conflicts of interest.
Specific recommendation to AIFMs: It is recommended that entities authorised only as AIFM
comply with points 110 to 113.

5 https://www.cssf.lu/en/document/faq-concerning-the-luxembourg-law-of-17-december-2010-relating-toundertakings-for-collective-investment/

Circular CSSF 18/698 Page 24/96
Chapter 5. Arrangements regarding the central administration and
internal governance
Sub-chapter 5.1. Arrangements regarding the central administration of the IFM
115. Every IFM must have a central administration in Luxembourg, consisting of a "decision-making
centre" and an "administrative centre". This requirement implies that the IFM cannot only have a corporate or registered office in Luxembourg.
116. The central administration of the IFM, referred to in Article 102(1)(e) of the 2010 Law and 7(1)(e)
of the 2013 Law should not be confused with the “administration” function referred to in Annex II of the 2010 Law or Annex I of the 2013 Law, respectively.
117. The central administration of the IFM, which comprises in a broad sense the functions of direction
and management, of execution and of control, must permit the IFM to have control of all its activities.
118. The concept of “decision-making centre” does not only include the activity of the senior management
pursuant to Article 102(1)(c) of the 2010 Law and Article 7(1)(c) of the 2013 Law but also the activities of the persons responsible for the different key functions or of any other business unit within the IFM.
119. The administrative centre comprises in particular a sound administrative and accounting organisation
which ensures, among others, the adequate execution of transactions, the correct and complete recording of transactions, the production of sound and readily available management information, the monitoring of delegated activities, the management of conflicts of interest and the compliance with applicable rules of conduct and other operating conditions. To that effect, the IFM must have in Luxembourg the human and technical resources necessary and sufficient to exercise the activities it intends to exercise and in order to monitor the delegated functions. This implies that it has the following elements (non-exhaustive list) in place in Luxembourg:

enough own competent operating staff in order to execute the decisions taken (Section
5.1.1.: Clarifications on human resources);
its own systems of execution, i.e. procedures and technical and IT infrastructures
(Section 5.1.2. : Clarifications on technical infrastructure, IT and business continuity);
an accounting function (Section 5.1.3.: Clarifications on the accounting function);
its own premises (Section 5.1.4: Clarifications on the premises in Luxembourg).

The concept of central administration implies also that the IFM must have the following elements in
Luxembourg:

its own internal control function (Sub-chapter 5.3.: Internal control functions);
its own procedures (Sub-chapter 5.5.: Requirements with respect to organisation and
procedures);
its own AML/CFT arrangements (Sub-chapter 5.4.: Organisation of the fight against
money laundering and terrorist financing);
documentation relating to its operations and those undertaken by the delegates on behalf
of the IFM (Chapter 6: Specific organisational arrangements).
Section 5.1.1. Clarifications on human resources

In accordance with Article 6 of CSSF Regulation 10-4 and Article 22 of Delegated Regulation (EU)
231/2013, every IFM must employ sufficient staff in Luxembourg with the skills, knowledge and expertise necessary to fulfil the tasks it intends to exercise and in order to efficiently supervise the delegated activities.
The staff must have appropriate individual and collective professional skills having regard to the
investment strategies of the managed UCIs.

Circular CSSF 18/698 Page 25/96
123. Every IFM must employ at least three full-time people (FTE) at the head office in Luxembourg who
perform key functions. Depending on the nature and complexity of its activity, the IFM must adapt the size of the teams performing key functions and employ more people with the necessary skills, knowledge and expertise in order to perform key functions.
124. Long-term absences or departures of staff members (for example, resignations or dismissals) cannot
impair the proper functioning of the IFM in the long run.
125. In the absence of a staff member in charge of key functions, it is necessary to arrange that a staff
member with appropriate experience and necessary independence replaces him/her if need be.
126. The staff are, in principle, employed by the IFM with which it is bound by an employment contract.
127. The CSSF may grant derogation from the requirements referred to in point 126 and authorise part of
the staff to be seconded or made available by an entity belonging to the same group or by a thirdparty company. In this case, the contract governing this secondment or this availability must be submitted to the CSSF for prior approval. Furthermore, the contract must contain rules for managing conflicts of interest between the relevant staff and the entity to which the staff also provide services. This contract must also specify the tasks of the relevant staff, the reporting line with the conducting officers of the IFM for the functions performed in the entity pursuant to Articles 5(1)(a) of CSSF Regulation 10-4 and 57(1)(a) of Delegated Regulation (EU) 231/2013 as well as actual time spent within the IFM. The staff thus made available to the IFM or seconded must be permanently located in Luxembourg and must be reachable at any time in Luxembourg during normal business hours. This does not however prevent the staff members from having their domicile in a place allowing them, in principle, to come to Luxembourg every day.
128. Where, due to the small size of the IFM, several duties and responsibilities have to be assigned to the
same person, this grouping must be organised so that it does not prejudice the objective pursued by the segregation of duties.
129. Specific provision applicable to ManCos: The performance of multiple functions by the same person
should not prevent or be likely to prevent this same person from discharging any particular function soundly, honestly and professionally in accordance with Article 6(3) of CSSF Regulation 10-4.
130. Specific recommendation to AIFMs: It is recommended that the AIFM also complies with the
provision referred to in point 129 above.
131. The organisation chart of the IFM must detail the various (operational and control) functions of the
structure and the reporting and functional links between these functions and between the senior management and management body/governing body of the IFM.
132. The organisation chart and description of the duties must be established based on the principle of
segregation of duties. Pursuant to this principle, the duties and responsibilities must be assigned so as to avoid that they are incompatible for the same person. The objective pursued is to avoid conflicts of interest and to prevent, through a peer review environment, a person from making mistakes and irregularities.
133. Upon the CSSF’s request, the IFM must provide an updated organisation chart. To this end, the
organisation chart must, in particular, include:

the name of the members of the management body/governing body, the conducting
officers and the persons responsible for key functions;
the number of staff assigned to each department or unit of the IFM, drawing a distinction
in particular between the functions of portfolio management, administration of UCIs, marketing, risk management, compliance, internal audit as well as between the persons in charge of AML/CFT and those responsible for monitoring the delegates.

Circular CSSF 18/698 Page 26/96
Section 5.1.2. Clarifications on technical infrastructure, IT and business continuity
134. Every IFM must have in its premises a suitable technical and IT infrastructure for the activity it
intends to exercise.
135. According to Article 5(2) of CSSF Regulation 10-4 and Article 57(2) of Delegated Regulation (EU)
231/2013, every IFM must establish, implement and maintain systems and procedures that are adequate to safeguard the security, integrity and confidentiality of information, taking into account the nature of the information in question.
136. The requirements in the above paragraph are best met when the IFM has its own IT infrastructure
which is supported by its own IT department organised and surrounded by an internal control system determined by the senior management. As a general rule, the IFM must have its own computers and appropriate and duly documented computer programmes in its premises in Luxembourg.
137. Thus, the IFM must implement procedures and a system for the identification and management of IT
risks, particularly in the following areas:

the risks related to the confidentiality, integrity and accessibility of data;
the risks related to the business continuity of the IFM and the resilience of IT systems;
the risks related to the outsourcing of the IT function, where appropriate;
the risks of computer fraud, characterised by the use of the IFM’s data, software and
hardware for malicious purposes;
the risks of cyber attacks.

However, the above provisions do not prevent an IFM from having, under its responsibility, recourse
to the services of a third party specialised in consultancy, programming, maintenance or management of IT systems. Any use of a third party must be notified beforehand to the CSSF and formalised by a service contract. In addition, the third party must be subject to initial due diligence and ongoing monitoring pursuant to the provisions under Sub-chapter 6.2. (Delegation framework) of this circular.
It is also permissible for an IFM to be linked by way of telecommunication to the data processing
centre located at its parent company or a subsidiary of its parent company. If the IFM uses the services of its parent company or of a subsidiary of its parent company, it must verify that the entity concerned is qualified for and able to provide these services.
In the event the IFM uses the services of a third party, it must ensure that it has quick and unlimited
access to its own information stored at the data processing centre. This information must be encrypted or otherwise protected according to other available technical means in order to ensure the security of communication and the confidentiality of client data.
Moreover, the IFM must be able to function normally in case of disruption of the IT systems. To this
end, it must implement a back-up solution in line with a business continuity plan as provided for by
Article 5(3) of CSSF Regulation 10-4 and Article 57(3) of Delegated Regulation (EU) 231/2013.
This business continuity plan must describe the actions to be implemented by the IFM in order to continue its activities in case of an incident or disaster related to unusual events. Where the IFM uses the services of its parent company or of a subsidiary of the parent company, the IFM may rely on the back-up solution of its parent company or this subsidiary, provided that the segregation of the IFM’s data is ensured.
An IFM must have suitable IT systems enabling it to comply with the provisions on sound
administrative organisation provided for in Article 109(1)(a) of the 2010 Law and Article 16 of the 2013 Law. In this context, a distinction must however be made between an IFM which performs itself one or more functions included in the activity of management of UCIs and an IFM which has delegated one or more of these functions to one or more third parties. Depending on the chosen organisation, the IFM must refer to the relevant sections of Sub-chapters 6.3. to 6.6. of this circular.
Circular CSSF 17/654 on IT outsourcing relying on a cloud computing infrastructure applies to an
IFM if the IFM uses this infrastructure. Pursuant to point 24(c) of the above-mentioned circular, the

Circular CSSF 18/698 Page 27/96
IFM must designate a person among its employees, the cloud officer, responsible for using cloud computing services and guarantor of the skills of the staff managing cloud computing resources. This function may be performed directly by the conducting officer in charge of the IT function.
144. The CSSF would like to remind all IFMs that they must comply with the provisions of Circular CSSF
11/504 on frauds and incidents due to external computer attacks.
Section 5.1.3. Clarifications on the accounting function
145. According to Article 5(4) of CSSF Regulation 10-4 and Article 57(4) of Delegated Regulation (EU)
231/2013, every IFM must establish, implement and maintain accounting policies and procedures as well as valuation rules providing financial information which reflects a true and fair view of the IFM’s financial situation.
146. Consequently, every IFM must communicate to the CSSF the name of the person in charge within
the IFM who can provide information on the accounting situation of the IFM.
147. The identity of the person responsible for the accounting function as well as of every person
succeeding him/her in office must be communicated forthwith to the CSSF.
148. Regarding the organisation of the accounting function, the IFM can either put in place its own
accounting function, or use, under its responsibility, the accounting expertise of a third party. Any use of a third party must be notified beforehand to the CSSF and formalised by a service contract. In addition, the third party must be subject to initial due diligence and ongoing monitoring pursuant to the provisions under Sub-chapter 6.2. (Delegation framework) of this circular.
149. Regardless of the organisation of the accounting function, particularly the use of a third party, the
accounting documents relating to the activity of the IFM must always be available and/or accessible electronically at the head office of the IFM in Luxembourg to enable the IFM to draw up a balance sheet and a profit and loss account in an independent way.
150. The accounting function must operate based on written procedures that provide for:

the identification and recording of all transactions undertaken by the IFM;
the explanation of the changes in the accounting balances from one closing date to the
next by keeping record of the movements affecting the accounting items;
the record keeping of all accounting documents in accordance with the applicable legal
provisions;
the performance of the reconciliation of accounts and accounting entries;
the assurance regarding the reliability of the financial reporting.

The entire accounting organisation and procedures must be described in an accounting procedure
manual. While defining and implementing these procedures, the IFM must ensure compliance with the principle of integrity in order to avoid in particular that the accounting system is used for fraudulent purposes.
Section 5.1.4. Clarifications on the premises in Luxembourg
The concept of central administration also implies that the IFM must have its own premises in
Luxembourg. Access to the IFM’s premises must be secure and restricted to the IFM’s staff. In the event of a change of premises, the IFM must inform beforehand the CSSF in order to obtain approval of any amendments to the articles of incorporation. The file transmitted to the CSSF must include a plan of the premises and, if the IFM does not own the premises, the lease agreement. Sub-chapter 5.2. General internal governance arrangements
In accordance with Articles 109 and 111 of the 2010 Law as well as Articles 16 and 11 of the 2013
Law, every IFM must have robust internal governance arrangements which ensure the sound and prudent management of its activities and the risks inherent therein.

Circular CSSF 18/698 Page 28/96
154. Internal governance must ensure in particular sound and prudent business management, including
the risks inherent therein. In order to achieve this objective, the IFMs must establish internal governance arrangements which are consistent with the three-lines-of-defence model.
155. The first line of defence consists of the business units that take or acquire risks under a predefined
policy and limits and carry out controls.
156. The second line consists of the permanent risk management (Section 5.3.1.) and compliance (Section
5.3.2.) functions which contribute to the independent risk control, as well as of the support functions, including the IT function (Section 5.1.2.) and accounting function (Section 5.1.3.).
157. The third line consists of the internal audit function (Section 5.3.3.) which provides an independent,
objective and critical review of the first two lines of defence.
158. The three lines of defence are complementary, each line of defence assuming its control
responsibilities regardless of the other lines.
159. These internal governance arrangements must be structured around the following areas, which have
essentially been elaborated in CSSF Regulation 10-4 and Delegated Regulation (EU) 231/2013:

organisational requirements, including the internal control mechanisms (Sub-chapter
5.3. Internal control functions);
internal reporting requirements;
personal transactions;
management of conflicts of interest;
exercise of voting rights;
rules of conduct;
remuneration policy.

In practice, the internal governance arrangements must include in particular:

a clear and consistent organisational and operational structure including decisionmaking powers, reporting and functional links and segregation of duties which are
clearly defined, transparent, consistent, complete and free from conflicts of interest;
adequate internal control mechanisms;
a formal escalation, settlement and, where appropriate, sanction procedure for the
problems, shortcomings and irregularities identified through the internal control mechanisms;
internal communication arrangements including an internal whistleblowing procedure
which enables the staff of the IFM to draw the attention of those responsible to all their significant and legitimate concerns related to the internal governance of the IFM;
business continuity management arrangements aimed to limit the risks of serious
disruption of business activities and to maintain the key operations as defined by the management body/governing body upon proposal of the senior management. These arrangements must include a business continuity plan which describes the actions to be put in place in order to continue to operate in case of an incident or disaster;
crisis management arrangements which ensure appropriate responsiveness in case of
crisis, including a business recovery plan.

Every IFM promotes an internal control and risk culture which aims to ensure that all members of
staff actively take part in the detection, reporting and control of risks incurred by the IFM. Sub-chapter 5.3. Internal control functions
In accordance with CSSF Regulation 10-4 and Delegated Regulation (EU) 231/2013, every IFM
must establish and maintain operational a permanent compliance, risk management and internal audit function.

Circular CSSF 18/698 Page 29/96
163. The policies implemented with respect to risk management, compliance and audit must provide for
three distinct internal control functions: on the one hand, the risk control function and compliance function which are part of the second line of defence and on the other hand, the internal audit function which is part of the third line of defence. These policies which describe the fields of intervention directly related to each internal control function must clearly define the responsibilities for the common fields of intervention and the objectives as well as the independence, objectivity and permanence of the internal control functions.
164. Each internal control function must be under the responsibility of a separate function manager who
is appointed and revoked in accordance with an internal written procedure. The appointments and revocations of the persons responsible for the internal control functions must be approved by the management body/governing body and communicated to the CSSF in writing, in accordance with the provisions laid down in Sub-section 5.3.1.3. for the risk management function, Sub-section
5.3.2.4. for the compliance function and Sub-section 5.3.3.4. for the internal audit function.
165. The persons responsible for the three internal control functions are accountable to the senior
management and ultimately to the management body/governing body for the performance of their mandate. In this respect, these persons must be able to contact and inform, directly and on their own initiative, the management body/governing body or, where appropriate, the members of the audit committee as well as the CSSF.
166. The main purpose of the internal control functions is to verify compliance with all the internal
policies and procedures which fall under their competence, to regularly assess their suitability as regards the IFM’s organisational and operational structure, strategies, activities and risks and as regards the applicable legal and regulatory requirements and to report it directly to the senior management and to the management body/governing body. They must provide the senior management and the management body/governing body with the opinions and advice they deem necessary in order to improve the arrangements regarding the central administration and the internal governance of the IFM.
167. The persons responsible for the internal control functions must respond as soon as possible to the
requests for opinions and advice from the senior management and the management body/governing body of the IFM or, where appropriate, the IFM’s specialised committees. If they consider that effective, sound or prudent business management is compromised, the persons responsible for the internal control functions must promptly inform, on their own initiative, the senior management and the management body/governing body in accordance with the applicable internal procedures.
168. The internal control functions must also cover the activity of branches, representative offices,
agencies and subsidiaries owned by an IFM.
169. It should be noted that the compliance and the internal audit functions cannot be performed by the
same natural person. Similarly, where the performance of the permanent compliance or internal audit function is delegated in compliance with the conditions referred to in the respective sections below (5.3.2. and 5.3.3.), the monitoring of these functions cannot be entrusted to the same natural person.
170. Moreover, the persons responsible for the internal control function must submit annual reports to the
CSSF in accordance with point 212 (for the risk management function), Sub-section 5.3.2.6. (for the compliance function) and Sub-section 5.3.3.7. (for the internal audit function) below. Characteristics of the internal control functions
171. The internal control functions must be permanent and independent functions each with sufficient
authority. The persons responsible for these functions must have the right to directly contact the IFM’s management body/governing body and réviseur d'entreprises agréé (approved statutory auditor) as well as the CSSF.
172. The independence of the internal control functions is incompatible with the situation in which:

Circular CSSF 18/698 Page 30/96

the staff of the internal control functions are in charge of tasks they are called upon to
control;
the internal control functions are, from an organisational point of view, included in the
business units they control or report to; and
the remuneration of the staff of the internal control functions is linked to the
performance of the activities they control or is determined according to other criteria which compromise the objectivity of the work carried out by the internal control functions.

The authority, which the internal control functions must have, requires that these functions should be
able to exercise their duties, on their own initiative, express themselves freely and access all external and internal data and information (in all business units of the IFM they control) deemed necessary to fulfil their missions.
The staff of the internal control functions or third parties acting on behalf of these functions must be
objective in carrying out their work.
In order to ensure objectivity, the persons in charge of the internal control functions must exercise
independent thinking and judgement necessary for the proper exercise of their duties.
The allocation of responsibilities and functions within the IFM must be organised so as to avoid or
at least mitigate conflicts of interest. Where the IFM is part of a group, the existence of reporting lines from the IFM to the functions or persons of the group cannot jeopardise the independence of the internal control functions.
In order to ensure the effectiveness of the internal control functions, the members of each internal
control function must individually and collectively possess high professional skills in the field of IFM activities and applicable standards. These skills must be assessed by taking into account both the nature of the missions of the associates and the complexity and diversity of the activities carried out by the IFM in order to enable full coverage of the activities and risks. These individual skills must include the ability to make critical judgements and to be heard by the conducting officers of the IFM as well as by the management body/governing body.
The persons responsible for the internal control functions must keep the acquired knowledge up to
date and ensure ongoing and up-to-date training for each of the associates.
In addition to their high professional experience, the persons responsible for the internal control
functions, who take on such a position for the first time, must have the theoretical knowledge that enables them to efficiently perform this function.
In order to guarantee the execution of the tasks assigned to them, the internal control functions must
have necessary and sufficient human resources, infrastructure and budgets, pursuant to the principle of proportionality. The budget must be sufficiently flexible to reflect an adaptation of the missions of the control functions in response to changes of the IFM’s risk profile. These arrangements must be compatible with the use of external experts for the internal control functions in accordance with the provisions set out in Sub-sections 5.3.1.6., 5.3.2.5. and 5.3.3.5. of this circular.
The internal control framework must cover the whole IFM within the limits of its respective
competences.
Every IFM must take the necessary measures to ensure that the members of the internal control
functions perform their functions with integrity and discretion.
The persons responsible for the internal control functions must document the work carried out in
accordance with the assigned responsibilities, in particular in order to allow tracking the interventions as well as the conclusions reached.

Circular CSSF 18/698 Page 31/96
184. In case of serious problems, shortcomings and irregularities, the persons responsible for the internal
control functions must inform forthwith the senior management and the management body/governing body thereof.
185. The persons responsible for the internal control functions must verify the effective follow-up of the
recommendations relating to the identified problems, shortcomings and irregularities. They must report regularly on this subject to the senior management and management body/governing body of the IFM.
Section 5.3.1. Permanent risk management function
Sub-section 5.3.1.1. Obligations of IFMs regarding risk management
186. Articles 42(1) of the 2010 Law and 14 of the 2013 Law introduce, in particular, the obligation for an
IFM to use a method and systems for risk management allowing it to identify, measure and control the risks of UCI positions.
187. The permanent risk management function and the risk management policy are central elements
thereof.
Sub-section 5.3.1.2. Permanent risk management function
188. In accordance with Articles 13 of CSSF Regulation 10-4 and 39 of Delegated Regulation (EU)
231/2013, an IFM must, among others, establish and maintain a permanent risk management function.
189. The permanent risk management function must be hierarchically and functionally independent from
the business units in accordance with Article 13(2) of CSSF Regulation 10-4 and Article 14(1) of the 2013 Law as specified in point 533 of this circular.
190. The functional and hierarchical separation of the functions of risk management is reviewed by the
CSSF in accordance with the principle of proportionality, on the understanding that the IFM must, in any event, be able to demonstrate that specific safeguards against conflicts of interest allow for the independent exercise of risk management activities and that the risk management process satisfies the requirements of Articles 42 of the 2010 Law and 14 of the 2013 Law and is consistently effective.
191. The risk management function must:

implement the risk management policy and procedures;
ensure compliance of the risk limit system of managed UCIs, including statutory limits
concerning global exposure and counterparty risk in accordance with Articles 46, 47 and 48 of CSSF Regulation 10-4 for UCITS and, as far as AIFs are concerned, the limits set in accordance with Article 44 of Delegated Regulation (EU) 231/2013;
participate in the identification, development and monitoring of the risk profile of UCIs
in accordance with Articles 13 of CSSF Regulation 10-4 and 39 of Delegated Regulation (EU) 231/2013;
provide regular reports to the management body/governing body of the IFM and, where
it exists, the supervisory function, on the elements referred to in Article 13(3)(d) of CSSF Regulation 10-4 and Article 39(1)(d) of Delegated Regulation (EU) 231/2013;
provide regular reports to the senior management of the IFM outlining the current level
of risk incurred by each managed UCI and any actual or foreseeable breaches to the set limits, so as to ensure that prompt and appropriate action can be taken;
assess and, where appropriate, contribute to the effectiveness of asset valuation systems
and procedures in accordance with Articles 13 and 49 of CSSF Regulation 10-4 and 70 of Delegated Regulation (EU) 231/2013.

The main mission of the permanent risk management function is therefore to identify, measure and
manage the risks of UCIs and to report to the management body/governing body and to the senior

Circular CSSF 18/698 Page 32/96 management of the IFM. These written reports must include analyses which allow the addressees to verify the consistency between:

the risk levels and the risk profile of each UCI;
the risk levels and the limits set for each UCI;
the risk profile and the limits set for each UCI;
and to ensure that no new risk arises.

The reports must also include the measures to address identified deficiencies and to report on the
effectiveness of the measures taken to this end.
The risk profile developed for each UCI plays a central role in the mission of the permanent risk
management function. Its documentation and that of the analysis of the consistency with the set limits and identified risk levels must be immediately available upon the CSSF’s request.
In general, all interventions of the permanent risk management function must be documented.
The permanent risk management function must have sufficient human and technical resources and
the necessary expertise to discharge its functions. In addition, it must have the necessary authority and access to all the relevant information which is necessary to fulfil its functions. In particular, communication channels must be put in place between the permanent risk management function and the portfolio management function. Where appropriate, the permanent risk management function may participate or be represented in internal committees concerning, in particular, the risk management, the assessment and the management of UCIs. Sub-section 5.3.1.3. Person responsible for the permanent risk management function
Every IFM must, in principle, designate a person among its staff who is responsible for the permanent
risk management function and who possesses the necessary skills, knowledge and expertise in the area. This person must perform his/her function under the direct responsibility of the conducting officer in charge of the risk management function.
The IFM must communicate beforehand to the CSSF the name of the person responsible for the
permanent risk management function supplemented by the following pieces of information and any other document which might be subsequently indicated by the CSSF:

a recent curriculum vitae, signed and dated;
a copy of the passport/identity card;
a declaration of honour, as may be downloaded on the CSSF website (www.cssf.lu);
and
a recent extract of the criminal record, if available, or any other equivalent document.

In the event of a change of the person responsible for the permanent risk management function, the
IFM must communicate beforehand to the CSSF the name of the person succeeding him/her in office supplemented by the documents referred to in point 198.
By virtue of the principle of proportionality, one of the conducting officers of the IFM may also be
directly designated as the person responsible for the permanent risk management function provided that s/he has the necessary skills, knowledge and expertise in the area. Without prejudice to the operational model chosen, the conducting officer in charge of the permanent risk management function or directly responsible for the permanent risk management function may not, at the same time, be the conducting officer responsible for investment management, even if this function is delegated to a third party. Furthermore, the conducting officer in charge of the permanent risk management function may not be in charge of the internal audit function.
The person responsible for the permanent risk management function cannot at the same time be
responsible for the internal audit function. By contrast, it is permissible to combine the responsibilities for the compliance and the risk management functions.

Circular CSSF 18/698 Page 33/96
202. The tasks of the person responsible for the permanent risk management function cannot be exercised
directly by a member of the management body/governing body, unless s/he is part of the IFM’s senior management. Sub-section 5.3.1.4. Risk management policy
203. In accordance with Articles 43 of CSSF Regulation 10-4 and 40 of Delegated Regulation (EU)
231/2013, an IFM must establish, implement and maintain an appropriate and documented risk management policy which identifies the risks which the UCIs it manages are or might be exposed to. This policy must be implemented by the permanent risk management function.
204. The risk management policy must include all the necessary procedures to allow the IFM to assess for
each UCI it manages the exposure of the UCI to market, credit, liquidity and counterparty risks, as well as exposure of the UCI to any other risks, including operational risk, likely to be material for the UCI.
205. The risk management policy must cover at least the elements referred to in Articles 43 of CSSF
Regulation 10-4 and 40 of Delegated Regulation (EU) 231/2013. In particular, the description of the techniques, tools and arrangements allowing the IFM to measure and manage the risks as well as the allocation of responsibilities within the IFM must be detailed and complete. Moreover, Articles 45 of CSSF Regulation 10-4 and 44 and 45 of Delegated Regulation (EU) 231/2013 detail the requirements regarding the risk measurement and management and regarding the risk limits. In this context, the IFM is reminded that it must in particular:

adopt adequate and effective arrangements, processes and techniques in order to
measure and manage the risks which the UCIs it manages are or might be exposed to;
conduct, where appropriate, periodic stress tests and scenario analyses to address risks
arising from potential changes in market conditions that might adversely impact the UCIs;
set limits in accordance with the risk profiles of UCIs and control compliance with them.

The above-mentioned arrangements, processes and techniques must be proportionate to the nature,
scale and complexity of the activities of the IFM and the UCIs it manages, and in accordance with the risk profiles of the UCIs.
The risk management policy of the IFM must also include the techniques, tools and arrangements
concerning the liquidity risk management procedure which the IFM must apply, where appropriate, and which ensures that the liquidity profile of the investments of each UCI complies with the underlying obligations, in accordance with the provisions laid down in Article 45 of CSSF Regulation 10-4, Article 15 of the 2013 Law and Articles 46 to 49 of Delegated Regulation (EU) 231/2013. These provisions specify also the IFM’s obligations with respect to stress tests in the context of liquidity management.
The risk management policy must be documented and immediately available upon the CSSF’s
request.
In accordance with Articles 44 of CSSF Regulation 10-4 and 41 of Delegated Regulation (EU)
231/2013, the IFM must in particular assess, monitor and periodically (at least once a year) review:

the adequacy and effectiveness of the risk management policy and of the arrangements,
processes and techniques used in order to measure and manage risks and ensure compliance with the set limits;
the degree of compliance by the IFM with the risk management policy and with the
above-mentioned arrangements, processes and techniques;
the adequacy and effectiveness of measures taken to address any deficiencies in the
performance of the risk management process.

Where appropriate, the IFM must make the necessary changes following this review and inform the
CSSF of any significant change in its risk management policy.

Circular CSSF 18/698 Page 34/96
211. More generally, the person responsible for the permanent risk management function must report on
the adequacy and effectiveness of the risk management process to the management body/governing body and, where it exists, to the supervisory function of the IFM in accordance with Articles 13(3)(d) of CSSF Regulation 10-4 and 39(1)(d) of Delegated Regulation (EU) 231/2013. This report must indicate, in particular, the status of possible remedial measures.
212. The written report assessing the adequacy and effectiveness of the risk management to be drawn up,
in accordance with Articles 10(4) of CSSF Regulation 10-4 and 60(4) of Delegated Regulation (EU) 231/2013, by the risk management function, must be submitted to the CSSF once a year and at the latest five months following the end of the financial year of the IFM. This report may be a consolidated report covering all the UCIs managed by the IFM. Sub-section 5.3.1.5. Risk management procedure (RMP) to be communicated to the CSSF
213. Pursuant to Articles 42(1) of the 2010 Law and 22(2)(c) of the 2013 Law, the IFM must communicate
to the CSSF some information on the risk management policy aimed at identifying, measuring, managing, monitoring and reporting the risks likely to be material for the UCIs it manages. This communication must be made via an RMP as described herein.
214. As regards ManCos, for the UCITS they manage, Circular CSSF 11/512 presenting, among others,
the main regulatory changes in risk management and providing further clarifications on risk management rules, specifies in Chapter V the requirements of the CSSF regarding the communication in this context. In particular, the Annex to this circular presents a framework to be complied with for this RMP.
215. As regards AIFMs, the format of the RMP in Annex 1 of this circular must be complied with for the
managed AIFs. The general section concerns the main organisation of AIFMs. Specific complementary sections must be drawn up according to the strategies of the managed AIFs: at least one specific complementary section will be created for each type of investment strategy of the AIFs, as defined in Annex IV of Delegated Regulation (EU) 231/2013 (“Hedge Fund Strategy”, “Private Equity Strategy”, “Real Estate Strategy”, “Fund of Fund Strategy” and “Other Strategy”). If necessary, specific sections must be drawn up at a higher degree of granularity (e.g. creation of a specific complementary section for the strategy “Other Strategies/Commodity fund” and creation of a specific complementary section for the strategy “Other Strategies/Infrastructure fund). The assessment of the relevance of these specific sections is carried out by the AIFMs. However, the CSSF reserves the right to require one or more specific complementary section(s) if it deems it necessary.
216. The RMP must also comply with the following rules:

the risk management procedure must strictly follow the appropriate format;
the comments, explanations, descriptions and demonstrations provided must be brief;
all sections provided in each grid must be filled in and, where appropriate, if one of them
is not applicable (e.g. VaR-approach for the determination of the total exposure of a UCITS), its heading must nevertheless be included with the indication “not applicable” under the heading;
the procedure must be sent electronically to opc@cssf.lu;
the risk management procedure must include the responses to the requirements listed in
this annex by considering the risk management activities subject to agreement(s) with one or more third parties and by referring, where appropriate, to the procedures, systems and methods of the third parties.

Any new IFM subject to Chapter 15 of the 2010 Law or Chapter 2 of the 2013 Law must include an
RMP which has the appropriate format in the authorisation file to be submitted to the CSSF. Then, an update must be communicated to the CSSF at least once a year and within five months following the end of the financial year of the IFM. This obligation enters into force as from the financial year ending in 2018. It should be noted that, in case of an application for an extension of an AIFM’s

Circular CSSF 18/698 Page 35/96 authorisation to a new type of AIF investment strategy, as defined in Annex IV of Delegated Regulation (EU) 231/2013, an RMP adapted to this new type of strategy must be submitted to the CSSF.
218. Before launching a new UCI (including a compartment) and, where appropriate, when submitting
the authorisation file to the CSSF, the IFM must particularly ensure that the risk management policy and, thus, the RMP is adequate. If this is the case, the IFM must confirm it in writing to the CSSF at the time of the launch and, where appropriate, at the time of the submission of the file concerning this new UCI by indicating the reference of the latest submitted version of the RMP. If this is not the case (e.g. the UCI’s strategy is not covered by the risk management policy), the IFM must adapt its risk management policy, make changes in the RMP accordingly and send this document to the CSSF together with other elements of the file relating to the new UCI.
219. It should be noted that the procedure must cover at all times all the managed UCIs (including the
compartments) and that in case of significant changes in the risk management policy (e.g. change in the risk management procedures or methods), the IFM must update the RMP and inform the CSSF by readily submitting an updated version of this procedure.
220. The CSSF would like to point out that this RMP to be submitted to the CSSF is actually a distinct
part of the risk management policy described in Sub-section 5.3.1.4. Indeed, whereas the risk
management procedure described here is a synthetic communication tool vis-à-vis the CSSF allowing it, in particular, to carry out its prudential supervision with respect to risk management, the risk management policy is a documentation which is more free in form but more detailed in content and which includes, among others, processes, techniques, tools and allocations of responsibilities for the performance of risk management.
221. The CSSF also points out that pursuant to Article 50 of CSSF Regulation 10-4, a ManCo must
provide the CSSF at least once a year with a report containing information giving a true picture of the types of financial instruments used for each managed UCITS, the underlying risks, the quantitative limits and the methods chosen for assessing the risks associated with transactions in derivative instruments. This report must be submitted within five months following the end of the financial year of the IFM. Sub-section 5.3.1.6. Use of third-party experts
222. In accordance with Articles 110(1) of the 2010 Law and 26(4) of CSSF Regulation 10-4 or Articles
18 of the 2013 Law and 75 to 82 of Delegated Regulation (EU) 231/2013 respectively, the performance of some risk management tasks may be delegated to a third-party expert, provided there is a contract and the CSSF is notified beforehand.
223. Where an IFM delegates some risk management activities, the provisions of Articles 110(1) of the
2010 Law, 26(4) of CSSF Regulation 10-4, 18 of the 2013 Law and 75 to 82 of Delegated Regulation (EU) 231/2013 must apply. The IFM must also comply with the provisions referred to in Sub-chapter
6.2. Delegation framework of this circular.
224. The contract and the name of the mandated third party(ies) together with a description of the expertise
and internal organisation of this(these) third party(ies) must be communicated to the CSSF. The fact that the IFM has delegated part of the risk management to a specialised third party does not affect the IFM's responsibility for the adequacy and effectiveness of the risk management policy and its responsibility to ensure adequate monitoring of the risks of the UCI.
225. The ongoing monitoring of the specialised third parties in charge of risk management must cover in
particular the exposure of the UCI to market, liquidity, counterparty and concentration risks as well as to all other risks, including operational risk, which may be significant for the UCI.

Circular CSSF 18/698 Page 36/96
Section 5.3.2. Permanent compliance function
Sub-section 5.3.2.1. General principles
226. An IFM must have its own compliance function in Luxembourg which is organised in accordance
with the provisions referred to in Articles 11 of CSSF Regulation 10-4 and 61 of Delegated Regulation (EU) 231/2013 as well as with the provisions of this sub-chapter.
227. The aim of the compliance function is to anticipate, identify and assess the compliance risks of an
IFM as well as to assist the senior management in controlling these risks. These risks may include a variety of risks such as reputational risk, legal risk, litigation risk, risk of sanctions, as well as some operational risk aspects, in connection with all activities of the IFM, including the activities and services referred to in Article 101(3) of the 2010 Law and/or Article 5(4) of the 2013 Law. This task must be carried out on an ongoing basis and without delay.
228. The compliance function must be able to operate independently and must comply with the principle
of segregation of duties in order to identify any risk of non-compliance of the IFM with the requirements imposed by the 2010 Law, 2013 Law, CSSF Regulation 10-4, Delegated Regulation (EU) 231/2013 and all other regulations applicable to the IFM. Sub-section 5.3.2.2. Operational arrangements and compliance charter
229. The operational arrangements of the compliance function in terms of objectives, responsibilities and
powers must be laid down in a compliance charter drawn up by the compliance function and approved by the senior management and ultimately by the management body/governing body.
230. The compliance charter must at least:

define the position of the compliance function in the organisation chart of the IFM and
specify at the same time its key characteristics (independence, objectivity, integrity, competences, authority and adequacy of the resources);
recognise the compliance function's right to take the initiative to open inquiries on all
activities of the IFM including those of its branches and subsidiaries in Luxembourg and abroad and to access all documents, evidence, minutes of the consultative and decision-making bodies of the IFM, to meet all persons working in the IFM, to the extent required to fulfil its mission;
define the responsibilities and reporting lines of the Compliance Officer;
describe the relationships with the permanent risk management and internal audit
functions as well as possible delegation and/or coordination needs;
establish the conditions and circumstances applicable where external experts are used;
establish the right for the Compliance Officer to directly and on his/her own initiative
contact the management body/governing body of the IFM or, where appropriate, the members of the audit committee or the compliance committee as well as the CSSF.

The content of the compliance charter is brought to the attention of all staff members of the IFM,
including those who work in branches abroad or in Luxembourg and in subsidiaries abroad or in Luxembourg.
The compliance charter must be updated as soon as possible in order to take into account the changes
in the applicable standards affecting the IFM. All changes must be approved by the senior management, confirmed by the audit committee or, where appropriate, the compliance committee and ultimately approved by the management body/governing body. They must be brought to the attention of all staff members. Sub-section 5.3.2.3. Specific responsibilities and scope of the compliance function
For the purpose of reaching the objectives set, the responsibilities of the compliance function must
cover at least the following aspects:

Circular CSSF 18/698 Page 37/96

identification of the standards to which the IFM is subject in the exercise of its activities
and record keeping of the main rules. This record must be accessible to the relevant staff of the IFM;
identification of the compliance risks to which the IFM is exposed in the exercise of its
activities and assessment of their significance and possible consequences. The classification of the identified compliance risks must allow the compliance function to establish its control plan according to the risk, thus enabling an effective use of the resources of the compliance function;
guarantee that the compliance risk is identified and assessed before the IFM expands
into new activities, products or business relationships, as well as when developing the transactions and network of the group at international level;
guarantee that, for the implementation of the compliance policy, the IFM has rules that
can be used as guidelines by the staff from different functions and business units in the exercise of their day-to-day tasks. These rules must be properly reflected in the instructions, procedures and internal controls in areas directly related to compliance. In drawing up these rules, the compliance function must take into account, as far as necessary for the IFM in question, the ethical rules laid down in the internal governance arrangements. The compliance policy may be included in the manual of procedures referred to in Section 5.5.4. of this circular;
the areas generally related to the compliance function are the fight against money
laundering and terrorist financing, the prevention regarding market abuse and personal transactions, the integrity of the markets in financial instruments, the protection of the clients' and investors’ interests, the data protection (unless another person is appointed as Data Protection Officer in accordance with the regulation in force) and compliance with confidentiality obligations, the prevention and management of conflicts of interest, the prevention of the use of the financial sector by third parties to bypass their regulatory obligations and the management of the compliance risk related to cross-border activities. In the more general context of compliance with the code of conduct, the compliance function has also to cover the areas of ethics and professional conduct or even frauds. This list is not exhaustive. In general, the compliance function must be organised so that it covers all the areas which may result in compliance risks. However, insofar as some areas, resulting in practice in compliance risks, may also be linked to other functions such as the risk control function, accounting function or legal function, and for the sake of avoiding any duplication of the compliance controls, the areas other than those referred to above may not be directly covered by the compliance function. In this case, it is understood that the compliance risk is to be covered by the other internal control functions in accordance with a compliance policy clearly defining the competences and responsibilities of the different stakeholders in this area and subject to compliance with the segregation of duties. In this case, the Compliance Officer within the IFM as referred to in Sub-sections 5.3.2.4. and 5.3.2.5. must assume the role of coordination, centralisation and verification that the other areas which do not directly fall within his/her competence are well covered.

The IFM is in charge of deciding whether, in view of the particular characteristics of the activities
performed, its compliance function includes monitoring compliance with the rules that are not directly related to activities of management of UCIs or of discretionary management, strictly speaking, such as in particular the rules under labour law, social law, company law or environmental law.
The compliance function must verify compliance with the compliance policy and procedures on a
regular basis and must propose adaptations, if required. To this end, the compliance officer must assess and control the compliance risk on a regular basis. In respect of the compliance risk controls as well as the verification of the procedures and instructions, the provisions of this circular do not prevent the compliance function from taking into account the internal audit work.

Circular CSSF 18/698 Page 38/96
236. The compliance function must centralise all information on the compliance problems (inter alia,
infringements of standards, non-compliance with procedures or conflicts of interest) identified in the IFM.
237. As long as the compliance function has not obtained this information on its own involvement, it must
examine relevant documents, whether internal (e.g. internal control reports and internal audit reports, reports or statements of the senior management or, where appropriate, of the management body/governing body) or external (e.g. reports of the external auditor, correspondence from the supervisory authority).
238. The Compliance Officer must assist and advise the senior management on issues of compliance and
standards, notably by drawing its attention to changes in standards which may subsequently have an impact on the compliance area.
239. The compliance function must raise awareness of the staff about the significance of compliance and
related aspects and assist them in the daily activities relating to compliance. To this end, it must also develop an ongoing training programme and ensure its implementation. Sub-section 5.3.2.4. Person responsible for the permanent compliance function
240. Every IFM must, pursuant to Article 11(3)(b) of CSSF Regulation 10-4 or Article 61(3)(b) of
Delegated Regulation (EU) 231/2013, appoint a person responsible for compliance, the Compliance Officer, who has the necessary skills, knowledge and expertise in the area. The IFM must communicate beforehand to the CSSF the name of its Compliance Officer supplemented by the following pieces of information and any other document which might be subsequently indicated by the CSSF:

a recent curriculum vitae, signed and dated;
a copy of the passport/identity card;
a declaration of honour, as may be downloaded on the CSSF website (www.cssf.lu);
and
a recent extract of the criminal record, if available, or any other equivalent document.

This person is, in principle, employed full-time by the IFM.
In the event of a change of the Compliance Officer, the IFM must communicate beforehand to the
CSSF the name of the person succeeding him/her in office supplemented by the documents referred to in point 240 above.
Where, pursuant to the principle of proportionality, the creation of a full-time position for a
Compliance Officer is not necessary, a person may be entrusted with this position on a part-time basis after prior approval by the CSSF. To this end, the senior management and the management body/governing body must submit to the CSSF a written request providing the grounds as well as the necessary information to enable to assess that the correct application of the provisions of this circular and the proper performance of the compliance function remain assured.
The Compliance Officer of the IFM is, in principle, the key contact person of the competent
authorities in relation to the fight against money laundering and terrorist financing for any questions in this respect as well as in relation to market abuse. S/he is also in charge of the transmission of any information or statement to these authorities.
The other tasks carried out by this employee must remain consistent with the responsibilities
incumbent upon him/her pursuant to the provisions of this circular. In principle, it is possible for the Compliance Officer to provide legal services to the IFM.
It is also possible that, upon specific approval by the CSSF, the conducting officer in charge of the
compliance function takes up the position of Compliance Officer him/herself.
The role of the Compliance Officer cannot be ensured by a member of the management
body/governing body of the IFM unless s/he is member of the IFM’s senior management.

Circular CSSF 18/698 Page 39/96
Sub-section 5.3.2.5. Use of third-party experts or technical means
248. An IFM whose authorisation is limited to the management of UCIs may invoke, via a specific prior
derogation request based on an adequate justification, the possibility of delegating the performance of the compliance function to a third party in accordance with Article 10(2)(c) of CSSF Regulation 10-4 and Article 6(2)(d) of Delegated Regulation (EU) 231/2013.
249. However, an IFM providing, in addition to management of UCIs, one or more of the services referred
to in Article 101(3) of the 2010 Law or Article 5(4) of the 2013 Law is not in principle authorised to delegate the performance of the compliance function.
250. In general, the IFM which has one or more branches is not allowed to delegate the performance of
the compliance function. However, the CSSF may derogate based on an adequate justification from this above-mentioned general principle provided that the importance of the activity and the size of the branch(es) so justify.
251. Pursuant to the principle of proportionality, the IFM may thus, upon duly justified derogation,
delegate the performance of the compliance function either by using third-party experts or technical means (external expert) or by establishing, where appropriate, a functional link with the group’s compliance function for the performance of compliance tasks.
252. The senior management must select these third parties on the basis of an analysis of suitability
between the IFM's needs and the specific services and competences offered by these third parties. The choice of the external expert carrying out the compliance work must be approved by the management body/governing body. The use of an external expert must be based on a written mandate. The expert must carry out the work in compliance with the applicable regulatory and internal provisions (notably the compliance charter). The external expert must carry out its work in accordance with the provisions of this sub-chapter. In this respect, it must take over all duties and responsibilities incumbent upon the compliance under this circular.
253. The IFM which decides to delegate the performance of the compliance function must submit
beforehand a written request to the CSSF. This request must include the information necessary for the assessment, including in particular:

the name of the external expert, legal person;
the description of the competences and internal organisation of this external expert, legal
person;
the name of the external expert, natural person, who will perform the IFM’s compliance
function;
the curriculum vitae of the natural person who will perform the compliance function;
a copy of the identity card of the natural person who will perform the compliance
function.

The principle of proportionality does not allow an IFM to exist without a compliance function. Thus,
the IFM which uses third-party experts or technical means must designate from among its employees a Compliance Officer who will monitor the work of the external expert. This person must have sufficient knowledge of the Luxembourg regulations concerning the activity of management of UCIs and, where appropriate, the discretionary management. The identity of this person must be notified beforehand to the CSSF. This notification must be accompanied by the following pieces of information and any other document which the CSSF may request subsequently:

a recent curriculum vitae, signed and dated;
a copy of the passport/identity card;
a declaration of honour, as may be downloaded on the CSSF website (www.cssf.lu);
and
a recent extract of the criminal record, if available, or any other equivalent document.

Circular CSSF 18/698 Page 40/96
255. In the event of a change of the Compliance Officer referred to in point 254, the IFM must
communicate beforehand to the CSSF the name of the person succeeding him/her in office supplemented by the documents referred to in point 254. Sub-section 5.3.2.6. Obligations regarding the drawing-up of reports
256. The Compliance Officer must report in writing on a regular basis, and, where necessary, on an ad
hoc basis, to the senior management and, where appropriate, to the specialised committees and management body/governing body of the IFM. These reports concern the follow-up of the recommendations, problems, shortcomings and irregularities identified in the past as well as the new problems, shortcomings and irregularities identified. Each report must specify the risks related thereto as well as their seriousness (measuring the impact) and must propose corrective measures, as well as, in general, the position of the persons concerned.
257. The Compliance Officer must prepare, at least once a year, a summary report on his/her activities
and his/her operation. As far as the operation of the compliance function is concerned, the report must mention in particular the nature and level of reliance on external experts pursuant to Sub-section
5.3.2.5. as well as any problems which may have occurred in this context. This report must be
submitted for approval to the management body/governing body and, where appropriate, the specialised committees and for information purposes to the senior management.
258. The summary report of the compliance function must be provided to the CSSF annually. The CSSF
must receive this document within five months following the end of the financial year of the IFM.
259. It is recommended that the summary report of an IFM’s compliance function covers at least the
following information:

the description and assessment of the organisation of the permanent compliance
function, including the human and technical resources, the hierarchical and functional lines and, where appropriate, the description of the nature and level of reliance on external experts as well as the assessment of possible problems which appeared in this context;
the description of the main objectives and work carried out by the compliance function
during the financial year, including in particular the implementation and development of new procedures, the regulatory monitoring and analyses of legal and regulatory texts;
the description of the compliance monitoring plan adopted using a risk-based approach
which includes the monitored activities, the risk assessed for each activity and the timetable set for carrying out the monitoring provided for in the compliance monitoring plan following a multi-year programme;
the list of the main recommendations made to the senior management of the IFM, the
(existing or emerging) problems, the significant shortcomings and irregularities which have occurred since the last report, the measures taken with regard to these shortcomings and irregularities as well as the list of significant problems, shortcomings and irregularities identified in the last report but which have not yet been subject to appropriate corrective measures, particularly as regards AML/CFT, the monitoring of delegates in accordance with the provisions referred to in Chapter 6 of this circular and the monitoring of the compliance of the activities carried out within the branches and subsidiaries, where appropriate.

In the summary report, the Compliance Officer must take into account any other information deemed
relevant, for instance in the following areas (non-exhaustive list):

governance of the IFM;
compliance with the legal and regulatory requirements with respect to own funds and
their use;
management of conflicts of interest;
net asset value errors;

Circular CSSF 18/698 Page 41/96

non-compliance with the investment policy and restrictions;
personal transactions;
best execution;
handling of third-party claims and complaints;
handling of reports of infringements of the regulatory framework (whistleblowing);
non-compliance with the applicable reporting deadlines;
fraud and cyber attacks
update of the manual of procedures referred to in Section 5.5.4.;
approval of new business relationships and new products;
update of contracts;
follow-up carried out following interactions with the supervisory authorities (on-site
inspections, meetings, written correspondence, telephone conversations, etc.);
reporting to the management body/governing body;
staff training;
changes in the compliance policy and compliance charter.
Section 5.3.3. Permanent internal audit function
Sub-section 5.3.3.1. General principles

An IFM must have its own internal audit function in Luxembourg which must be organised in
accordance with the provisions referred to in Articles 12 of CSSF Regulation 10-4 and 62 of Delegated Regulation (EU) 231/2013 as well as with the provisions of this sub-chapter.
The internal audit function constitutes within the organisation of the IFM an independent and
permanent function of critical assessment of the adequacy and effectiveness of the central administration, internal governance and business and risk management as a whole in order to assist the management body/governing body and senior management of the IFM and to enable them to have the best control over their activities and the risks related thereto and thus to protect its organisation and reputation.
The internal audit function must be able to operate independently and must comply with the principle
of segregation of duties in order to identify any risk of non-compliance of the IFM with the requirements imposed by the 2010 Law, 2013 Law, CSSF Regulation 10-4, Delegated Regulation (EU) 231/2013 and all other regulations applicable to the IFM. Sub-section 5.3.3.2. Operational arrangements and internal audit charter
The operational arrangements of the internal audit function in terms of objectives, responsibilities
and powers must be laid down in an internal audit charter drawn up by the internal audit function and approved by the senior management, confirmed, where approrpiate, by the audit committee and ultimately approved by the management body/governing body of the IFM.
The internal audit charter must at least:

define the position of the internal audit function in the organisation chart of the IFM and
specify at the same time its key characteristics (independence, objectivity, integrity, competences, authority and adequacy of the resources);
confer on the internal audit function the right of initiative and authorise it to review all
the activities and functions of the IFM including those of its branches abroad and in Luxembourg and subsidiaries abroad and in Luxembourg, to access all documents, evidence, minutes of the consultative and decision-making bodies of the IFM, to meet all persons working in the IFM, to the extent required to fulfil its mission;
lay down the hierarchical and functional lines of communication for the conclusions
drawn from the audit engagements;
define the relationships with the compliance and risk management functions;

Circular CSSF 18/698 Page 42/96

establish the conditions and circumstances applicable where third-party experts are
used;
define the nature of the work and conditions under which the internal audit function may
provide internal consulting services or perform other special engagements, define the responsibilities and reporting lines of the person responsible for the internal audit function;
establish the right for the person responsible for the internal audit to directly and on
his/her own initiative contact the management body/governing body or, where appropriate, the members of the audit committee as well as the CSSF;
specify that the internal audit engagements are performed in accordance with the
recognised professional standards;
specify the procedures to be observed in respect of coordination and cooperation with
the réviseur d'entreprises agréé (approved statutory auditor).

The content of the internal audit charter is brought to the attention of all staff members of the IFM,
including, where appropriate, those who work in branches in Luxembourg or abroad and in subsidiaries in Luxembourg or abroad.
The internal audit charter must be updated as soon as possible to take into account the changes that
have occurred. All changes must be approved by the senior management, confirmed, where appropriate, by the audit committee and ultimately approved by the management body/governing body. They must be brought to the attention of all staff members.
The internal audit function of the IFM must employ sufficient staff and have sufficient overall
expertise to cover all the IFM’s activities. The person responsible for the internal audit function must have sufficient knowledge of audit techniques.
In order not to challenge their independence of judgement, the internal auditors cannot be in charge
of the preparation or implementation of elements of the central administration and internal governance arrangements. This principle does not prevent them from taking part in the implementation of sound internal control mechanisms through opinions and recommendations which they provide in this respect. Sub-section 5.3.3.3. Specific responsibilities and scope of the internal audit function
In general, the internal audit function must review and assess whether the IFM’s central
administration and internal governance arrangements are adequate and operate effectively. In this respect, the internal audit function must assess, among others:

the monitoring of compliance with the laws and regulations and the prudential
requirements imposed by the CSSF;
the effectiveness and efficiency of the internal control;
the adequacy of the IFM’s organisation, including, in particular, the monitoring of
delegates as well as the implementation of the procedure for the approval of new business relationships and new products;
the adequacy of the accounting and IT function;
the adequacy of the segregation of duties and of the exercise of activities;
the accurate and complete registration of the transactions and the compilation of
accurate, comprehensive, relevant and understandable financial and prudential information which is available without delay to the management body/governing body, to specialised committees, where appropriate, and to the senior management and the CSSF;
the implementation of the decisions taken by the senior management and by the persons
acting by delegation and under their responsibility;
the compliance with the procedures governing capital adequacy as specified in Chapter
3 (Own funds) of this circular;

Circular CSSF 18/698 Page 43/96

the operation and effectiveness of the compliance and risk management functions.

The internal audit must be independent from the other internal control functions which it audits.
Consequently, the risk management function or the compliance function cannot be performed by the person responsible for the internal audit function of the IFM. However, these functions may take into account the internal audit work as regards the verification of the correct application of the standards in force to the exercise of the activities by the IFM.
The internal auditor must ensure that the department applies the international standards of the
Institute of Internal Auditors or equivalent international standards.
The multi-year internal audit plan must be provided to the CSSF upon request.
Sub-section 5.3.3.4. Person responsible for the permanent internal audit function
The IFM must communicate beforehand to the CSSF the name of the person responsible for the
internal audit function supplemented by the following pieces of information and any other document which might be subsequently indicated by the CSSF:

a recent curriculum vitae, signed and dated;
a copy of the passport/identity card;
a declaration of honour, as may be downloaded on the CSSF website (www.cssf.lu);
and
a recent extract of the criminal record, if available, or any other equivalent document.

In the event of a change of the person responsible for internal audit, the IFM must communicate
beforehand to the CSSF the name of the person succeeding him/her in office supplemented by the documents referred to in point 274 above.
The role of the person responsible for internal audit cannot be ensured by a member of the
management body/governing body of the IFM unless s/he is member of the IFM’s senior management. Sub-section 5.3.3.5. Use of third-party experts or technical means
An IFM whose authorisation is limited to the management of UCIs may invoke, via a specific prior
derogation request based on an adequate justification, the possibility of delegating the performance of the internal audit function to a third party.
However, an IFM providing one or more of the services referred to in Article 101(3) of the 2010 Law
or Article 5(4) of the 2013 Law in addition to management of UCIs is not in principle authorised to delegate the performance of the internal audit function.
In general, the IFM which has one or more branches is not allowed to delegate the internal audit
function to an external expert specialised in internal audit (external expert). However, the CSSF may derogate based on an adequate justification from this above-mentioned general principle provided that the importance of the activity and the size of the branch(es) so justify.
Pursuant to the principle of proportionality, the IFM may thus, upon duly justified derogation,
delegate the internal audit function to an external expert. The external expert may be an internal auditor of the group to which the IFM belongs. In that case, the IFM has the possibility to establish, where appropriate, a functional link with the group’s internal audit function for the performance of internal audit tasks.
The senior management must select these third parties on the basis of an analysis of suitability
between the IFM's needs and the specific services and competences offered by these third parties. The choice of the external expert carrying out the internal audit work must be approved by the management body/governing body. The use of an external expert must be based on a written mandate. The expert must carry out the work in compliance with the applicable regulatory and internal provisions (notably the internal audit charter). The external expert must carry out its work in

Circular CSSF 18/698 Page 44/96 accordance with the provisions of this sub-chapter. In this respect, it must take over all duties and responsibilities incumbent upon the internal audit under this circular.
282. The IFM which decides to delegate the performance of the internal audit function must submit
beforehand a written request to the CSSF. This request must include the information necessary for the assessment, including in particular:

the name of the external expert, legal person;
the description of the competences and internal organisation of this external expert, legal
person;
the name of the external expert, natural person, who will perform the IFM’s internal
audit function;
the curriculum vitae of the natural person in charge of the internal audit engagement;
a copy of the identity card of the natural person in charge of the internal audit
engagement.

In any event, the appointed external expert must be independent from the réviseur d’entreprises agréé
(approved statutory auditor) of the IFM or from the cabinet de révision agréé (approved audit firm) as well as from the group to which the réviseur (auditor) belongs.
The principle of proportionality does not allow an IFM to exist without an internal audit function.
Thus, the IFM which delegates the internal audit function to an external expert must designate from among its employees a person responsible for the internal audit function. This person must have sufficient knowledge in audit in order to monitor the work of the external expert or, where appropriate, to coordinate the exercise of internal audit activities with the group’s internal audit function. The identity of the person responsible for the internal audit function in charge of monitoring the work of the external expert must be notified beforehand to the CSSF. This notification must be accompanied by the following pieces of information and any other document which the CSSF may request subsequently:

a recent curriculum vitae, signed and dated;
a copy of the passport/identity card;
a declaration of honour, as may be downloaded on the CSSF website (www.cssf.lu);
and
a recent extract of the criminal record, if available, or any other equivalent document.

In the event of a change of the person responsible for the internal audit function referred to in point
284, the IFM must communicate beforehand to the CSSF the name of the person succeeding him/her in office supplemented by the documents referred to in point 284.
Irrespective of whether the performance of the internal audit function is delegated or not, one member
of the senior management must be responsible for the internal audit function. This function cannot be performed by the conducting officer assigned to the compliance function or risk management function or by the conducting officer responsible for compliance with the AML/CFT professional obligations. The internal audit function must prepare a report for the senior management as a whole. Sub-section 5.3.3.6. Performance of the internal audit function according to an internal audit plan
All internal audit engagements must be planned and executed in accordance with an internal audit
plan. The plan must be drawn up by the person responsible for the internal audit function for a period of several years (generally three years). Its purpose is to cover all activities and functions of the IFM, taking into account both the risks posed by an activity or function of the IFM and the effectiveness of the organisation and internal control in place for this activity or function. The plan must take into account the opinions of the management body/governing body and the senior management. The plan must cover all matters of prudential interest (including the CSSF's comments and requests) and must also reflect the developments and innovations provided for as well as the risks which may arise therefrom.

Circular CSSF 18/698 Page 45/96
288. The plan must be discussed with the senior management and submitted to the latter for approval,
confirmed, where appropriate, by the audit committee and ultimately approved by the management body/governing body. It should be reviewed on an annual basis and adapted, where appropriate, to developments and emergencies. Any adaptation is to be formally approved by the senior management and, where appropriate, the audit committee. The approval implies that the senior management provides the person responsible for the internal audit function with the means necessary to implement the internal audit plan.
289. In the summary report to the management body/governing body pursuant to point 298 below, the
person responsible for the internal audit function must indicate and explain the main changes made to the audit plan as initially approved by the management body/governing body.
290. The plan, which is adequately documented, must set out the objectives of each mission and the scope
of the tasks to be executed, give an estimate of the necessary time and human and material resources and assign an audit frequency to each activity and risk.
291. The internal audit plan must also provide for the adequate and sufficiently frequent coverage, within
a planning period of several years, of important or complex activities which represent a significant potential risk, including a reputational risk. It must focus on the risk of execution errors and the risk of fraud.
292. The person responsible for the internal audit function must regularly inform the senior management
of the implementation of the internal audit plan.
293. Each internal audit engagement must be planned, executed and documented pursuant to the
professional standards adopted by the internal audit function in its internal audit charter.
294. Where the internal audit department of the parent company of the Luxembourg IFM regularly carries
out on-site inspections of its subsidiary, it is recommended, for reasons of effectiveness, that the Luxembourg IFM coordinate, as far as possible, its internal audit plan with that of its parent company.
295. In case of use of an external expert, this expert must carry out his/her work under the internal audit
plan of the IFM by following a work programme, by producing detailed documentation on his/her work and by drafting the reports for each engagement. These reports are to be drafted in French, German or English and to be given to the person responsible for the internal audit, the senior management, where appropriate, the audit committee and the management body/governing body. Sub-section 5.3.3.7. Obligations regarding the drawing-up of reports
296. The person responsible for the internal audit function must report in writing on a regular basis, and,
where necessary, on an ad hoc basis, to the senior management and, where appropriate, to the specialised committees and management body/governing body of the IFM. These reports concern the follow-up of the recommendations, problems, shortcomings and irregularities identified in the past as well as the new problems, shortcomings and irregularities identified. Each report must specify the risks related thereto as well as their seriousness (measuring the impact) and must propose corrective measures, as well as in general the position of the persons concerned.
297. Every engagement must be subject to a written report of the internal auditor, generally for the audited
persons, the senior management and, possibly as a summary, for the management body/governing body in accordance with point 298 below. The reports must also be made available to the réviseur d'entreprises agréé (approved statutory auditor) and the CSSF. These reports must be drafted in French, German or English.
298. The person responsible for the internal audit function must prepare, at least once a year, a summary
report on his/her activities and his/her operation. As far as the operation of the internal audit function is concerned, the report must mention in particular the nature and level of reliance on external experts pursuant to Sub-section 5.3.3.5. as well as any problems which may have occurred in this context. As regards the activities, every summary report must include a statement to the senior management of the main recommendations on significant problems (existing or emerging), shortcomings and

Circular CSSF 18/698 Page 46/96 irregularities identified since the last report, the measures taken in this respect as well as the statement on the significant problems, shortcomings and irregularities identified in the last report but which have not yet been subject to appropriate corrective measures. This report must be submitted for approval to the management body/governing body and for information purposes to the senior management.
299. It is recommended that the summary report of an IFM’s internal audit function also cover, over a
period of several years (generally three years), at least the following information:

the functions included in the activity of collective portfolio management as defined in
Annex II of the 2010 Law or the functions included in Annex I of the 2013 Law,
respectively;
the discretionary management and non-core services referred to in Article 101(3)(a) of
the 2010 Law and Article 5(4) of the 2013 Law, where appropriate;
the valuation function;
the compliance and risk management functions;
the monitoring of delegated activities;
the accounting function;
the IT function;
the functioning of the senior management and management body/governing body;
the internal governance and organisation of the IFM;
the rules of conduct;
the management of conflicts of interest;
the claim and complaint handling;
the remuneration policy;
the approval of new business relationships and new products;
the branches and subsidiaries, where appropriate.

The summary report of the internal audit function must cover, on an annual basis, compliance with
the AML/CFT professional obligations in accordance with Sub-section 5.4.1.3. (Internal audit control).
The summary report referred to in point 298 must be provided to the CSSF annually. The CSSF must
receive this document within five months following the end of the financial year of the IFM. Sub-chapter 5.4. Organisation of the fight against money laundering and terrorist financing
This sub-chapter applies to every IFM and every branch of an IFM whose corporate office is located
in a Member State or a third country, as referred to in point (f) of Article 1(3a) of the AML/CFT Law.
Section 5.4.1. details the general framework and requirements for every IFM, irrespective of the
functions it performs as referred to in point 4 of this circular.
Section 5.4.2. covers the requirements applicable to IFMs. Thus, this section identifies four cases
according to the manner in which the relationship with marketing intermediaries and the function of registrar agent is organised. As regards cases (b), (c) and (d), AML/CFT obligations must apply not only to IFMs but also to the entity performing the function of registrar agent.
Section 5.4.1. Obligations applicable to every IFM referred to in this sub-chapter
Sub-section 5.4.1.1. General principles
Every IFM is subject to the laws and regulations in force regarding the fight against money
laundering and terrorist financing, including the AML/CFT Law, CSSF Regulation 12-02 and the CSSF circulars on AML/CFT. In addition, every IFM is also subject to the Law of 27 October 2010 which, among other things, implements United Nations Security Council resolutions as well as acts adopted by the European Union concerning prohibitions and restrictive measures in financial matters

Circular CSSF 18/698 Page 47/96 in respect of certain persons, entities and groups in the context of the combat against terrorist financing, as well as to Articles 33(1) and 39(1) of CSSF Regulation 12-02 on the obligation of ongoing due diligence in this context. In this respect, EU regulations directly applicable in national law or via the adoption of ministerial regulations also apply to every IFM. The IFM must be organised so as to take into account and apply the new laws and regulations on this subject as soon as they become applicable. The IFM is also urged to follow the publications of the Financial Action Task Force (FATF) on this subject, including those related to financial sanctions relating to terrorist financing and those relating to the prevention, suppression and disruption of proliferation of weapons of mass destruction and its financing. Similarly, the IFM must follow Guidances for the Securities Sector issued by the FATF.
306. When carrying out UCI management and, where appropriate, the discretionary management and noncore services referred to in Article 101(3)(a) of the 2010 Law and Article 5(4) of the 2013 Law, every
IFM must take appropriate measures to identify and assess money laundering and terrorist financing (ML/TF) risks to which it is exposed by taking into account the risk factors, including those linked to customers, countries or geographical areas, products, services and transactions or delivery channels. The IFM must take effective measures to mitigate these risks.
307. The professional obligations laid down in the AML/CFT Law and the Law of 27 October 2010 must
be implemented effectively by every IFM. Compliance with these obligations must be subject to regular monitoring and verifications at a frequency determined according to the risks to the which the IFM is exposed and at least every time the relevant obligations change.
308. Every IFM must implement due diligence measures, in particular, on clients, initiators of UCIs,
portfolio managers to whom it delegates the management and on investment advisers. The IFM must implement due diligence measures which are adapted to ML/TF risks which may arise from the UCIs it manages.
309. Pursuant to Articles 3(7) and 4(1) of the AML/CFT Law, the IFM must also apply due diligence
measures on the assets of the UCIs it manages.
310. It should be borne in mind that, in accordance with Article 3 of CSSF Regulation 12-02, the UCI, its
IFM or, where appropriate, the respective proxies of these professionals, must put in place enhanced due diligence measures on intermediaries subscribing units on behalf of clients.
311. The IFM must also comply with Circular CSSF 17/661 adopting the joint guidelines issued by the
three European Supervisory Authorities (EBA/ESMA/EIOPA) on money laundering and terrorist financing risk factors, particularly with Chapter 9 of Title III of these guidelines, as well as any circular supplementing or repealing it.
312. Where the exercise of some AML/CFT tasks is delegated to a third party, notably the transfer agent,
the IFM is not exempt from its AML/CFT responsibility.
Sub-section 5.4.1.2. Obligation to designate an AML/CFT compliance officer at senior management level and drawing-up of a summary report on AML/CFT
313. In accordance with Article 4 of the AML/CFT Law, every IFM must designate an AML/CFT
Compliance Officer at senior management level (AML/CFT compliance officer at the management level) as well as an AML/CFT Compliance Officer. As regards the designation of an AML/CFT Compliance Officer referred to in Article 4(1)(a) of the AML/CFT Law, the IFM must take into account the size and nature of its activities.
314. The persons referred to in point 313 above must have sufficient experience and knowledge of the
Luxembourg and EU legal and regulatory framework on AML/CFT. Moreover, they must allocate sufficient time for their function, be permanently located in Luxembourg and be employed by the IFM pursuant to Article 41 of CSSF Regulation 12-02. This does not however prevent these people from having their domicile in a place allowing them, in principle, to come to Luxembourg every day.

Circular CSSF 18/698 Page 48/96
315. The IFM must communicate beforehand to the CSSF the name of the persons referred to in point 313
above supplemented by the following pieces of information and any other document which might be subsequently indicated by the CSSF:

a recent curriculum vitae, signed and dated;
a copy of the passport/identity card;
a declaration of honour, as may be downloaded on the CSSF website (www.cssf.lu);
and
a recent extract of the criminal record, if available, or any other equivalent document.

In the event of a change of the persons referred to in point 313, the IFM must communicate
beforehand to the CSSF the name of the person succeeding him/her in office supplemented by the documents referred to in point 315 above.
The AML/CFT compliance officer at the management level must draw up a summary report on
compliance with AML/CFT professional obligations at least once a year. This report must be submitted for approval to the management body/governing body of the IFM. Once a year, this report covering the preceding year must be sent to the CSSF within five months following the end of the IFM’s financial year.
The report must at least cover the following:
a) the results of the identification and assessment of ML/TF risks and the measures taken to mitigate them, as well as the IFM’s ML/TF risk level tolerance; b) the results of the due diligence conducted on clients, initiators of UCIs, portfolio managers to whom it delegates the management, investment advisers, including ongoing due diligence; c) the results of the enhanced due diligence conducted on intermediaries acting on behalf of their clients in accordance with the provisions of Article 3 of CSSF Regulation 12- 02, including the ongoing due diligence; d) the results of the enhanced due diligence on persons identified as politically exposed persons (PEPs) in accordance with the provisions of Article 3-2(4)(d) of the AML/CFT Law; e) the results of the due diligence conducted on assets of UCIs, including the ongoing due diligence; f) the monitoring of the positions blocked due to AML/CFT in the registers of unit-holders of UCIs and/or intermediaries involved in the marketing of UCIs; g) the periodic review of all business relationships according to their risk level; h) in the case of delegation of tasks relating to professional obligations to third parties, the results of the monitoring carried out on the compliance of the services provided by these third parties, not only with the legal and regulatory provisions but also with the contractual provisions; where appropriate, the reasons why the IFM has chosen new third parties during the year; i) statistical history concerning the identified suspicious transactions which inform about the number of suspicious transaction cases reported to the Financial Intelligence Unit (FIU) by the IFM, as well as the total amount of funds involved; j) statistical history concerning the transactions reported in the framework of the financial sanctions relating to terrorist financing and those linked to the implementation of the United Nations Security Council resolutions and acts adopted by the European Union as referred to in point 305 as well as the amount of the funds involved; k) the number of identified breaches of AML/CFT professional obligations. If the number is zero, it must be clearly specified; l) the number of AML/CFT actions implemented, with a description of the main actions, and the deadline for their implementation, pursuant to Article 7(2) of Grand-ducal Regulation of 1 February 2010 and Article 42(5) of CSSF Regulation 12-02. If the number is zero, it must be clearly specified. The number of actions results in particular

Circular CSSF 18/698 Page 49/96 from the work of the AML/CFT Compliance Officer, the internal audit, the external réviseur (auditor) or of the CSSF’s inspections.
319. The report must be accompanied by documentation on the identification, assessment and mitigation
of ML/TF risks referred to in point 306.
Sub-section 5.4.1.3. Internal audit control
320. It should be borne in mind that the internal audit function must assess independently the policies,
monitoring and procedures, including the procedure relating to the functioning of the IFM’s approval committee referred to in point 355 below, as well as the ML/TF risk management models of the IFM and report to the senior management and to the management body/governing body of the IFM by submitting them at least once a year a summary report on the compliance with the AML/CFT obligations. The internal audit must show diligence by ensuring that its recommendations or corrective measures are effectively carried out.
Section 5.4.2. Obligations applicable to the IFM according to the manner in which the
relationship with marketing intermediaries and the function of registrar agent is organised
321. The following cases may occur, on the understanding that several identified cases may apply to one
and the same IFM, depending on the nature of the relations.
Case (a): the IFM is in a direct relationship i) with the intermediaries which ensure the marketing and act on behalf of clients and/or ii) with the direct investors and ensures itself the function of registrar agent. Case (b): the IFM is in a direct relationship i) with the intermediaries which ensure the marketing and act on behalf of clients and/or ii) with the direct investors and the registrar agent function has been delegated to one or more6 registrar agents. Case (c): the IFM is in no direct relationship i) with the intermediaries which ensure the marketing and act on behalf of clients and/or ii) with the direct investors and the registrar agent function has been delegated to one or more7 registrar agents. Case (d): the AIFM performs neither the additional marketing function of the UCIs it manages nor the registrar agent function.
322. Depending on the case which applies to the IFM, the latter is subject to the following provisions:
Provisions applicable to IFMs in case (a):
323. The IFM must implement its own due diligence measures on the intermediaries who ensure the
marketing and/or on the direct investors in accordance with the legal and regulatory provisions in force.
324. The relationships with the intermediaries which market UCIs managed by the IFM must be
formalised in a written contract in order to establish the respective responsibilities with regard to compliance with AML/CFT obligations of the intermediary and of the IFM.

6 Case of an IFM managing several UCIs, all compartments combined.
7 Case of an IFM managing several UCIs, all compartments combined.

Circular CSSF 18/698 Page 50/96
325. The IFM must submit annually a list of all the marketing intermediaries with whom it is in a direct
relationship to the CSSF. This list must be provided within five months following the end of the financial year of the IFM.
326. Moreover, the IFM must put in place the measures necessary to ensure that the intermediaries comply
with the provisions of this section as well. The due diligence measures must be adapted to the ML/TF risks which may arise from these intermediaries.
327. The IFM must also comply with the provisions referred to in Section 6.2.3. (Initial due diligence and
ongoing monitoring of the delegates) with respect to the marketing intermediaries, insofar as some issues are not covered in point 328 below.
328. Furthermore, pursuant to Article 4 of the AML/CFT Law, the IFM must establish internal policies,
controls and procedures which include, among others, arrangements for due diligence on intermediaries who ensure the marketing as laid down in Article 3 of the AML/CFT Law. These arrangements must take the form, among others, of initial and ongoing due diligence covering at least the points referred to in Article 3(2) of the AML/CFT Law and the following aspects (non-exhaustive list):
a) the types of intermediaries chosen by the IFM and the collection of information on the country of establishment of the intermediary and the applicable AML/CFT legal and regulatory framework, the supervisory authority and regime applicable to it, the ownership and control structure of the intermediary; b) the collection of sufficient information to understand fully the nature of the intermediary and to determine from publicly available information the reputation of the intermediary and the quality of supervision; c) the collection of documents required pursuant to the IFM’s AML/CFT obligations when entering into a business relationship with an intermediary (Know Your Intermediary); d) the distribution channels, the risks of which must be assessed in accordance with the factors referred to particularly in points 215 and 216 of the Joint Guidelines (EBA/ESMA/EIOPA) on ML/TF risk factors adopted by way of Circular CSSF 17/661; thus, for example, the use of unclear or complex distribution channels and the fact that the intermediary is located in a jurisdiction associated with higher ML/TF risks are high risk factors requiring the implementation of an enhanced monitoring of these intermediaries; e) the country risk to be assessed in accordance with the factors referred to particularly in point 217 of the Joint Guidelines (EBA/ESMA/EIOPA) on ML/TF risk factors adopted by way of Circular CSSF 17/661.
329. The IFM using intermediaries which ensure the marketing and act on behalf of clients as provided
for in Article 3 of CSSF Regulation 12-02 must, according to the terms of Article 28 of CSSF Regulation 12-02 to which Article 3 of the same regulation refers, carry out among others:
a) a periodic review according to the risk and, where applicable, an update of the information on which the decision to enter into a relationship was based; b) a re-examination of this relationship, where information is obtained which is likely to weaken the trust in the AML/CFT mechanism of the intermediary's country of establishment or in the effectiveness of the AML/CFT controls set by the latter; c) verifications and periodic assessments according to the risk so that the intermediary ensures at all times the compliance with the subscribed commitments, notably with respect to the communication, without delay and upon request, of relevant identification data of clients.
330. The ongoing monitoring operations of intermediaries which market and act on behalf of clients must
for example concern (non-exhaustive list):

Circular CSSF 18/698 Page 51/96 a) the monitoring of the marketing policy with the implementation of a procedure enabling the IFM to be involved in decision-making concerning new countries of registration; b) the monitoring of the existence of contracts or any other document up to date which establish the responsibilities of the intermediary and of the IFM, respectively; c) the regular screening of the lists of financial sanctions relating to terrorist financing as well as a screening of the persons, entities or groups mentioned in the United Nations Security Council resolutions and acts adopted by the European Union as referred to in point 305; d) the monitoring of the compliance of the intermediaries with their AML/CFT obligations.
331. As regards direct investors, the IFM must at least ensure the following aspects (non-exhaustive list):
a) the collection of documents required pursuant to the IFM’s AML/CFT obligations when entering into a business relationship (Know Your Customer); b) the country risk to be assessed in accordance with the factors referred to particularly in point 217 of the Joint Guidelines (EBA/ESMA/EIOPA) on ML/TF risk factors adopted by way of Circular CSSF 17/661; c) the regular screening of the lists of financial sanctions relating to terrorist financing as well as a screening of the persons, entities or groups mentioned in the United Nations Security Council resolutions and acts adopted by the European Union as referred to in point 305.
332. As regards the AML/CFT obligations of the IFM which also performs the registrar agent function,
these obligations are the same as those laid down in points 323 to 331 above, except for points 324, 325, 330(a) and (b). Provisions applicable to IFMs in case (b):
333. The IFM referred to in this case must comply with the provisions referred to in points 323 to 331
with respect to direct relationship i) with the intermediaries which ensure the marketing and act on behalf of clients and/or ii) with the direct investors.
334. In connection with the delegation of the registrar agent function, the IFM must, given its obligations
as specified in Section 5.4.1., comply with the provisions of Chapter 6 (Specific organisational provisions) among which in particular Section 6.2.2. (Obligation to conclude a contract), Section
6.2.3. (Initial due diligence and ongoing monitoring of delegates) and the relevant provisions referred
to in Sub-section 6.4.3.2. (Due diligence and ongoing monitoring). In particular, the contract between the IFM and the registrar agent provides for the latter’s obligation to make available to the IFM any information necessary for the performance by the IFM of its initial due diligence and ongoing monitoring of this registrar agent.
335. This contract between the two parties also provides for the obligation to make any information
available to each other so that each of the two parties can comply with its AML/CFT obligations. Finally, the contract must allow the IFM and registrar agent to determine their respective responsibilities with regard to AML/CFT obligations, including the provisions referred to in points 323 to 331 of this circular. Provisions applicable to IFMs in case (c):
336. In connection with the delegation of the registrar agent function, the IFM must comply with the
provisions of Chapter 6 (Specific organisational provisions) among which in particular Section 6.2.2. (Obligation to conclude a contract), Section 6.2.3. (Initial due diligence and ongoing monitoring of delegates) and the relevant provisions referred to in Sub-section 6.4.3.2. (Due diligence and ongoing monitoring), in view of its obligations as specified in Section 5.4.1. In particular, the contract between the IFM and the registrar agent provides for the latter’s obligation to make available to the IFM any information necessary for the performance by the IFM of its initial due diligence and ongoing monitoring of this registrar agent.

Circular CSSF 18/698 Page 52/96
337. This contract between the two parties also provides for the registrar agent to make available any
necessary information to the IFM so that the latter can comply with its AML/CFT obligations. Finally, the contract must allow the IFM and registrar agent to determine their respective responsibilities with regard to AML/CFT obligations, including the provisions referred to in points 323 to 331 of this circular, except for points 324, 325, 330(a) and (b). Provisions applicable to AIFMs in case (d):
338. Given its obligations as specified in Section 5.4.1. above, the AIFM which performs neither the
additional marketing function of the UCIs it manages nor the registrar agent function must implement procedures and arrangements allowing it to meet its responsibility in the context of AML/CFT.
339. In particular, the AIFM must be able to ensure that the provisions of points 323 to 331 are complied
with. To this end, the members of the board of directors or the members of any other managing body, respectively, which represent the UCI pursuant to the instruments of incorporation must make available any necessary information to the AIFM so that the latter can comply with its AML/CFT obligations. In particular, a document signed by the AIFM and the UCI must include this availability obligation. Sub-chapter 5.5. Requirements with respect to organisation and procedures
Section 5.5.1. Management Information and internal reporting system
340. According to Article 5(1)(e) of CSSF Regulation 10-4 and Article 57(1)(e) of Delegated Regulation
(EU) 231/2013, every IFM must maintain adequate and orderly records of its business and internal organisation.
341. To this end, every IFM must draw up Management Information enabling the monitoring of its
activities and that of its delegates. It is important that this Management Information includes, among others, the monitoring of the activities of the IFM and its UCIs, the result of the relevant controls and analyses and the monitoring of incidents.
342. In this context, the Management Information must cover, at least:

the monitoring of the legal and corporate life;
the monitoring of the financial and accounting activity and of the level of own funds;
the monitoring of human resources;
the functions included in the collective portfolio management activity as defined in
Annex II of the 2010 Law or the functions included in Annex I of the 2013 Law,
respectively, among which the launch of new products, the monitoring of the UCI performance, the monitoring of the best execution policy and the monitoring of incidents (significant and non-significant errors of the net asset value, breaches of limits, valuation problems, problems of reconciliation, situations giving rise to conflicts of interest and other problems, marketing incidents, ML/TF incidents, etc.);
the discretionary management and non-core services referred to in Article 101(3)(a) of
the 2010 Law and Article 5(4) of the 2013 Law, where appropriate;
the results of the controls carried out on the delegated activities, including analyses of
these results carried out by the IFM;
the analyses of the risk management of the IFM and UCIs, including the monitoring of
the operational risk;
the results of the controls on the effective and proper implementation of the general
investment policy and of the strategy of the managed UCIs;
the results of the controls of the adequate transparency in the prospectus and, where
appropriate, in the UCITS-KIID and/or the PRIIPs-KID of every managed UCI in relation to the general investment policy and the strategy implemented;
the result of the work carried out by the compliance function;
the monitoring of the observations of the internal audit function;

Circular CSSF 18/698 Page 53/96

the monitoring of the IT function and related incidents (cyber attacks and other intrusion
attempts);
the monitoring of the ML/TF risk level in relation to UCIs;
the monitoring of third-party claims and complaints;
where appropriate, the monitoring of the activities carried out by the branch(es);
the monitoring of the issues raised during preceding meetings.

As the Management Information must also provide information about the controls made on the
delegated activities, every IFM must ensure that it receives all necessary information from the delegates in order to carry out an effective control of every delegate. In addition, it is important that, prior to any delegation, the IFM ensures that the delegates will be able to provide this information.
It is the responsibility of the executive committee to ensure the reliability, comprehensiveness and
adequacy of the received information in light of the nature, scale and complexity of the IFM’s activity.
The analysis of the Management Information must be presented and discussed during the meetings
of the executive committee held at least on a monthly basis in Luxembourg. At the very least, the decisions taken on this matter must be recorded in writing in the minutes of these committees’ meetings.
In order to draw up the Management Information and pursuant to Article 5(1)(d) of CSSF Regulation
10-4 and Article 57(1)(d) of Delegated Regulation (EU) 231/2013, every IFM must establish, implement and maintain effective internal reporting and communication of information at all relevant levels of the IFM and effective information flows with any third party involved.
In accordance with Article 10(4) of CSSF Regulation 10-4 and Article 60(4) of Delegated Regulation
(EU) 231/2013, the IFM must ensure that the senior management as a whole receives, frequently and at least once a year, written reports on the compliance, internal audit and risk management indicating, in particular, if appropriate corrective measures have been taken in case of deficiencies.
Pursuant to Articles 10(6) of CSSF Regulation 10-4 and 60(6) of Delegated Regulation (EU)
231/2013, the IFM must ensure that the management body/governing body or the supervisory function, if any, receives on a regular basis written reports on compliance, internal audit and risk management.
Specific provisions applicable to AIFMs: Pursuant to Article 35(2) of Delegated Regulation (EU)
231/2013, the senior management must receive on a frequent basis, and at least annually, written reports on activities in which a conflict of interest entailing a material risk of damage to the interests of one or more AIFs or its investors has arisen or, in the case of an ongoing activity, may arise.
Specific recommendation to ManCos: It is recommended that the ManCo also comply with the
provisions laid down in point 349 above.
Section 5.5.2. Business continuity
In accordance with Article 5(3) of CSSF Regulation 10-4 and Article 57(3) of Delegated Regulation
(EU) 231/2013, every IFM must establish, implement and maintain an adequate business and service continuity policy ensuring the recovery of its activities and services after a disaster and providing for regular testing of its backup facilities.
The initial due diligence and ongoing monitoring referred to in Chapter 6 (Specific organisational
provisions) must allow the IFM to ensure that the delegate(s) to which the IFM delegated one or more functions included in the activity of UCI management, comprising some risk management activities as well as IT and accounting functions, has put in place an adequate continuity plan. The above-mentioned requirement must also apply in case of partial delegation of some tasks in the function of UCI administration.

Circular CSSF 18/698 Page 54/96
Section 5.5.3. Approval of new business relationships and new products
353. This section applies to any changes in the activity of the IFM (in terms of coverage of markets and
clients, products and services).
354. Thus, every IFM must implement arrangements enabling it to identify and assess risks, including
ML/TF risks as referred to in Sub-chapter 5.4. (Organisation of the fight against money laundering and terrorist financing), in particular regulatory and operational risks related to the launch of a UCI, a compartment or a new type of assets, the creation of new business relationships (including, in particular, with a new UCI initiator or a delegate or any business relationship during the exercise of discretionary management and non-core services, where appropriate), in the event of the IFM’s intervention on new markets or in new geographical areas. To this end, the IFM must refer to Chapter 9 of Title III of the Joint Guidelines (EBA/ESMA/EIOPA) on ML/TF risk factors adopted by Circular CSSF 17/661, in particular, points 210 to 217.
355. These arrangements must be based on the implementation of adequate procedures and the use of an
approval committee within the IFM. The procedures must provide for the consultation with the risk management and compliance functions as well as escalation measures, particularly in case of disagreement between the stakeholders.
356. Where appropriate, the IFM must cooperate with the intermediary ensuring the marketing during the
implementation of the product approval process which includes the definition of the target market of end clients, the assessment of all relevant risks to such identified target market and the verification of the adequacy of the distribution strategy with the identified target market in accordance with point (1) of Article 98 of the Law of 30 May 2018 on markets in financial instruments and transposing Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU.
Section 5.5.4. Manual of procedures
357. Every IFM must, in accordance with Article 5(1)(a), (b) and (d) of CSSF Regulation 10-4 and Article
57(1)(a), (b) and (d) of Delegated Regulation (EU) 231/2013, have a precise and clear manual of procedures which describes, in particular, its internal functioning, the allocation of tasks among its staff as well as the reporting lines. The manual of procedures may include the compliance policy referred to in point 233. Where appropriate, the procedures for exchanging information with delegates and the controls carried out on them in accordance with the provisions of Chapter 6 (Specific organisational provisions) must be detailed in the manual of procedures.
358. This manual of procedures must be available at the head office of the IFM, accessible to its staff and
kept up-to-date taking into account the evolution of the IFM’s business.
359. Every new request for authorisation of an IFM must include a confirmation relating to the
establishment of such a manual.
Section 5.5.5. Claim and complaint handling
360. Every IFM must have a complaint management policy in accordance with Article 15 of CSSF
Regulation 16-07. This policy must be defined, endorsed and implemented by the senior management of the IFM. The complaint management policy must be set out in a written document and must be formalised in an internal complaint resolution procedure made available to all relevant staff. This procedure must be effective and transparent in order to handle the complaint reasonably and promptly in full compliance with the provisions of above-mentioned regulation. It must reflect the concern for objectivity and for ascertaining the truth. It must also enable the identification and mitigation of any possible conflicts of interest.
361. The name of the conducting officer responsible for the handling, centralisation and monitoring of
complaints must be communicated to the CSSF. Subject to prior notification to the CSSF and in accordance with Article 15(3) of CSSF Regulation 16-07, the person responsible at senior management level may delegate internally the complaint management.

Circular CSSF 18/698 Page 55/96
362. In accordance with Article 16(3) of CSSF Regulation 16-07 and as detailed in Section 3 of Circular
CSSF 17/671, the conducting officer responsible for complaint handling must communicate to the CSSF, on an annual basis, a table including the number of complaints registered by the professional, classified by type of complaints, as well as a summary report of the complaints and of the measures taken to handle them. In addition, the reasons for the complaints as well as the progress made in their handling must be stated. This summary report may be included in the report of the compliance function referred to in point 257.
363. Every IFM must submit this table and summary report to the CSSF within five months following the
end of the financial year of the IFM.
364. Moreover, the initial authorisation request of an IFM must comprise a description of the procedures
for handling claims and complaints implemented by the IFM.
365. A specific mandate for the handling of complaints may be given to a specialised third party
established in Luxembourg or abroad. For example, the mandate may be given to an entity of the group to which the IFM belongs.
366. The IFM must communicate a list of third parties authorised to handle complaints to the CSSF
annually. The CSSF must receive this document within five months following the end of the financial year of the IFM.
367. Specific provision applicable to ManCos: The ManCo must also comply with Article 7 of CSSF
Regulation 10-4. In particular, the information concerning this procedure for handling complaints must be made available to investors free of charge.
368. Specific recommendation to AIFMs: It is recommended that the AIFM also comply with the principle
referred to in point 367.
Section 5.5.6. Personal transactions
369. Pursuant to Articles 14 of CSSF Regulation 10-4 and 63 of Delegated Regulation (EU) 231/2013,
the IFM must have written procedures regarding personal transactions. A list of all personal transactions notified to or identified by the IFM must be available at its head office in Luxembourg.
370. In accordance with Article 14(2) of CSSF Regulation 10-4 and Article 63(2) of Delegated Regulation
(EU) 231/2013, in case of delegation of some activities of the IFM to third parties, the above procedures must allow the IFM to ensure that the entity carrying out the activity maintains a record of personal transactions entered into by any relevant person and provides that information to the IFM promptly on request.
371. At the moment of its authorisation, the IFM must confirm that a written procedure regarding personal
transactions has been put in place. This procedure may be based on the one established in this respect at the level of the group to which the IFM belongs. It must be updated regularly. The CSSF reserves the right to request a copy of this procedure at any time.
Section 5.5.7. Management of conflicts of interest
Specific provisions applicable to ManCos:
372. In accordance with Article 109(1)(b) of the 2010 Law, the ManCo must be structured and organised
in such a way as to minimise the risk that conflicts of interest between the company and its clients, between two of its clients, between one of its clients and a UCITS or between two UCITS prejudice the interests of UCITS or clients.
373. The ManCo must try to avoid conflicts of interest and when they cannot be avoided, ensure that the
UCITS it manages are fairly treated in accordance with Article 111(d) of the 2010 Law.

Circular CSSF 18/698 Page 56/96
Specific provisions applicable to AIFMs:
374. In accordance with Article 13 of the 2013 Law, the AIFM must take all reasonable steps to identify
conflicts of interest that arise in the course of managing AIFs between:
a) the AIFM, including its managers, employees or any person directly or indirectly linked to the AIFM by control and the AIF managed by the AIFM or the investors in that AIF; b) the AIF or the investors in this AIF and another AIF or the investors in that other AIF; c) the AIF or the investors in this AIF and another client of the AIFM; d) the AIF or the investors in this AIF and a UCITS managed by the AIFM or the investors in that UCITS; or e) two clients of the AIFM.
375. In accordance with Article 11(1)(d) of the 2013 Law, the AIFM must take all reasonable steps to
avoid conflicts of interest and, when they cannot be avoided, to identify, manage and monitor and, where appropriate, disclose, these conflicts of interest in order to prevent them from adversely affecting the interests of the AIFs and their investors and to ensure that the AIFs they manage are treated fairly.
376. Provision applicable to IFMs: The IFM must try to avoid conflicts of interest and, when they cannot
be avoided, ensure that the UCIs it manages are treated fairly.
Sub-section 5.5.7.1.: Conflicts of interest policy
377. In accordance with Article 20 of CSSF Regulation 10-4 and Article 31 of Delegated Regulation (EU)
231/2013, an IFM must establish, implement and maintain an effective conflicts of interest policy. This policy must be set out in writing and must be appropriate to the size and organisation of the IFM and the nature, scale and complexity of its business. This policy must include the following:

the identification of the circumstances which constitute or may give rise to a conflict of
interest entailing a material risk of damage to the interests of the UCIs whilst taking also into account the relationships with other members of the group;
the procedures to be followed and the measures to be adopted in order to manage such
conflicts of interest.

In order to minimise the potential risk of conflicts of interest, the IFM must put in place appropriate
segregation of duties and activities.
In its analysis of the risks of conflicts of interest, the IFM must in particular identify the risks arising
from the relationship with the depositary. Moreover, the IFM must take into account the risks arising from the delegation of the UCI management functions to third parties and, where appropriate, the use of a prime broker.
At the moment of its authorisation, the IFM must confirm that the written procedures regarding
conflicts of interest have been put in place. These procedures must be regularly updated so as to adapt them to the evolution of the IFM’s business. The CSSF reserves the right to request a copy of these written procedures at any moment. Sub-section 5.5.7.2.: Keeping a record of conflicts of interest
In accordance with Article 22(1) of CSSF Regulation 10-4 and Article 35 of Delegated Regulation
(EU) 231/2013, the IFM must keep and regularly update a record of the types of activities undertaken by or on behalf of the IFM in which a conflict of interest entailing a material risk of damage to the interests of one of more UCIs or its investors has arisen or, in the case of an ongoing activity, may arise. This record must be specific to the organisation and activities of the IFM. It is recommended that the record covers at least the following:

the description of the conflict of interest (whether potential or actual);
the identification of the person or units concerned by the conflict of interest;
the date on which the conflict of interest occurred or was discovered;

Circular CSSF 18/698 Page 57/96

the potential or actual impacts of the conflict of interest;
the description of the envisaged solutions and chosen measures;
where appropriate, the arrangements for informing investors.

Upon request, the IFM must submit a copy of the record to the CSSF.
Sub-section 5.5.7.3.: Obligation to inform investors
In accordance with Article 22(3) of CSSF Regulation 10-4 and Article 36 of Delegated Regulation
(EU) 231/2013, the IFM must inform investors of situations where the organisational or administrative arrangements it has made to manage conflicts of interest have not been sufficient to ensure, with reasonable certainty, that the risk of damage to the interests of the UCI or its unit-holders will be avoided. Such information must be provided in a durable medium considered as appropriate. In addition, the IFM must indicate to investors the reasons for its decision in relation to these arrangements.
Provision applicable to AIFMs: The AIFM may provide the information referred to in point 383 by
means of a website under the conditions laid down in Article 36(2) of Delegated Regulation (EU) 231/2013.
Section 5.5.8. Rules of conduct
CSSF Regulation 10-4 and Delegated Regulation (EU) 231/2013 explain the content of some rules
of conduct and operating conditions provided for in Article 111 of the 2010 Law and Article 11 of the 2013 Law respectively. Thus, the IFM must act in the best interests of the managed UCIs and of the investors in these UCIs.
Based on the details provided for in CSSF Regulation 10-4 and Delegated Regulation (EU) 231/2013,
an IFM must implement procedures, arrangements and policies ensuring, among others:

that it carries out investment decisions on behalf of the managed UCIs in compliance
with the objectives, the investment strategy and the risk limits of such UCIs in accordance with Article 26 of CSSF Regulation 10-4 and Article 18 of Delegated Regulation (EU) 231/2013;
that it takes all reasonable steps to execute itself the orders with the best possible result,
in accordance with Articles 28 of CSSF Regulation 10-4 and 27 of Delegated Regulation (EU) 231/2013 respectively, in order to ensure that the orders placed with other entities for execution are executed with the best possible result, in accordance with Articles 29 of CSSF Regulation 10-4 and 28 of Delegated Regulation (EU) 231/2013; the contracts for execution signed with third parties must take this obligation into account;
that it executes promptly, fairly and expeditiously portfolio transactions on behalf of
managed UCI(s) in accordance with Article 30(1) of CSSF Regulation 10-4 and Article 25(1) of Delegated Regulation (EU) 231/2013.

At the moment of its authorisation, the IFM must confirm that the procedures, arrangements and
policies regarding rules of conduct and other operating conditions are in place. These procedures, arrangements and policies must be regularly updated so as to adapt them to the evolution of the IFM’s business. The CSSF reserves the right to request a copy of these procedures, arrangements and policies at any time.
Section 5.5.9. Remuneration policy
In order to promote a sound and prudent risk management, every IFM must implement a
remuneration policy in compliance with Articles 111a and 111b of the 2010 Law and/or Article 12 of the 2013 Law respectively.

Circular CSSF 18/698 Page 58/96
389. The IFM subject to Chapter 15 of the 2010 Law must also comply with the guidelines of the European
Securities and Markets Authority ESMA/2016/5758 .
390. The AIFM must comply with the guidelines of the European Securities and Markets Authority
ESMA/2016/5799
.
391. The IFM which intends to take a proportionate approach to compliance with a remuneration principle
must inform the CSSF thereof and explain the reasons for it. However, this principle does not exempt an IFM from implementing a remuneration policy.
Section 5.5.10. Exercise of voting rights
392. Pursuant to Article 23 of CSSF Regulation 10-4 and Article 37 of Delegated Regulation (EU)
231/2013, the IFM must, among others, develop an adequate and effective strategy for determining when and how voting rights attached to instruments held in the managed portfolios are to be exercised, to the exclusive benefit of the UCI concerned and its investors.
393. Any UCI that has not specifically mandated the IFM to exercise the voting rights attached to the
instruments held in its portfolio, must develop its own strategy for the exercise of voting rights.
394. It is also acceptable for an IFM to refer either to the strategies developed in this regard by the group
to which it belongs or to the recognised international standards when developing its own strategy for exercising voting rights. The use of a delegate’s strategy, where appropriate, is allowed provided that the IFM ensures during its initial due diligence and ongoing monitoring as referred to in Section
6.2.3. (Initial due diligence and ongoing monitoring of delegates) that the delegate’s strategy
complies with the provisions of point 392 above.
395. A brief description of this strategy must be made available to investors free of charge, in particular
by way of a website.
396. At the moment of its authorisation, the IFM must confirm that an adequate and effective strategy has
been put in place permitting the exercise of voting rights attached to the instruments held in the portfolios in the exclusive interest of the UCIs concerned. This procedure must be regularly updated. The CSSF reserves the right to request a copy of this procedure at any time.
Section 5.5.11. Obligations of the IFM to monitor compliance with the obligations under EMIR
397. EMIR imposes obligations on any UCI qualifying as financial or non-financial counterparty
according to Article 2(8) or Article 2(9), respectively, of EMIR which takes positions in derivative contracts, particularly:

the obligation to clear OTC derivative contracts pertaining to a class of OTC derivatives
that has been declared subject to the clearing obligation for any UCI qualifying as financial or non-financial counterparty exceeding the clearing threshold in accordance with Article 4 of EMIR;
the obligation to report details of any derivative contract concluded and any
modification or termination of the contract to a trade repository in accordance with
Article 9 of EMIR;
the obligation to put in place appropriate procedures and arrangements to measure,
monitor and mitigate operational risk and counterparty credit risk for OTC derivative contracts not cleared by a CCP in accordance with Article 11 of EMIR.

When performing the UCI management function, every IFM must implement procedures and
arrangements allowing it to ensure that the UCIs it manages comply with their obligations under EMIR.

8 https://www.esma.europa.eu/sites/default/files/library/2016-575_ucits_remuneration_guidelines.pdf 9 https://www.esma.europa.eu/sites/default/files/library/2016-579_aifmd_remuneration_guidelines_0.pdf

Circular CSSF 18/698 Page 59/96
399. Moreover, since the obligations introduced by EMIR aim to limit the counterparty risk and
operational risk when the UCIs take positions in OTC derivative contracts, the risk management policy referred to in Sub-section 5.3.1.4. as well as the risk management procedure referred to in Sub-section 5.3.1.5. established by the permanent risk management function must include the procedures and arrangements necessary to comply with the obligations under EMIR.
400. The IFM must in particular have procedures and arrangements to:

ensure that OTC derivative contracts pertaining to a class of derivatives that has been
declared subject to the clearing obligation be subject to clearing for any UCI qualifying as financial or non-financial counterparty and exceeding the clearing threshold in accordance with Article 4 of EMIR;
ensure that the information on derivative contracts be declared appropriately and within
the prescribed deadlines in accordance with Article 9 of EMIR;
monitor the rolling average position over 30 working days on OTC derivative contracts
of a UCI qualifying as non-financial counterparty in relation to the clearing threshold as well as notify the CSSF when exceeding or returning below the clearing threshold in accordance with Article 10 of EMIR;
measure, monitor and mitigate operational risk and counterparty credit risk for OTC
derivative contracts not cleared by a CCP/central counterparty in accordance with
Article 11 of EMIR, particularly:
a) ensure timely confirmation of the terms of the OTC derivative contract; b) implement formalised processes which are robust, resilient and auditable in order to reconcile portfolios, to manage the associated risk and to identify disputes between parties early and resolve them, and to monitor the value of outstanding contracts; c) ensure the marking-to-market on a daily basis of the value of outstanding contracts for all UCIs qualifying as financial or non-financial counterparty and exceeding the clearing threshold. Where market conditions prevent marking-to-market, reliable and prudent marking-to-model must be used. d) ensure timely, accurate and appropriately segregated exchange of collateral with respect to OTC derivative contracts for all UCIs qualifying as financial or nonfinancial counterparty exceeding the clearing threshold.

Where the execution of one or more of these obligations is delegated, the IFM must also comply with
the provisions referred to in Chapter 6 Specific organisational provisions of this part.
Section 5.5.12. Obligations of the IFM to monitor compliance with the obligations under the
MMFR
The MMFR lays down rules applicable to all UCIs qualifying as money market funds within the
meaning of Article 1(1) of the MMFR which are established, managed or marketed in the European Union. The MMFR also imposes specific obligations on the IFM acting in its capacity as manager of UCIs qualifying as money market funds.
When performing the function of management of UCIs qualifying as money market funds, every
IFM must implement procedures and arrangements in order to comply with the MMFR pursuant to
Article 5(4)(a) of the MMFR and in order to ensure that the managed UCIs qualifying as money
market funds comply with their obligations under the MMFR in accordance with Article 7(4) of the MMFR.

Circular CSSF 18/698 Page 60/96
404. The IFM must in particular have procedures and arrangements to:

ensure compliance with the obligations regarding investment policies of money market
funds with respect to eligible assets and rules on diversification and concentration;
determine the credit quality of money market instruments, securitisations and assetbacked commercial papers (ABCPs); to this end, the IFM must establish, implement
and consistently apply prudent internal credit quality assessment procedures in accordance with Articles 19 to 21 of the MMFR;
ensure compliance with the obligations regarding risk management by the money
market funds, in particular, with respect to liquidity, credit rating of money market funds, the know-your-customer obligation as well as obligations regarding stress testing, valuation and specific requirements for different types of money market funds;
ensure compliance with the obligations regarding external support as referred to in
Article 35 of the MMFR;
ensure compliance with the obligations regarding transparency.

Moreover, the risk management policy referred to in Sub-section 5.3.1.4. and the risk management
procedure referred to in Sub-section 5.3.1.5. established by the permanent risk management function, as well as valuation procedures and policies referred to in Section 6.6.1. must include procedures and arrangements necessary to comply with the obligations under the MMFR.
Specific provision applicable to AIFMs: Every AIFM intending to manage AIFs qualifying as money
market funds must be authorised by the CSSF to manage AIFs qualifying as money market funds pursuant to Article 5 of the MMFR.
Chapter 6. Specific organisational arrangements
This chapter describes the specific organisational arrangements implemented by the IFM for the
performance of the functions included in the collective portfolio management activity as defined in
Annex II of the 2010 Law or the functions included in Annex I of the 2013 Law respectively.
In order to exercise the activities more efficiently, every IFM may be authorised to delegate to third
parties the exercise of one or more functions on its own behalf, in compliance with the provisions laid down in Article 110 of the 2010 Law for the ManCo and in compliance with the provisions laid down in Article 18 of the 2013 Law and Articles 75 to 82 of Delegated Regulation (EU) 231/2013 for the AIFM. Sub-chapter 6.1. provides details regarding the limits to the scope of the delegation.
Sub-chapter 6.2. sets out the general framework to be complied with in case of delegation of the UCI
management functions.
Sub-chapters 6.3. to 6.6. provide details regarding the specific organisational arrangements to be
implemented for each UCI management function, distinguishing between the provisions applicable when the function is performed internally or when it is delegated. Sub-chapter 6.1. Limits to the scope of delegation
Among the activities that an IFM may, in principle, delegate, the following tasks are noteworthy:

the functions included in the activity of collective portfolio management as defined in
Annex II of the 2010 Law or the functions included in Annex I of the 2013 Law
respectively, within the limits described in points 417 and 418 above;
the risk management within the limit described in Sub-section 5.3.1.6. of this circular;
the valuation function under the conditions described in Section 6.6.3. of this circular;
the handling of complaints under the conditions described in Section 5.5.5. of this
circular;

Circular CSSF 18/698 Page 61/96

the discretionary management and non-core services referred to in Article 101(3)(a) of
the 2010 Law and Article 5(4) of the 2013 Law in compliance with the provisions applicable to MiFID II Regulation.

Moreover, the IFM may be authorised to delegate the performance of the following functions and
activities:

the compliance function, within the limits described in Section 5.3.2. of this circular;
the internal audit function, within the limits described in Section 5.3.3. of this circular;
the operation of the IT system under the conditions described in Section 5.1.2. of this
circular; and
the accounting function of the IFM under the conditions described in Section 5.1.3. of
this circular.

Any delegation which is of such large scale that the IFM could no longer be considered as an IFM in
substance and that it would become a letter-box entity, must be considered as contravening the conditions which the IFM is required to meet in order to obtain and maintain its authorisation.
The concept of letter-box entity is assessed particularly in the light of the size of the teams performing
the key functions which must be appropriate given the volume of assets under management, the complexity and number of UCIs managed by the IFM. In any case, the size of the team cannot consist of less than three FTE staff members, in accordance with point 123 of this circular.
Article 82 of Delegated Regulation (EU) 231/2013 defines the concept of letter-box entity with
respect to AIFMs.
The fact that the IFM has delegated some functions to third parties does not affect the IFM’s liability.
Among the activities which cannot be delegated to third parties and which must be performed by an
IFM, the following tasks are noteworthy:

the determination of the general investment policy for all UCIs which did not adopt the
form of a company;
the determination, where appropriate together with the management body/governing
body of the UCI which adopted the form of a company, of the risk profile of each managed UCI;
the interpretation of analyses of the risk management, including any necessary
corrective measures, where appropriate;
the implementation and monitoring of a conflict of interest policy;
the implementation and monitoring of a best execution policy;
in the absence of a representative price, assurance that the management body/governing
body of the UCI has taken a decision relating to the determination of the probable realisation value estimated with care and in good faith and to give the management body/governing body of the UCI the necessary support for this kind of decision;
the decision regarding the choice of delegates to be appointed;
the monitoring and control of delegated functions.

Specific provision applicable to AIFMs: In accordance with Article 17(10) of the 2013 Law, the
AIFM must also ensure the proper valuation of the assets of the AIF as well as the calculation and publication of the net asset value of the AIF.
Specific recommendation to ManCos: It is recommended that the ManCo apply the provisions laid
down in point 418 above.
Sub-chapter 6.2. Delegation framework
Where an IFM delegates one or more functions referred to in points 411 and 412 above, including
when it delegates to entities belonging to the same group as the IFM, the provisions of this subchapter must apply.

Circular CSSF 18/698 Page 62/96
421. The provisions of this sub-chapter must also be applied when the IFM delegates one or more
functions included in the activity of collective portfolio management as defined in Annex II of the 2010 Law or the functions included in Annex I of the 2013 Law respectively, including the delegation on a cross-border basis and in case of management of a non-regulated UCI.
422. The requirements which apply when delegating the performance of functions on behalf of the IFM
must apply mutatis mutandis in case the delegate sub-delegates the functions which were delegated to it and in case of any subsequent level of sub-delegation. The conditions associated with the subdelegation are subject to the same requirements as those referred to in this sub-chapter. In practice, this means that the IFM must ensure that its delegate also complies with the provisions laid down in this sub-chapter. In addition, the IFM must inform the CSSF beforehand if the delegate carries out a partial or full sub-delegation of its activity.
423. Specific provision applicable to AIFMs: The AIFM must notably comply with the conditions
applicable to sub-delegation as defined in Article 18(4), (5) and (6) of the 2013 Law and Article 81 of Delegated Regulation (EU) 231/2013. In particular, the AIFM must give its consent prior to the sub-delegation.
Section 6.2.1. Obligation to notify the CSSF
424. In accordance with Article 110(1)(a) of the 2010 Law and Article 18(1) of the 2013 Law, the CSSF
must be notified beforehand when the IFM intends to delegate one or more of the following functions:
portfolio management, risk management, UCI administration and valuation.
425. To this end, the IFM must submit to the CSSF beforehand an update of the programme of activity
referred to in Chapter 9 of this circular, detailing the functions it intends to delegate, the identity of the entities to which the functions will be delegated and their country of establishment as well as, where appropriate, the name of the supervisory authority of these entities. The IFM must submit to the CSSF on a yearly basis a list of all its delegates of the functions referred to in point 407 and, where appropriate, the valuation function. This list must be provided within five months following the end of the financial year of the IFM.
426. The notification file must also include the IFM’s procedures for monitoring the activities of the
undertakings to which functions have been delegated. This description must contain the necessary information allowing the CSSF to verify whether the preconditions have been effectively met.
427. The CSSF reserves the right to request at any time the documentation regarding the due diligence
carried out at the time the delegate has been chosen.
428. In case of change of the delegate or when the IFM wants to perform itself one or more functions or
activities which had been previously delegated without prejudice to compliance with Articles 110(1)(f) of the 2010 Law and Article 18(f) of the 2010 Law, the IFM must seek the CSSF’s approval beforehand and submit its updated programme of activity. Specific provisions applicable to AIFMs:
429. For each EU AIF it manages and for each AIF it markets in the EU, the IFM must, among others,
make available to investors of the AIF, before it invests in this AIF in accordance with the management regulations or instruments of incorporation of the AIF, a description of all management functions referred to in Annex I of the 2013 Law delegated by the IFM and all safe-keeping functions delegated by the depositary, the identity of the delegate and any conflict of interest which might arise from these delegations.
430. In accordance with the provisions referred to in Article 76 of Delegated Regulation (EU) 231/2013,
the AIFM must communicate the objective reasons for delegation, including when the delegate belongs to the same group as the AIFM. Specific provisions applicable to ManCos:
431. The prospectuses of the UCITS list the functions which the IFM has been authorised to delegate.

Circular CSSF 18/698 Page 63/96
432. It is recommended that the ManCo include the information referred to in point 430 in the notification
to the CSSF.
Section 6.2.2. Obligation to draw up a contract
433. A written contract must be concluded between the IFM and the delegate.
434. In accordance with Article 110(1)(f) of the 2010 Law and Article 18(f) of the 2013 Law, the mandate
must not prevent the persons who conduct the business of the IFM from giving further instructions at all times to the undertaking to which functions have been delegated or from withdrawing the mandate with immediate effect when this is in the interest of investors. The drafting of the contracts must take these requirements into account and specify the terms thereof.
435. The contract must clearly set out the rights and obligations of each party.
436. The contract between the IFM and the delegate must provide a right of access for the IFM to the
documents relating to transactions carried out by the delegate as well as data on UCIs upon simple request even in electronic form. The delegate may deny the request if this request would lead the delegate to act in breach of the applicable legislation in its country of establishment.
437. Moreover, the contract must provide the right for the IFM to carry out an on-site visit at a frequency
and under the terms to be laid down in the contract, for the purposes of exercising its due diligence and ongoing monitoring activities in accordance with Section 6.2.3., particularly the AML/CFT monitoring of the registrar agent. The delegate may deny the request if this request would lead the delegate to act in breach of the applicable legislation in its country of establishment.
438. The mandate must not prevent the effectiveness of supervision of the IFM; in particular, it must not
prevent the IFM from acting, or the UCI from being managed, in the best interests of its investors.
439. To this end, the delegation must be structured so that compliance with the rules of conduct laid down
in Articles 111 of the 2010 Law and the other operating conditions referred to in Article 11 of the 2013 Law, as specified in Section 5.5.8. (Rules of conduct) above, are ensured and may be monitored at any time.
440. The IFM and the delegate must establish, implement and maintain a business continuity plan for the
recovery of the business after a disaster or any other exceptional event which provides for a regular testing of the backup facilities, whenever this appears necessary in view of the nature of the delegated task or function.
Section 6.2.3. Initial due diligence and ongoing monitoring of delegates
Sub-section 6.2.3.1. General principles
441. Any use of a delegate within the meaning of point 1(9) of this circular must be subject to a prior
written initial due diligence carried out on the third party by the IFM.
442. In accordance with Article 110(1)(f), (g) and (h) of the 2010 Law and Article 18(1)(f) of the 2013
Law, the IFM must be able to effectively monitor and control at any time the delegated task. After having received the mandate, the delegate must be subject to proper ongoing monitoring by the IFM. Sub-section 6.2.3.2. Establishment of a delegation framework procedure
443. All IFMs must define and implement a procedure which covers all aspects of delegation.
444. In particular, the procedure must describe the process of selection and change of a delegate.
445. All IFMs must implement procedures and arrangements allowing them to ensure that the delegated
activity(ies) is(are) carried out in compliance with the legal and regulatory provisions in force.
446. The procedure must include the implementing rules for initial and periodic due diligence carried out
by the IFM on all its delegates and the requirements applicable in case of sub-delegation, as described in points 422 and 423.

Circular CSSF 18/698 Page 64/96
447. The procedure must describe the measures taken which allow the persons who conduct the business
of the IFM and its operating staff to effectively monitor the business of the undertaking to which the mandate has been given on an ongoing basis, in order to ensure that the exercise and quality of the activities are monitored as if they were carried out internally. The procedure must set out reporting requirements to which the delegates are subject. The drawing-up of the contract referred to in Section
6.2.2. above must take these obligations into account.
448. In particular, the procedure must determine the nature, scope and frequency of the periodic due
diligence to be carried out on delegates taking into account a risk-based approach. When carrying out its risk assessment, the IFM must take into account not only the risks incurred by every delegate but also the number of delegates it uses.
449. The IFM must implement a multi-year plan (generally three years) for conducting periodic due
diligence on delegates. This plan must be updated taking into account the risk-based approach determined by the IFM and provided that the principle of proportionality which the IFM may rely on to increase or reduce this update frequency is applied.
450. Moreover, the procedure must describe the escalation measures and decision-making procedures
regarding delegation.
451. Under no circumstances can the monitoring of the activities delegated to a third party be delegated.
Thus, the IFM must have staff in Luxembourg which are sufficient in number and qualified to carry out a proper monitoring of the delegated activities taking into account the risks arising from the delegation(s) identified by the IFM and the number of delegates. The procedure must identify which departments or staff members of the IFM are in charge of the ongoing monitoring of delegates.
452. The IFM may take into account transversal or specific skills existing within the group to which it
belongs when implementing its control arrangements. In that case, the IFM must participate in the process of selection of delegates and of maintaining the delegation relationship. In particular, the IFM must ensure to have access to documents received during the initial due diligence and ongoing monitoring operations.
453. The procedure must describe the measures allowing the IFM to ensure the continuity of operations
in case of withdrawal of the mandate.
454. Moreover, the IFM must ensure that the data protection is guaranteed at all times.
Sub-section 6.2.3.3. Details on the initial due diligence
455. When carrying out the initial due diligence, the IFM must, among others, identify and assess all risks
arising from the delegation, in particular, the operational, financial, legal and reputational risks in order to manage them appropriately in accordance with the IFM’s risk management policy.
456. The initial due diligence must allow the IFM to ensure that the undertaking to which functions will
be delegated is qualified and capable of performing these functions, depending on the nature of the delegated functions, in compliance with the legal, regulatory and contractual obligations.
457. Moreover, the initial due diligence must allow the IFM to ensure the delegate’s ability to provide the
information necessary to fulfil its ongoing monitoring obligations. During the initial due diligence, the IFM must assess its ability to ensure the appropriate ongoing monitoring of the delegate given the identified risks and the specificities of the delegate. Thus, for example, the geographical location of the delegate cannot, in principle, impede regular on-site visits.
458. The IFM must, among others, analyse the organisational structure of the delegate. It must verify that
the delegate has taken appropriate measures to comply in particular with the requirements regarding the organisation, conflicts of interest and rules of conduct laid down in CSSF Regulation 10-4 as well as the other operating conditions referred to in Delegated Regulation (EU) 231/2013. The abovementioned requirement also applies to partial delegation of one or more functions. The IFM must also effectively monitor the compliance with these requirements by the third party.

Circular CSSF 18/698 Page 65/96
459. Besides the authorisations which may be required by applicable regulations, the entities to which
functions are delegated must prove that they have adequate human and technical resources in view of the delegated functions.
460. In their assessment of risks arising from delegation, as referred to in point 448 above, and in order to
assess the quality of the contemplated delegate, the IFM must take into account all relevant criteria including in particular the following listed information (non-exhaustive list):

the jurisdiction in which the delegate is located;
the regulation and/or supervision by a supervisory authority;
where appropriate, the nature of the authorisations received by the delegate;
where appropriate, the sanctions imposed by a supervisory authority;
the reputation of the delegate;
the delegate’s shareholding structure;
the delegate’s governance structure;
the delegate’s organisational structure;
the organisation of the control functions within the delegate (compliance, internal audit,
risk control);
the skills and abilities of the delegate;
the financial situation of the delegate by reviewing, for example, the annual accounts
and the opinion issued by the réviseur d'entreprises (statutory auditor) or an equivalent;
the absence of suspicion of money laundering and terrorist financing;
the quality of the delegate’s IT systems;
the business continuity plan and the disaster recovery plan of the delegate (BCP/DRP);
the measures implemented by the delegate to ensure data protection, in particular when
the delegate is located outside Luxembourg;
the risk of conflicts of interest between the IFM and its delegate and the management of
these risks;
the review of the claims and complaints received by the delegate;
the sub-delegation by the delegate and the delegate’s ongoing monitoring measures with
respect to its own delegates;
the ability of the delegate to provide sufficient and relevant reports and key performance
indicators for the ongoing monitoring by the IFM.

The initial due diligence includes a written critical analysis concerning at least the information listed
in point 460 above as well as any element deemed relevant given the nature of the delegated function. To this end, the IFM must ensure to apply the specific provisions referred to in Sub-chapters 6.3. to
6.6. of this circular.
All due diligence must be formalised in a written report which includes at least:

the description of the due diligence measures taken in accordance with the risk-based
approach as referred to in point 448 above such as, for example, the submission of an initial questionnaire and the analysis of this questionnaire and related documents; the analysis of all relevant reports such as, for example, the reports on the functioning of the relevant controls, audit reports, etc.; the review of the relevant policies and procedures implemented within the delegate; the meetings (on the phone or on site) with the persons responsible within the delegate, formalised in the minutes of the meeting; the controls, where appropriate, in the premises of the delegate during an on-site visit, etc.;
the description and critical analysis of the observations made;
the results of the analysis of the information and documents received during the due
diligence assessment;
where appropriate, the escalation measures taken;

Circular CSSF 18/698 Page 66/96

the conclusions reached, then validated, dated and signed by all the bodies of the IFM
empowered to approve or refuse this delegation, as defined in the procedure referred to in Sub-section 6.2.3.2. In case the delegation is approved, the conclusions must indicate in particular the frequency and nature of the subsequent periodic due diligence to be carried out. The due diligence report must be reviewed by the approval committee of the IFM referred to in Section 5.5.3. which takes the final decision.

The initial due diligence must be finalised, dated and signed before the entry into force of the contract
with the delegate referred to in Section 6.2.2. above.
The initial due diligence assessments must be documented and kept at the IFM’s head office.
The initial due diligence assessments must be made available to the CSSF upon request and sent
without delay.
Sub-section 6.2.3.4. Details on the ongoing monitoring
The ongoing monitoring of the delegates must allow the IFM to:

ensure that the services provided by the delegate are continuously in compliance, not
only with the legal and regulatory provisions but also with the contractual provisions and that the quality of the services are satisfactory;
assess over time the adequacy of the organisational structure and the procedures of the
delegate with respect to the delegated activity and determine if the delegate is qualified and able to perform these functions;
reassess regularly the risks arising from every delegation in order to appropriately
manage the risks.

This ongoing monitoring is based:

on the exercise of periodic due diligence, on the one hand;
on the implementation of a procedure for the ongoing monitoring of the delegated
activities, on the other hand.
Periodic due diligence

The periodic due diligence includes a written critical analysis of the delegate’s business and
organisation while applying a risk-based approach. To this end, the IFM reassesses the criteria analysed during the initial due diligence (point 460 above) and includes, where appropriate, any other relevant criterion.
All due diligence must be formalised in a written report dated and signed and which includes, in
addition to the information referred to in point 462 above, the following information:

the monitoring of the observations made during the previous due diligence. The due
diligence report describes the action plans and timetable for their implementation. Moreover, the report describes the escalation measures taken;
the conclusions reached, then validated, dated and signed by all the bodies of the IFM
empowered to decide to keep or end this delegation, as defined in the procedure referred to in Sub-section 6.2.3.2. as well as the conditions for maintaining this relationship. In case the decision has been made to maintain the delegation, the conclusions must indicate in particular the frequency of the subsequent periodic due diligence to be carried out.

The provisions referred to in points 464 and 465 must apply mutatis mutandis to the periodic due
diligence.

Circular CSSF 18/698 Page 67/96
Ongoing monitoring
471. The ongoing monitoring obliges the IFM to implement control arrangements which allow the
monitoring of the business of the delegates within the meaning of point 1(9) of this circular.
472. Moreover, this requirement obliges the IFM to implement control arrangements which allow the
senior management and its staff to access the data documenting the activities exercised by the delegate(s) for and on behalf of the IFM and the UCIs under its management.
473. The Management Information referred to in Section 5.5.1. must also allow the monitoring of the
delegates’ activity.
474. Thus, the conducting officers must regularly receive detailed reports on the results of the control
arrangements, including in particular key performance indicators, for all the UCIs managed by the IFM. The frequency of submission and the detail of such reports will be determined by the profile of the managed UCIs and their inherent risks. The IFM must determine and implement its own key performance indicators when the key performance indicators provided by the delegate are not sufficient to ensure an appropriate ongoing monitoring.
475. Moreover, the IFM must define and implement a methodology to analyse the results of the control
arrangements and set up its own warning systems in order to monitor its delegates according to a risk-based approach. The analysis of this information must be documented in writing and made available to the CSSF upon request.
476. In the case where the delegate uses a standard for the internal control such as for example the ISAE
3402, the IFM may take this information into account for the organisation of its monitoring of the delegate. Sub-chapter 6.3. Organisation of the portfolio management function
Section 6.3.1. Specificities related to the internal performance of the portfolio management
function
Sub-section 6.3.1.1. Implementation of a portfolio management procedure
477. In accordance with Article 26 of CSSF Regulation 10-4 and Article 18 of Delegated Regulation (EU)
231/2013, every IFM must apply a high standard of diligence in the selection and ongoing monitoring of investments of the managed UCIs. The IFM must establish, implement and apply written policies and procedures on due diligence and implement effective arrangements for ensuring that investment decisions are carried out in compliance with the objectives, the investment strategy and, where appropriate, the risk limits of the managed UCIs. In this context, every IFM must determine and implement a portfolio management procedure. This procedure must cover at least the following information:

the description of the portfolio management process for all the strategies followed by
the UCIs and for every type of contemplated instrument;
the identification of the operating staff members involved in the process as well as the
determination of their respective roles. To this end, a flow chart of the investment process must be included in the portfolio management procedure;
the arrangements for taking investment and disinvestment decisions on behalf of the
UCIs and their formalisation;
the control arrangements regarding the existence and performance of investments;
the control arrangements regarding compliance with the objectives, the investment
strategies and, where appropriate, the risk limits of the managed UCIs;
the control arrangements regarding the adequate transparency in the prospectus and,
where appropriate, in the UCITS-KIID and/or the PRIIPs-KID of every managed UCI in relation to the general investment policy and the strategy implemented;

Circular CSSF 18/698 Page 68/96
478. Specific provision applicable to AIFMs: The AIFM must, in addition, comply with Articles 18 and
19 of Delegated Regulation (EU) 231/2013. In accordance with Article 19 of Delegated Regulation (EU) 231/2013 concerning investments in assets of limited liquidity which are preceded by a negotiation phase, the portfolio management procedure must describe in particular:

the functioning of and search for possible consistent transactions;
the process of analysing and assessing the selected transactions;
the functioning of the due diligence activities related to the transactions prior to
arranging execution;
the control arrangements regarding the performance of the AIF.
Sub-section 6.3.1.2. Details on the staff and IT systems

The IFM performing internally the portfolio management function must have sufficient staff with the
necessary skills, knowledge and expertise regarding portfolio management having regard to the strategies managed by the IFM.
The IFM which is directly in charge of the portfolio management of one or more UCIs, without using
an external portfolio manager, must make appropriate arrangements for suitable IT systems so as to permit the timely and proper recording of each portfolio transaction according to Articles 8 and 15 of CSSF Regulation 10-4 and Articles 58 and 64 of Delegated Regulation (EU) 231/2013. Sub-section 6.3.1.3. Functioning of the portfolio management committee
Where the IFM establishes a portfolio management committee, it is recommended that the IFM
comply with the following conditions:

the members of the committee collectively have the necessary professional experience
and skills having regard to the managed strategies;
the committee is (not necessarily exclusively) composed of members of the senior
management and of the staff of the IFM who are permanently located in Luxembourg or who have their domicile in a place allowing them, in principle, to come to Luxembourg every day; it is recommended that the conducting officer in charge of the portfolio management function be part of the portfolio management committee;
the operational arrangements of the committee, including in particular the composition
of the committee and the rules regarding the voting rights (majority, veto, etc.) in compliance with the legal provisions on independence of the functions, must be documented. This document must be provided to the CSSF upon request;
the work of the committee must be documented. This documentation includes the
agenda of the meetings, the minutes of the meetings documenting in particular the assessment of risks associated with the contemplated investment, the decisions and measures taken by the committee. Sub-section 6.3.1.4. Use of investment advisers

In order to perform effectively its function and to benefit from the specific skills taking into account
the strategy of the UCI, the IFM may use the services of investment advisers provided that the following cumulative conditions are complied with:

the IFM must define and implement a procedure which describes the IFM’s critical and
independent analysis of the transactions proposed by the investment adviser. Moreover, the document must describe the decision-making process within the IFM with respect to the approval or refusal to carry out the proposed investment. The analysis by the IFM must be carried out prior to the execution of the transaction and must be documented in writing. A simple verification by the IFM that the transaction complies with the UCI’s investment restrictions is not sufficient;
when the investment process is based on the adviser’s proposal of an investment
universe in which it predetermined a precise, limited and detailed list of financial

Circular CSSF 18/698 Page 69/96 instruments in which the UCI may invest (“white list”), this list must be subject to prior analysis and validation by the IFM;

when the IFM uses an investment model (including, for example, an algorithm) drawn
up by the adviser, this investment model must be subject to prior analysis and validation by the IFM;
the IFM must ensure that adequate disclosure is made in the prospectus of the UCIs,
highlighting the exact role of the IFM and the investment adviser in accordance with the provisions of Articles 151(1) of the 2010 Law and 21(1)(d) of the 2013 Law.

The composition of the portfolio management committee referred to in point 481 and the rules
regarding the voting rights within this committee must ensure that the IFM takes effective decisions on investment choices. Thus, for example, if an investment adviser is in the portfolio management committee, its role should, in principle, be limited to an advisory role.
Every IFM which uses the services of an investment adviser must implement measures allowing it
to ensure that this investment adviser has sufficient skills and experience on an ongoing basis taking into account the risk profile of the UCI and the strategies of this UCI.
Section 6.3.2. Specificities related to the delegation of the portfolio management
Sub-section 6.3.2.1. Specific conditions
In addition to the general provisions on the delegation framework as laid down in Sub-chapter 6.2.
(Delegation framework) above, the following specific conditions are applicable.
Where the delegation concerns the portfolio management, the mandate may only be given to
undertakings authorised or registered for the purpose of portfolio management and subject to prudential supervision.
Where the mandate concerning the portfolio management has been given to a third-country
undertaking, the cooperation between the CSSF and the supervisory authority of this country must be ensured. The CSSF determines which supervisory authorities fulfil this condition.
As regards the AIFs in particular, where the conditions referred to in points 486 and 487 cannot be
met, the CSSF may derogate from them in accordance with Article 18(1)(c) and (d) of the 2013 Law.
No mandate with regard to the core function of portfolio management can be given to the depositary
or to a delegate of the depositary or to any other undertaking whose interests may conflict with those of the IFM or the unit-holders.
This provision does not prohibit the delegation of the portfolio management function to a company
belonging to the same group as the depositary. In this case, the CSSF will only authorise the delegation if it has proof that measures protecting the interests of the IFM and the unit-holders have been put in place.
While complying with the general investment policy and the investment limits contained in the
prospectus, the UCI’s fund rules or the UCI’s instruments of incorporation, the entities to which the investment management function has been delegated must manage the portfolio in accordance with investment-allocation criteria periodically laid down by the IFM or the management body/governing body of the UCI which took the form of a company, respectively.
Therefore, the delegation contract will indicate the investment policy and, where appropriate, the
investment limits applicable to the UCI (or to each compartment, if the delegation concerns one or more compartments of a UCI with multiple compartments), and, where appropriate, the specific asset allocation criteria defined by the management body/governing body of the IFM or the management body/governing body of the UCI which adopted the form of a company, respectively. These provisions may be included in the delegation contract by means of a reference to the provisions contained in the prospectus, the UCI’s fund rules, the instruments of incorporation or the issue documents or, where appropriate, the partnership agreement of the UCI concerned, subject to specific

Circular CSSF 18/698 Page 70/96 instructions which may be given from time to time by the management body/governing body of the IFM, by the management body/governing body of the UCI which adopted the form of a company or by the persons who conduct the business of the IFM. In the event of a change of one of these elements, the contract will be amended in good time.
493. In view of the due diligence obligation provided for in Article 26 of CSSF Regulation 10-4 and
Article 18 of Delegated Regulation (EU) 231/2013, the IFM must ensure that the investment
decisions taken are based on qualitative, quantitative, reliable and up-to-date research. Furthermore, it must ensure that these investment decisions are carried out in compliance with the objectives, the investment strategy and the risk limits of the managed UCIs.
494. Where an IFM has delegated the portfolio management, it must, from the moment it enters into the
relationship, monitor on an ongoing basis that each delegate has suitable IT systems in order to meet the requirements of Articles 8, 9, 15 and 16 of CSSF Regulation 10-4 and Articles 58, 59, 64 and 65 of Delegated Regulation (EU) 231/2013. Sub-section 6.3.2.2. Due diligence and ongoing monitoring
495. In addition to the elements referred to in Sub-section 6.2.3.3. Details on the initial due diligence, the
IFM delegating the portfolio management function should, for example, include the following elements (non-exhaustive list) to its due diligence assessment:

the review of the investment process and of the arrangements to use, where appropriate,
investment advisers;
the verification and assessment of the portfolio manager’s track record;
the consideration of the size, skills and experience of the management teams, taking into
account the contemplated strategies, the types of assets, their geographical location and the risk profile of the managed UCIs;
the analysis of the arrangements for the execution and trading of orders (including
compliance with the procedures of the IFM regarding authorised counterparties);
the review of the best execution procedure;
the review of the operational processes regarding transactions, data retention and
position reconciliation processes;
the review of the procedure for selecting brokers;
the analysis of the organisation of the delegate’s risk control function;
the compliance with the remuneration rules;
the review of the procedure applicable to personal transactions.

Moreover, the IFM delegating the portfolio management function should, for example, include the
following elements (non-exhaustive list) to its ongoing monitoring operations:

the verification that the assets of the managed UCI are invested in compliance with the
instruments of incorporation and the legal provisions in force;
the verification that the investment decisions on behalf of the managed UCIs are carried
out in compliance with the objectives, the investment strategy and, where appropriate, the risk limits of these UCIs;
the verification that the prospectus and, where appropriate, the UCITS-KIID and/or the
PRIIPs-KID of every managed UCI adequately reflect the general investment policy and the strategy implemented;
the regular monitoring of the number and nature of pre-trade and post-trade incidents
accompanied by the process for regularising incidents;
the regular monitoring of the number and nature of operational errors and the
implementation of corrective measures;
the verification that the delegate complies with the best execution policy.

Circular CSSF 18/698 Page 71/96
Sub-chapter 6.4. Organisation of the function of UCI administration
Section 6.4.1. General obligations
497. In view of the provisions of CSSF Regulation 10-4 and Delegated Regulation (EU) 231/2013, every
IFM must have established (with reference to Article 9 of CSSF Regulation 10-4) or must establish (with reference to Article 59 of Delegated Regulation (EU) 231/2013), implement and maintain accounting policies and procedures which comply with the accounting rules of the UCI’s home Member State and which ensure that the net asset value of each UCI is accurately calculated on the basis of its accounts and that subscription and redemption orders are properly executed at that net asset value.
498. The accounting records shall be kept in such a way that all assets and liabilities of a UCI can be
directly identified at all times. If the UCI in question has different compartments, separate accounts must be maintained for those compartments.
499. The IFM must ensure that, for UCIs with multiple compartments, separate information on each
compartment must be provided in their annual financial reports in order to allow the investor to have clear and accurate information on the compartment in which s/he invests.
500. An IFM must establish appropriate procedures to ensure the proper and accurate valuation of the
assets and liabilities of the UCIs or, where appropriate, of their compartments. In the case of delegation, these procedures include, in particular, the implementation by the IFM of its own control and monitoring system referred to in point 518 below.
501. The principles laid down above must apply to all types of UCIs managed by the IFM, including nonregulated UCIs managed, where appropriate, by the IFM.
502. The IFM must designate a person among its staff who is responsible for the accounting administration
of UCIs. This function may be combined with other functions. The name of this person and of every person succeeding him/her in office must be communicated forthwith to the CSSF.
Section 6.4.2. Specificities related to the wholly or partially internal UCI administration
function
503. Every IFM which intends to exercise one or more activities falling under the administration function
within the meaning of Annex II of the 2010 Law or Annex I of the 2013 Law must inform the CSSF beforehand in order to get a specific approval to act as UCI administration in addition to its authorisation as IFM. To this end, the IFM must duly fill in and submit the questionnaire Application for approval as administration of a UCI available on the CSSF’s website.
504. Every IFM which intends to delegate one or more tasks falling under the UCI administration function
must inform the CSSF beforehand in order to get a specific approval to act as UCI administration and delegate some tasks relating to the UCI administration function in addition to its authorisation as IFM. To this end, the IFM must duly fill in and submit the questionnaire Application in case of outsourcing of administration tasks for UCI available on the CSSF website.
505. Every IFM must implement procedures and arrangements allowing it to ensure that the delegates
comply with the legal and regulatory provisions in force.
506. An IFM which is directly in charge of the UCI administration, including the maintenance of the
register of the unit-holders must make the appropriate arrangements for suitable IT systems so as to permit the timely and proper recording of each subscription or redemption order in accordance with Articles 8 and 16 of CSSF Regulation 10-4 as well as Articles 58 and 65 of Delegated Regulation (EU) 231/2013.
507. The IFM must have an IT environment permitting to comply with the accounting principles referred
to in Section 6.4.1. above.

Circular CSSF 18/698 Page 72/96
Section 6.4.3. Specificities related to the delegation of the UCI administration
Sub-section 6.4.3.1. Specific conditions
508. In addition to the general provisions on the delegation framework as laid down in Sub-chapter 6.2.
(Delegation framework) above, the following specific conditions are applicable.
509. An IFM established in Luxembourg may be authorised to delegate the administration of a UCI that
it manages to a third party which has all the necessary authorisations and a suitable organisation in order to perform this function.
510. However, different rules of delegation in the area of UCI administration are applicable depending on
the home Member State of the UCI.
511. In the case where a Luxembourg IFM manages a regulated Luxembourg UCI, it is authorised to
delegate the administration of this UCI to a delegate established in the territory of Luxembourg (i.e. bank, professional of the financial sector, IFM) which has all the necessary authorisations and a suitable organisation to perform this function.
512. Where a Luxembourg IFM intends to manage UCIs established in a country other than Luxembourg
and to use an administrative agent established outside Luxembourg, the IFM must also inform the CSSF in accordance with the provisions referred to in Section 6.2.1. (Obligation to notify the CSSF) and must apply the provisions of Section 6.2.3. (Initial due diligence and ongoing monitoring of delegates). As part of its due diligence process, it must verify in particular that the delegate has an organisation permitting to ensure the administration of the UCI(s) concerned. In any case, the third party must have all the necessary authorisations, if applicable in the country in question, and be qualified and capable of undertaking the function in question. In the notification to the CSSF, it must demonstrate that such a delegation complies with the legal and regulatory provisions in force in the country of establishment of the UCI and that the delegation is permitted by the supervisory authority of the UCI.
513. It should be borne in mind that, in all the above-mentioned cases, the IFM must ensure that the third
party in charge of the administration employs accounting procedures and policies (i.e. application of the accounting rules of the home country of the UCI, separate accounting for UCIs with multiple compartments, means permitting the identification and measurement of assets and liabilities of the UCI) when applying due diligence measures, such as referred to in Article 9 of CSSF Regulation 10- 4 and Article 59 of Delegated Regulation (EU) 231/2013.
514. Every IFM must implement procedures and arrangements allowing it to ensure that the delegates
comply with the legal and regulatory provisions in force.
515. Where an IFM has delegated the UCI administration, including the maintenance of the register of
unit-holders, to one or more third parties, it must, from the moment it enters into the relationship, monitor on an ongoing basis that each delegate has suitable IT systems in order to meet the requirements of Articles 8, 9, 15 and 16 of CSSF Regulation 10-4 and Articles 58, 59, 64 and 65 of Delegated Regulation (EU) 231/2013.
516. Specific provision applicable to AIFMs: In view of the obligations of the AIFM under Article 17 of
the 2013 Law and given the responsibility of the AIFM regarding the calculation and publication of the AIF’s net asset value referred to in paragraph 10 of the above-mentioned article, the AIFM must implement measures to fulfil this responsibility. With this in mind, in the event of a delegation of the administration function by the AIF which adopted the form of a company, the AIFM must either be
part of a delegation contract or ensure that bilateral contracts allow the AIFM to fulfil its
responsibilities in accordance with Article 17(10) of the 2013 Law.

Circular CSSF 18/698 Page 73/96
Sub-section 6.4.3.2. Due diligence and ongoing monitoring
517. In addition to the elements referred to in Sub-section 6.2.3.3. Details on the initial due diligence, the
IFM delegating the UCI administration function, including the function of registrar agent, should include the following elements (non-exhaustive list) to its due diligence assessment:

the verification of the existence of a solid control system for calculating the net asset
value;
the verification of the existence of an approval for the valuation source used for
transferable securities, derivative instruments and unlisted instruments;
the review of the implemented AML/CFT operational controls and the assessment of
the human resources allocated to these controls;
the assessment of the registrar agent’s capacity to provide its service, taking into account
the structure and complexity of the distribution network and the types of UCIs concerned;
the assessment of the development of the ML/TF risk;
the review of the registration process for subscriptions and redemptions;
the review of the procedure for the reconciliation of the number of units in circulation.

In the case of delegation of the central administration function, including the function of registrar
agent, the IFM must implement its own control and monitoring system covering at least the following elements (non-exhaustive list):

monitoring the time of delivery of the net asset value;
monitoring the net asset value calculation errors;
monitoring the non-compliance with the investment policy and restrictions;
monitoring the transactions which were not accounted for within the usual time limits;
controlling the fees and commissions to be borne by UCIs;
monitoring the reconciliation of the number of units in circulation.
Sub-chapter 6.5. Organisation of the marketing function

When performing the marketing function, every IFM must implement procedures and arrangements
to ensure that the marketing of UCIs is carried out in compliance with the legal and regulatory provisions in force, particularly the legal and regulatory provisions of the 2010 Law and 2013 Law, especially regarding the initial due diligence and ongoing monitoring obligations of intermediaries ensuring the marketing and with whom the IFM has a direct relationship, as well as the AML/CFT legal and regulatory provisions.
Consequently, the IFM must establish and implement a marketing procedure which covers the
required due diligence as specified in Section 6.2.3. (Initial due diligence and ongoing monitoring of delegates). Moreover, the procedure must also detail the due diligence required under the AML/CFT laws and regulations in force as referred to in Section 5.4.2. (Obligations applicable to the IFM according to the manner in which the relationship with marketing intermediaries and the function of registrar agent is organised).
The procedure referred to in point 520 above must also address the following aspects (non-exhaustive
list) when the UCIs are marketed in the European Union:

where appropriate, the contribution to the identification of the target market of the UCI
together with the UCI’s initiator in accordance with the MiFID II Regulation;
the arrangements for the exchange of structured information between the IFM and the
marketing intermediaries, particularly with respect to the target market;
the arrangements for the remuneration of marketing intermediaries including, where
appropriate, benefits in accordance with the MiFID II Regulation.

Circular CSSF 18/698 Page 74/96
522. In addition to the elements referred to in Sub-section 6.2.3.4. (Details on the ongoing monitoring),
the IFM must carry out an ongoing monitoring of the marketing intermediaries in compliance with
Section 5.4.2. (Obligations applicable to the IFM according to the manner in which the relationship
with marketing intermediaries and the function of registrar agent is organised) of this circular and include the following elements (non-exhaustive list):

the monitoring of marketing incidents (for example, Market Timing, non-compliance
with the legal and regulatory provisions in force in the marketing country, etc.);
the monitoring of the marketing countries;
the monitoring of the compliance by the delegates with the provisions of the MiFID II
Regulation with respect to the reception of benefits, the arrangements for the exchange of information between the IFM and the marketing intermediaries, particularly regarding the target market;
the analysis of the complaint records;
the monitoring of the collection of subscriptions and redemptions, broken down by UCI.

The IFM must submit annually a list of all the marketing intermediaries with whom it has a direct
relationship to the CSSF. This list must be provided within five months following the end of the financial year of the IFM. Sub-chapter 6.6. Organisation of the valuation function (specific provisions applicable to IFMs authorised as AIFM)
Section 6.6.1. General obligations
The AIFM must apply the provisions laid down in Article 17 of the 2013 Law and in Section 7 of
Delegated Regulation (EU) 231/2013 and must therefore put in place a valuation function. The organisation of the valuation function must ensure an independent valuation of the AIFs’ assets.
In accordance with Article 17(4) of the 2013 Law, the function may either be performed internally
or be delegated to an external valuer.
Recommendation applicable to ManCos: Given that the ManCo must also put in place appropriate
procedures to ensure the accurate and precise valuation of assets and liabilities of UCITS pursuant to Article 9(3) of CSSF Regulation 10-4, the CSSF recommends that the ManCo comply with the provisions of this sub-chapter.
Irrespective of the organisational model adopted, the IFM must implement policies and procedures
for the valuation of the AIF’s assets in accordance with Article 17(1) of the 2013 Law and Article 67(1) of Delegated Regulation (EU) 231/2013.
The valuation policies and procedures address at least the points referred to in Article 67(2) of
Delegated Regulation (EU) 231/2013 and Article 17(3) of the 2013 Law. All AIFM strategies for which the AIFM is authorised and each type of instrument contemplated must have a description of the inputs, models and selection criteria for pricing and market data sources. When the AIFM delegates the performance of the function to an external valuer, the identity of this valuer and the description of the process for the exchange of information between the AIFM and this valuer in accordance with Article 67(3) of Delegated Regulation (EU) 231/2013 must be indicated in the procedure.
In the event of a difference in asset values or any other problem of valuation of the AIFs’ assets,
appropriate escalation measures to address these problems must be described in the valuation policies and procedures in accordance with Article 71(4) of Delegated Regulation (EU) 231/2013. In accordance with Article 71 of Delegated Regulation (EU) 231/2013, the valuation policies and procedures of the AIFM must set out a review process for the individual values of assets where a material risk of an inappropriate valuation exists.
The AIFM using these models for the valuation of assets must also comply with the provisions of
Article 68 of Delegated Regulation (EU) 231/2013. The valuation policies and procedures must detail

Circular CSSF 18/698 Page 75/96 the arrangements for the use of valuation models and include at least details on the following elements:

the description of the types of models (standard model or other);
the main characteristics of the model (simple reference to association models is not
enough);
the name of the person(s) who developed each model;
the name of the person(s) empowered to validate the model in accordance with Article
68(2) of Delegated Regulation (EU) 231/2013 who must have sufficient expertise and who should not have been involved in the process of building that model;
the process applied to change the existing models or to make a change of model
(including the name of the person(s) approving these changes);
the arrangements to change a price determined via models (such as, for example, the
application of a discount) by specifying, for example, the name of the approved persons and the validation process.

The valuation policies and procedures must be subject to a periodic review in accordance with Article
70 of Delegated Regulation (EU) 231/2013. Before launching a new investment strategy, the valuation policies and procedures must be reviewed by the AIFM and then submitted to the CSSF for authorisation to extend the authorisation to this new strategy.
Section 6.6.2. Specificities related to the internal performance of the valuation function
In accordance with Article 17(4)(b) of the 2013 Law, the AIFM must ensure that the valuation task
is functionally independent from the portfolio management and the remuneration policy and that other measures ensure that conflicts of interest are mitigated and that undue influence upon the employees is prevented.
In accordance with Article 14 of the 2013 Law pursuant to which the risk management function must
be independent from the operating units, the AIFM must, in particular, ensure the independence between the risk management and valuation activities. Given that for some assets, among which especially complex and illiquid financial instruments, the risk of inappropriate valuation is higher, it is recommended that the AIFMs, authorised to manage strategies and complex and illiquid financial instruments and which decided to perform internally the valuation function, separate the risk management function and the valuation function. However, the CSSF may apply the principle of proportionality in its assessment of the organisation of the valuation function in accordance with the above article.
When performing the valuation function internally, the AIFM may use third-party experts. However,
the liability of the AIFM towards the AIF and its investors is not affected.
Where the valuation function is not performed by an independent external valuer pursuant to Article
17(9) of the 2013 Law, the CSSF may require that the valuation procedures and/or the valuations of the AIFM as well as the model(s) used in accordance with Article 68 of Delegated Regulation (EU) 231/2013 be checked by an external valuer or, where appropriate, by a réviseur d'entreprises agréé (approved statutory auditor).
Where the AIFM establishes a valuation committee, it is recommended that the AIFM comply with
the following conditions:

the members of the committee as a whole have the necessary professional experience
and skills having regard to the managed strategies;
the committee is (not necessarily exclusively) composed of members of the senior
management and of the staff of the AIFM who are permanently located in Luxembourg or who have their domicile in a place allowing them, in principle, to come to Luxembourg every day; it is recommended that the conducting officer in charge of the valuation function be part of the valuation committee;

Circular CSSF 18/698 Page 76/96

the operational arrangements of the committee including, in particular, the composition
of the committee and the rules regarding the voting rights (majority, veto, etc.) in compliance with the legal provisions relating to the independence of the functions must be documented; this document must be made available to the CSSF upon request; the composition of the valuation committee and the rules regarding the voting rights must ensure an independent valuation of the AIF’s assets; thus, for example, in order to ensure that the valuation is performed impartially and with all due skill, care and diligence in accordance with Article 17(8) of the 2013 Law, proof must be provided that the members of the valuation committee are functionally independent from the investment management process, including from the selection of investments; the AIFM must apply the above principle irrespective of the fact that the portfolio management function is performed internally, possibly relying on investment advisers, or is delegated;
the work of the committee must be documented. This documentation includes the
agenda of the meetings, the minutes of the meetings documenting, in particular, the assessment of risks associated with the investments, the decisions and measures taken by the committee.
Section 6.6.3. Specificities related to the delegation of the valuation function

In addition to the general provisions on the delegation framework as laid down in Sub-chapter 6.2.
(Delegation framework) above, the following specific conditions are applicable.
The AIFM which delegates the performance of the valuation function must also ensure compliance
with the provisions laid down in Article 17(4)(b), (5), (6) and (7) of the 2013 Law as well as Article 67(3) of Delegated Regulation (EU) 231/2013.
In accordance with Article 17(7) of the 2013 Law, the AIFM must notify the designation of an
external valuer to the CSSF.
Moreover, when carrying out the initial due diligence and ongoing monitoring, the AIFM which
designated an external valuer must ensure that this external valuer offers sufficient professional guarantees as laid down in Article 73 of Delegated Regulation (EU) 231/2013 and Article 17(5)(b) of the 2013 Law.
Finally, the CSSF reiterates that the designated external valuer is not authorised to delegate the
valuation function to a third party in accordance with Article 17(6) of the 2013 Law.
Chapter 7. External audit
In accordance with Article 104 of the 2010 Law and Article 7a of the 2013 Law, every IFM must
entrust the audit of its annual accounting documents to one or more réviseurs d'entreprises agréés (approved statutory auditors) who can prove that they have adequate professional experience.
In accordance with the above articles, the IFM must spontaneously transmit the audited annual
accounts and written comments issued by the réviseur d’entreprises agréé (approved statutory auditor) in the context of its audit of the annual accounting documents, in particular the internal audit letter (also known as management letter) issued by the réviseur d'entreprises agréé (approved statutory auditor), within one month following the ordinary general meeting that approved the annual accounts of the IFM and at the latest seven months following the closing date of the IFM’s financial year.
Any change regarding the réviseurs d’entreprises agréés (approved statutory auditors) must be
approved by the CSSF beforehand. The file must also include the name of the key audit partner.
Chapter 8. Information exchange between the IFM and the depositary
The IFM must ensure that the depositary receives, upon commencement of its duties and on an
ongoing basis thereafter, all the relevant information it needs to perform its functions for the UCI for

Circular CSSF 18/698 Page 77/96 which it has been designated as depositary, so that the depositary may comply with its obligations in accordance with the applicable legal and regulatory provisions.
546. Consequently, the IFM must also ensure that its delegates as well as, where appropriate, the external
persons who are not designated directly by the IFM (such as, for example, the administration of the AIF or the collateral manager, where appropriate) make available to the depositary all the relevant information it needs to carry out its duties in accordance with point 545 above.
547. Specific provision applicable to ManCos: The ManCo must, in particular, ensure that the written
procedures laid down in point 33 of Circular CSSF 16/644 describe the information that must be provided in this context to the depositary of the managed UCITS. Specific provisions applicable to AIFMs:
548. The AIFM must ensure that the written procedures laid down in point 65 of Circular CSSF 18/697
describe the information that must be provided in this context to the depositary of the managed AIFs.
549. Where the prime broker must hold custody of the assets owned by the AIF, the prime broker must
then be considered as acting as delegate of the depositary of this AIF. The AIFM must ensure that the depositary has a right of refusal regarding the choice and appointment of a prime broker by the AIF or its IFM where the prime broker will, in the discharge of its duties, hold custody of the assets owned by the AIF. The IFM must transmit to the depositary in good time all the relevant information on the prime broker so that the depositary is able to perform its duties.
550. Provisions applicable to IFMs: The procedures referred to in points 547 and 548 above must
determine the nature of the information for which the IFM should play a centralising role in order to facilitate the flow of information.
Chapter 9. Programme of activity
551. The application for authorisation of an IFM includes a programme of activity as referred to in Article
102(1)(d) of the 2010 Law and Article 6(2)(c) of the 2013 Law. This document provides a description of the envisaged activities as well as of the development projects of the IFM.
552. Note should be made that the programme of activity referred to in this chapter is different from the
document referred to in Article 114(2)(b) of the 2010 Law and Article 32(2)(b) of the 2013 Law in the context of the freedom to provide services and freedom of establishment.
553. The programme of activity includes, at least, information on:

the scope of the proposed services for the next three financial years concerning:
a) the management of UCIs:
the number of UCITS, AIFs and other UCIs under management, including
non-regulated AIFs, distinguishing between the UCIs directly managed and the UCIs managed by delegation;
the net assets and the number of UCIs created on the initiative of a thirdparty company (i.e. which does not belong to the same group as the IFM),
distinguishing between the UCIs directly managed and the UCIs managed by delegation;
for UCIs other than Luxembourg UCIs, the indication of the country in
which these funds are established and whether they are subject to supervision by an authority;
the number of UCITS, AIFs and other UCIs, including non-regulated AIFs
for which the IFM intends to act as administrative agent, registrar agent or domiciliation agent, where appropriate;
the investment policies of the managed UCIs, as well as the instruments
and financial markets concerned. Where appropriate, the programme must

Circular CSSF 18/698 Page 78/96 indicate if the IFM intends to manage UCIs qualifying as money market funds under the MMFR;

the investment strategy followed;
b) the discretionary management, where appropriate, in accordance with Part III below;
the organisational structure of the IFM including the delegation structure, where
appropriate;
the risk management procedure in accordance with the format presented in the Annex
to Circular CSSF 11/512 (Article 42(1) of the 2010 Law) for the IFM authorised to manage UCITS or in accordance with Annex 1 of this circular for the IFM authorised to manage AIFs;
the international strategy, in particular under the freedom to provide services and
freedom of establishment (cf. Part IV of this circular);
the projected accounts of the IFM (profit and loss accounts and balance sheet) for the
next three financial years as well as the development strategy of the IFM. The document must be accompanied by a description of the business development forecasts and must show the long-term nature of the envisaged business model. The assumptions must be realistic, solid, reasonable and sufficiently precise. Moreover, the IFM must show how it intends to comply with legal and regulatory requirements regarding own funds during its business start-up phase. In particular, the projected accounts must detail the UCI management commissions broken down by type of UCI, the retrocession of UCI management commissions broken down by type of UCI and by activity, the possible other income and expenses resulting from UCI management and the products associated with the activities which are not part of UCI management, when this information can be forecasted. In case of acquisition of units of UCIs by the IFM, such as, for example, during the launch of a UCI or share classes of managed UCIs (seeding), it must be explicitly indicated in the programme of activity. To this end, the IFM must inform the CSSF beforehand of its initial decision to make such investments by indicating the envisaged amounts and duration of said investments.

The IFM must inform the CSSF beforehand of its intention to make substantial changes to its
programme of activity.
Moreover, the CSSF may require the updated programme of activity, including, in particular, the
projected accounts which comply with point 553 above, at any time during the lifetime of the IFM. Specific provisions applicable to AIFMs:
Where the AIFM intends to launch one or more new AIF investment strategies, as defined in Annex
IV of Delegated Regulation (EU) 231/2013, the AIFM must submit a written request in order to be authorised to extend its authorisation to these new strategies. The request must include the questionnaire in force on the CSSF website which is supplemented at least by the valuation policies and procedures and the updated RMP in order to take these new intended strategies into account.
Where the AIFM intends to manage AIFs qualifying as money market funds, the AIFM must submit
a written application for authorisation to manage AIFs qualifying as money market funds pursuant to Article 5 of the MMFR.

Circular CSSF 18/698 Page 79/96
Part III. Conditions for obtaining and maintaining the authorisation of
IFMs which exercise activities of UCI management and management of portfolios of investments on a client-by-client basis as referred to in Article 101(3) of the 2010 Law and Article 5(4) of the 2013 Law
558. All the conditions set forth under Part II above remain applicable. Additional requirements apply that
are specific to the activity of the management of portfolios of investments on a client-by-client basis. It should be borne in mind that, in accordance with point 305 of this circular, the IFM referred to in this part is also subject to the AML/CFT laws and regulations in force, among which the AML/CFT Law, the Law of 27 October 2010, CSSF Regulation 12-02, CSSF circulars on AML/CFT and the United Nations Security Council resolutions as well as acts adopted by the European Union.
559. The programme of activity as described in Chapter 9 of Part II includes also information on the scope
of the proposed services for the next three financial years regarding at least:

the description of the activities carried out under Article 101(3) of the 2010 Law and/or
Article 5(4) of the 2013 Law including, where appropriate, the proposed non-core
services;
the type of clients targeted;
the number of private, institutional and pension fund clients;
the assets under management by type of client;
the financial instruments and markets concerned;
the arrangements made for marketing;
the indication of the depositaries with which the clients’ assets are deposited;
the risk management policy applied with regard to discretionary management.

The CSSF would like to point out that some provisions of the MiFID II Regulation apply to the IFM
providing discretionary management services. Consequently, Articles 1-1, 37-1 and 37-3 of the LFS, Articles 1(1) and 65 of Commission Delegated Regulation (EU) 2017/565 of 25 April 2016 supplementing Directive 2014/65/EU of the European Parliament and of the Council as regards organisational requirements and operating conditions for investment firms and defined terms for the purposes of that Directive, as well as Article 1 of Grand-ducal Regulation of 30 May 2018 on the protection of financial instruments and funds belonging to clients, product governance obligations and the rules applicable to the provision or reception of fees, commissions or any monetary or nonmonetary benefit apply mutatis mutandis to the provision of discretionary management services by the IFM.
In this context, the IFM must provide confirmation, at the moment of its authorisation, that it
completely adheres to the above-mentioned provisions of MiFID II Regulation.
It should be noted that, insofar as the services provided in accordance with mandates given on a
client-by-client basis by an IFM referred to in this part are the same as those provided by the private portfolio managers falling within the scope of Article 24-3 of the LFS, the same prudential rules are applicable.
As regards the requirements under EMIR, the responsibility of the IFM authorised to exercise
discretionary management is limited solely to the reporting of positions in derivative contracts taken for clients for which the IFM authorised to exercise discretionary management is party to the derivative contract (“for its own account”). In case of delegation, the IFM authorised to exercise discretionary management must also comply with the provisions referred to in Part II, Chapter 6 Specific organisational arrangements.
The IFM must also submit to the CSSF model contracts for discretionary management and, where
appropriate, contracts relating to non-core services it intends to have its clients sign.
Every IFM that provides services of management of portfolios of investments, including those owned
by pension funds in accordance with mandates given by investors on a discretionary, client-by-client

Circular CSSF 18/698 Page 80/96 basis, must also comply, besides with the provisions of Part II, Chapter 3 Own funds of this circular, with Luxembourg laws and regulations transposing Directive 2013/36/EU of 26 June 2013 on capital adequacy.
566. To this end, the IFM referred to in this part must submit its calculation of the capital ratio in
accordance with Circular CSSF 07/290 on a quarterly basis, i.e. by the 20th of the month following the end of the calendar quarter at the latest.
567. Finally, every IFM whose authorisation covers the services set out in Article 101(3) of the 2010 Law
or Article 5(4) of the 2013 Law and thus ensuring discretionary management, must participate for these services in an investor compensation system set up in Luxembourg and recognised by the CSSF. Consequently, the IFMs must be members of the Système d’Indemnisation des Investisseurs Luxembourg.
Part IV. The IFM and the principle of freedom of establishment and
freedom to provide services
Chapter 1. Freedom to establish a branch
Sub-chapter 1.1. Obligation of notification
Specific provisions applicable to ManCos:
568. Every IFM subject to Chapter 15 of the 2010 Law and wishing to exercise activities or to provide
services within the territory of another Member State, by way of a branch under the UCITS Directive, must submit a notification which includes the information referred to in Article 114 of the 2010 Law to the CSSF. Thus, the notification must be accompanied by the following pieces of information:
a) the Member State within the territory of which the ManCo plans to establish a branch; b) a programme of operations setting out the activities and services according to Article 101(2) and (3) envisaged and the organisational structure of the branch, which must include a description of the risk management process put in place by the ManCo. It must also include a description of the procedures and arrangements taken to handle complaints and to make information available at the request of the public or the competent authorities of the UCITS home Member State; c) the address in the ManCo's host Member State from which documents may be obtained; and d) the name of the conducting officer(s) responsible for the management of the branch.
569. The description of the risk management process must be appropriate and proportionate to the activity
and/or services actually provided at the level of the branch in the host country. It covers, where appropriate, the services provided for in Article 101(3) of the 2010 Law, i.e. the management of mandates on a client-by-client basis.
570. Specific provision applicable to AIFMs: Every IFM authorised as AIFM and wishing to exercise
activities or to provide services within the territory of another Member State, by way of a branch under the AIFMD, must submit a notification which includes the information referred to in Article 32 of the 2013 Law to the CSSF. Thus, the notification must be accompanied by the following pieces of information:
a) the Member State within the territory of which the AIFM plans to establish a branch, and/or to provide the services referred to in Article 5(4) of the 2013 Law; b) a programme of operations stating in particular the services which the AIFM intends to provide and/or identifying the AIFs it intends to manage; c) the organisational structure of the branch; d) the address in the home Member State of the AIF from which documents may be obtained;

Circular CSSF 18/698 Page 81/96 e) the names and contact details of the persons responsible for the management of the branch.
571. The notification file must be established in a language mutually accepted by the CSSF and the
competent authority of the host Member State.
572. The branch of the IFM must have at least one branch manager
(“dirigeant”/”Zweigniederlassungsleiter”) located in the host country.
573. As regards the branch manager(s), every IFM must include the following pieces of information and
any other document which might be subsequently indicated by the CSSF in the notification:

a recent curriculum vitae, signed and dated;
a copy of the passport/identity card;
a declaration of honour, as may be downloaded on the CSSF website (www.cssf.lu);
and
a recent extract of the criminal record, if available, or any other equivalent document.
Sub-chapter 1.2. Operating conditions

The IFM designates a person among its conducting officers who is responsible for monitoring the
activities of the branch and whose name will be communicated to the CSSF at the time of the notification. This person is responsible for coordinating the exchange of information between the branch(es) and the head office of the IFM in Luxembourg. The name of this person and of every person succeeding him/her in office must be communicated forthwith to the CSSF for approval. The notification must be accompanied by the pieces of information referred to in point 573 above.
The IFM must maintain a sufficient level of substance in the head office in Luxembourg in
accordance with the provisions under Chapters 4, 5 and 6 of Part II. of this circular in order to carry out an appropriate monitoring of the activities of the branch(es).
The functions of compliance, risk management and internal audit must cover the activities exercised
in the branch(es).
In general, the IFM which has one or more branches can neither use an external expert specialised in
internal audit nor delegate the performance of the compliance function. However, the CSSF may derogate from this general principle based on an appropriate justification, provided that the importance and nature of the activities exercised by the branch as well as the size of the branch so justify pursuant to the provisions referred to in Sections 5.3.2. and 5.3.3. of this circular.
The IFM must inform the CSSF of the changes affecting the branch in accordance with the provisions
laid down in Article 18(4) of the UCITS Directive or Article 33(6) of the AIFMD respectively.
The IFM must readily inform in case of changes affecting the organisation of the branch or any
substantial change affecting the number of staff in the branch as well as the nature and volume of activity carried out from the branch.
The senior management of the IFM must draw up a written report on an annual basis which describes
the activities carried out within each branch during that period, including their geographical distribution and an assessment of the financial situation of the branch. The report describes the organisation implemented within the branch to fight against money laundering and terrorist financing as well as the checks carried out and their conclusions as regards compliance with the Luxembourg AML/CFT obligations by each branch. In case of non-compliance, the report provides explanations on the reasons for this non-compliance and the steps taken and deadlines to address this situation. The report specifies if the policies and procedures were implemented at group level and if the IFM is a group or part of the group in accordance with the provisions of Article 4-1 of the AML/CFT Law. The CSSF must receive this document within five months following the end of the financial year of the IFM.

Circular CSSF 18/698 Page 82/96
581. It should be borne in mind that, in accordance with Circular CSSF 10/467, the IFM which have one
or more branches must communicate not only the accounting version “L” of the periodic tables (figures of the sole head office in Luxembourg) but also the version “N” (overall figures of the head office and of all the branches) and the version “S” (figures of each branch separately).
582. The réviseur d’entreprises agréé (approved statutory auditor) includes the branches when auditing
the annual accounts of the IFM.
Chapter 2. Freedom to provide services
Specific provisions applicable to ManCos:
583. Every ManCo wishing to exercise activities or provide services within the territory of another
Member State under the freedom to provide services pursuant to the UCITS Directive must submit to the CSSF a notification containing the information referred to in Article 115 of the 2010 Law. Thus, the notification must be accompanied by the following pieces of information:
a) the Member State within the territory of which the ManCo intends to operate; b) a programme of operations stating the activities and services referred to in Article 101(2) and (3) of the 2010 Law envisaged which must include a description of the risk management process put in place by the ManCo. It must also include a description of the procedures and arrangements taken in accordance with Article 112 of the 2010 Law.
584. The description of the risk management process must be appropriate and proportionate to the activity
and/or services actually provided at the level of the branch in the host country. It covers, where appropriate, the services provided for in Article 101(3) of the 2010 Law, i.e. the management of mandates on a client-by-client basis.
585. It should be noted that under Article 113 of the 2010 Law, a ManCo which proposes, without
establishing a branch, only to market the units of the UCITS it manages in a Member State other than the UCITS home Member State, is not subject to the provisions regarding the freedom to provide services.
586. Specific provision applicable to AIFMs: Every AIFM wishing to exercise activities or provide
services within the territory of another Member State under the freedom to provide services pursuant to the AIFMD must submit to the CSSF a notification containing the information referred to in Article 32 of the 2013 Law. Thus, the notification file must include:
a) the Member State within the territory of which the AIFM intends to manage AIFs directly and/or to provide the services referred to in Article 5(4) of the 2013 Law; b) a programme of operations stating in particular the services which the AIFM intends to provide and/or identifying the AIFs it intends to manage;
587. The notification file must be established in a language mutually accepted by the CSSF and the
competent authority of the host Member State.
588. The IFM must also provide a description of the main marketing techniques which it intends to use
(regular trips to the host Member State, distance sales, etc.) if marketing is one of its key functions.
Chapter 3. General provisions regarding the freedom of establishment and the
freedom to provide services
589. The IFM which established a branch or which acts under the freedom to provide services in another
Member State, must notify in writing any changes in the information referred to in point 568(b), (c) and (d), or in point 583(b) for ManCos, or in point 570 or point 586 for AIFMs, to the competent authority of its host country as well as to the CSSF within one month before the entry into force of the change at the latest (Articles 114(7) or 115(4) of the 2010 Law for the ManCo and Article 32(5) of the 2013 Law for the AIFM).

Circular CSSF 18/698 Page 83/96
590. Specific provision applicable to ManCos: Where a ManCo wishes to manage a UCITS of a Member
State on a cross-border basis via the creation of a branch or via the freedom to provide services, it must provide the competent authorities of the UCITS home Member State with the written agreement concluded with the depositary and with information relating to the delegation arrangements made by the ManCo in relation to the functions referred to in Annex II of the 2010 Law on administration and investment management.
Part V. Principle of proportionality
591. The principle of proportionality may be invoked by an IFM in the application of certain requirements
set out in CSSF Regulation 10-4 and Delegated Regulation (EU) 231/2013 while taking into account the nature, scale and complexity of its activities and the range of services provided.
592. Thus, an IFM may be authorised to apply the principle of proportionality when organising its
permanent risk management (Section 5.3.1.), compliance (Section 5.3.2.), internal audit (Section 5.3.3.) functions, subject to prior duly reasoned request. The principle of proportionality cannot be invoked in order to put in place the above-mentioned functions.
593. Moreover, every IFM may take this principle into account in the organisation of its human resources,
in the management of conflicts of interest, in the implementation of the remuneration policy, in compliance with the conditions referred to above in Sections 5.1.1., 5.5.7. and 5.5.9. of this circular.
594. When applying the provisions regarding the organisational requirements referred to in Article 5 of
CSSF Regulation 10-4 and Article 57 of Delegated Regulation (EU) 231/2013, the IFM must take into account the nature, the size and the complexity of its activity as well as the nature and range of the provided services and performed tasks.
595. However, the application of the principle of proportionality cannot be invoked with respect to the
obligation to employ at least three FTE people at the Luxembourg head office who spend their work time performing key functions as referred to in point 123.
596. In order to assess the principle of proportionality, the following elements are taken into account: the
number of UCIs/compartments managed by the IFM, whether or not they are regulated, including the UCIs managed on a cross-border basis, the total assets under management, the risk level of the types of assets or strategies managed, the closed-end or open-end nature of the UCIs, the number of transactions at the level of UCIs, the possibility for the IFM to benefit from a specific intra-group expertise.
Part VI. IFMs governed by Article 125-1 of Chapter 16 and IFMs governed
by Chapter 17 of the 2010 Law
Chapter 1. IFMs governed by Article 125-1 of Chapter 16 of the 2010 Law
597. Access to the activity of an IFM governed by Article 125-1 of Chapter 16 of the 2010 Law is subject
to prior authorisation by the CSSF (Article 125-1 of the 2010 Law).
598. The conditions for obtaining and maintaining this authorisation are specified in this chapter. To this
end, the following requirements with which the IFM subject to Article 125-1 of Chapter 16 of the 2010 Law must comply are particularly noteworthy:

to have sufficient financial resources to conduct its business effectively and to meet its
liabilities. It must in particular have a minimum paid-up share capital of one hundred and twenty-five thousand euros (EUR 125,000) in accordance with Article 125-1(2)(a) of the 2010 Law.
to maintain the required own funds at the permanent disposal of the IFM and invest it
in its own interest in accordance with Article 125-1(2)(b) of the 2010 Law. To this end, the IFM authorised under Article 125-1 of the 2010 Law must comply with the

Circular CSSF 18/698 Page 84/96 provisions referred to in Sub-chapter 3.3. of Part II (Use of own funds), including with respect to the arrangements regarding the acquisition of holding and the creation of a subsidiary, except for point 57 of this circular, where appropriate;

the conducting officers of the IFM within the meaning of Article 129(5) of the 2010
Law must prove that they are of good repute and that they have the professional experience required to perform their functions in accordance with Article 125-1(2)(c) of the 2010 Law. To this end, the provisions referred to in Sub-chapter 4.1. (The members of the governing body or management body), Sections 4.2.2. (Requirements regarding the skills, experience and the good repute of the senior management) and
4.2.4. (Obligations regarding meetings and deliberations) as well as Sub-chapter 4.3.
(Procedure for the approval of the members of the management body/governing body and the conducting officers) of Part II are applicable to IFMs governed by Article 125- 1 of Chapter 16 of the 2010 Law;
the identity of the reference shareholders or members of the IFM must be communicated
to the CSSF in accordance with Article 125-1(2)(d) of the 2010 Law. Thus, the provisions referred to in Sub-chapter 2.1. (Initial authorisation) are applicable to IFMs governed by Article 125-1 of Chapter 16 of the 2010 Law; in case of a change affecting the shareholding of the IFM, the CSSF expects to be notified thereof pursuant to the provisions of Sub-chapter 2.2. (Changes in the shareholding);
the authorisation request must describe the structure and organisation of the IFM in
accordance with Article 125-1(2)(e) of the 2010 Law. This description must in particular concern the organisation of the human resources and of the UCI management functions including, where appropriate, the delegation structure;
in accordance with Article 126 of the 2010 Law which refers to Article 104 of the 2010
Law, the IFMs governed by Article 125-1 of Chapter 16 of the 2010 Law must also comply with Chapter 7 (External audit) of Part II of this circular.

The IFMs subject to Article 125-1 of Chapter 16 of the 2010 Law must also comply with the
AML/CFT laws and regulations in force. Consequently, Sub-chapter 5.4. (Organisation of the fight against money laundering and terrorist financing) applies to them.
Chapter 2. IFMs governed by Chapter 17 of the 2010 Law
Access to the UCI management activity by EU or non-EU branches of IFMs other than those
authorised by the competent authorities of another Member State pursuant to the UCITS Directive, which are governed by Chapter 17 of the 2010 Law, is subject to prior authorisation by the CSSF (Article 127(1) of the 2010 Law).
Pursuant to Article 127(1) of the 2010 Law, the IFM referred to in this chapter is subject to the same
rules as the IFM subject to Article 125-1 or 125-2 of Chapter 16 of the 2010 Law. Consequently, this IFM must comply with all the provisions of this circular (Part VI, Chapter 1 or Part II, where appropriate) where they are relevant in view of the absence of a legal personality of the branch.
Part VII. SIAGs and FIAAGs
Chapter 1. Conditions for obtaining and maintaining authorisation
Access to the activity of a SIAG within the meaning of Article 27 of the 2010 Law and the activity
of a FIAAG within the meaning of Article 4(1)(b) of the 2013 Law is subject to prior authorisation by the CSSF.
The conditions for obtaining and maintaining this authorisation are specified in this chapter. To this
end, it is particularly noteworthy that a SIAG or a FIAAG must:

Circular CSSF 18/698 Page 85/96

have a share capital of EUR 300,000 at the time of its authorisation in accordance with
Article 27(1) of the 2010 Law for the SIAG and with Article 8(1) of the 2013 Law for
the FIAAG;
submit a programme of activity (Article 27(1) of the 2010 Law for the SIAG and Article
6(2)(c) of the 2013 Law for the FIAAG) at the time of its authorisation;
appoint at least two conducting officers (Article 27(1) of the 2010 Law for the SIAG
and Article 7(1)(c) of the 2013 Law for the FIAAG);
comply with some conditions regarding delegation (Article 27(2) of the 2010 Law with
reference to Article 110(1) of the 2010 Law for the SIAG and Article 18 of the 2013 Law for the FIAAG);
act in compliance with the rules of conduct provided for in Article 27(2) of the 2010
Law with reference to Article 111 of the 2010 Law for the SIAG and other operating conditions provided for in Article 11 of the 2013 Law for the FIAAG;
comply with the rules regarding remuneration policies and practices as provided for in
Article 27(2) of the 2010 Law with reference to Articles 111a and 111b of the 2010 Law
for the SIAG and Article 12 of the 2013 Law for the FIAAG;
comply with the provisions provided for in Section 5.5.5. on the obligations regarding
claim and complaint handling;
have sound administrative and accounting procedures (Article 27(3) of the 2010 Law
with reference to Article 109(1)(a) of the 2010 Law for the SIAG and Article 16 of the 2013 Law for the FIAAG);
put in place a risk management and measurement policy (Article 42(1) of the 2010 Law
for the SIAG and Article 14 of the 2013 Law for the FIAAG);
have a central administration and registered office in Luxembourg (Article 102(1)(e) of
the 2010 Law for the SIAG and Article 7(1)(e) of the 2013 Law for the FIAAG).

It follows from the above-mentioned articles that the SIAG and the FIAAG must comply with the
entire Parts II, V, VIII and IX of this circular, except for point 512. As regards the application of Part II, Chapter 2 (Shareholding), the provisions must be applied to the initiator of the SIAG or the FIAAG. As regards more particularly the SIAG, Sections 5.3.2. (Permanent compliance function) and 5.3.3. (Permanent internal audit function) do not apply to it.
Consequently, every SIAG and every FIAAG must not only have its registered office in Luxembourg
but also its decision-making centre and its administrative centre as defined in Sub-chapter 5.1. (Arrangements regarding the central administration of the IFM).
A regulated SIAG or FIAAG may delegate the administration of its portfolio(s) to a third party
established in Luxembourg (i.e. bank, professional of the financial sector, IFM) having all the necessary authorisations and a suitable organisation in order to perform this function.
Every SIAG and every FIAAG must, in addition, comply with the AML/CFT laws and regulations
in force; thus, Sub-chapter 5.4. (Organisation of the fight against money laundering and terrorist financing) applies to them.
Specific provision applicable to FIAAGs: Moreover, the FIAAG is subject to the following
obligations:

the obligation to cover potential professional liability risks in accordance with Article
8(7) of the 2013 Law, as specified in points 37 to 39 of this circular;
the obligation to establish a compliance and internal audit function pursuant to Articles
61 and 62 of Delegated Regulation (EU) 231/2013;
the obligation to comply with the valuation obligations (Article 17 of the 2013 Law).

Specific provision applicable to SIAGs: The SIAG must have procedures for the handling of claims
from investors and for the transmission of information, upon request of the public or competent

Circular CSSF 18/698 Page 86/96 authorities of the home Member State of the UCITS pursuant to Article 27(2) of the 2010 Law with reference to Article 112 of the 2010 Law.
610. Based on a duly reasoned request, a SIAG or a FIAAG may invoke the principle of proportionality
pursuant to Part V, provided that the provisions concerned apply to it.
611. Finally, it should be noted that the provisions of Part IV regarding the freedom to provide services
or the freedom of establishment of a branch, respectively, do not apply to a SIAG or a FIAAG.
Chapter 2. Prudential supervision of SIAGs and FIAAGs
Specific provisions applicable to SIAGs:
612. Articles 27 and 39 of the 2010 Law require a SIAG to comply with the applicable provisions
regarding prudential supervision. Every SIAG is asked to submit specific financial information to the CSSF which must be drawn up on a quarterly basis. This financial information will be used by the CSSF for the purpose of the prudential supervision of a SIAG.
613. The financial information schedules which must be submitted periodically to the CSSF are set out in
Annex 3. This information concerns the “Financial situation” (Table SIAG 1A), the “Profit and loss
account” (Table SIAG 1B) and the “Number of employees” (Table Employees).
614. The tables must be drawn up on a quarterly basis. The dates of the report are the last day of each
calendar-quarter, i.e. 31 March, 30 June, 30 September and 31 December. The CSSF must receive these tables by the 20th day of the month following the reference date.
615. The final tables must be communicated to the CSSF one month after the ordinary general meeting
that approved the annual accounts.
616. Specific provision applicable to FIAAGs: The CSSF expects that the FIAAG submits its specific
financial information under the conditions referred to in points 612 to 615 above.
Part VIII. Communication with the CSSF
617. When communicating in writing with the CSSF, the IFM must use a language accepted by the CSSF.
The use of Luxembourgish, French, German or English is accepted in any case.
Part IX. Entry into force and various provisions
618. This circular repeals Circular CSSF 12/546.
619. Point (e) of Title V.I. Content and format of the risk management process of Circular CSSF 11/512
is amended in that the implementation of the risk management procedure must be communicated no later than five months following the end of the financial year of the IFM.
620. The last sub-paragraph of Title 3. Communication of information to the CSSF of Circular CSSF
17/671 is amended in that the table and summary report regarding the handling of complaints must be communicated to the CSSF within five months following the end of the financial year of the IFM.
621. This circular enters into force with immediate effect.

Circular CSSF 18/698 Page 87/96
ANNEXES
ANNEX 1: The risk management procedure of AIFs to be communicated to
the CSSF

General section: governance and organisation of the risk management function
1.1. Schematic organisation chart of the risk management function
1.1.1. Provide the general organisation chart of the risk management function by:

covering the players involved in the management of the main types of risks
(all being included under 1.4);
counting the people of each team involved in the risk management;
indicating the main reporting lines (for example, hierarchy, business line, risk
management committee, valuation committee, executive committee, Board of Directors, senior management, etc.), all being included under 1.2;
highlighting possible risk management activities delegated to third parties
(indicate the name of the third parties).
1.1.2. Comment on the organisation chart and describe the experience of the persons in
charge. Provide the name of the person responsible for the risk management function at the level of the AIFM as well as the curriculum vitae of this person.
1.2. Governance structure
Using the table below, describe the governance (in particular, the senior management, management body/governing body, the committees, where appropriate) involved in the risk management. Bodies Role/responsibilities Composition/members Frequency of meeting Board X Board Y Senior management Committee ABC …

Circular CSSF 18/698 Page 88/96
1.3. Pursuant to Articles 14 of the 2013 Law and 42 and 43 of Delegated Regulation (EU)
231/2013, demonstrate the independence of the permanent risk management function. Demonstrate (where appropriate) that appropriate safeguards have been implemented against conflicts of interest in order to allow the independent exercise of risk management activities.
1.4. Risk management policy
1.4.1. Describe the risk management policy by specifying the risks covered. As a reminder,
Article 40 of Delegated Regulation (EU) 231/2013 refers to market, liquidity and
counterparty risks as well as to any other risk, including the operational likely to be significant for AIFs (including the risks likely to be significant for AIFs which are not specifically covered in the following sections of this annex).
1.4.2. Demonstrate the compliance of the risk management policy with all the provisions
laid down in Article 40 of Delegated Regulation (EU) 231/2013.
1.4.3. List the main procedures included in the risk management procedure (cf. Article 40
of Delegated Regulation (EU) 231/2013).
1.5. Permanent risk management function
1.5.1. Describe the role of the permanent risk management function and describe
consecutively the manner in which it fulfils every requirement referred to in Article 39 of Delegated Regulation (EU) 231/2013.
1.5.2. Describe the process for the establishment of the risk profiles of every AIF.
1.6. Describe the valuation, monitoring and periodic review process of the risk management
system. Specify the reporting process in this respect to the senior management, management body/governing body and supervisory function, if any.
1.7. Describe the regular reports on risk management using the table below by describing the
information reports on the management of these risks for the risks covered by the risk management policy (cf. under 1.4) and at least for the risks listed in the table. Risks covered Report title Issuing entity Addressees* Frequency Market Liquidity Counterparty Operational Credit Compliance …

Name of the persons and their status or name of the bodies
Monitoring of the investment restrictions
1.8. Describe the IT systems used for the risk management using the table below by describing
these systems for the risks covered by the risk management policy (cf. under 1.4) and at least for the risks listed in the table.

Circular CSSF 18/698 Page 89/96
Risks covered IT system Person responsible for configuration* Person responsible for the monitoring of risks Market Liquidity Counterparty Operational Credit Compliance …

The configuration includes, for example, development, maintenance and management of the IT system
1.9. Agreement(s) with one or more specialised third parties in respect of the exercise of risk
management activities.
1.9.1. Describe the measures taken in order to ensure that these third parties have the skills
and capabilities necessary to exercise the risk management activities in a reliable, professional and effective manner.
1.9.2. Provide the possible status of prudential supervision of the third party(ies) involved
in the exercise of risk management activities.
1.9.3. Confirm the existence of contracts governing agreement(s) with one or more
specialised third parties in respect of the exercise of risk management activities.
1.9.4. Describe also the ongoing valuation process of the quality of the services provided
by the third parties.
1.9.5. Confirm that the risk management procedure includes the responses to the
requirements listed in this annex by considering the risk management activities subject to agreement(s) with one or more third parties and by referring, where appropriate, to the processes, systems and methods of the third parties.
1.10. Describe the validation policy and processes in respect of new products, instruments,
investment processes and new activities.
1.11. Describe in which manner the risk management activities are covered by the compliance
function and the internal audit function.

Circular CSSF 18/698 Page 90/96
2. Specific complementary section: risk management policy in respect of strategies
2.1. Provide the name of the strategy subject to this specific complementary section.
2.2. Briefly describe the strategy and instruments used to implement it.
2.3. Briefly describe the investment process, including the process for the selection, due
diligence, decision, monitoring and disinvestment of assets. Name the players involved in the process.
2.4. Where appropriate, describe possible organisational elements regarding the risk management
which would differ from the presentation in the general section.
2.5. Describe the market risk management policy.
2.6. Describe the liquidity risk management policy, demonstrate that the liquidity profile of the
AIFs’ investments is appropriate to the AIFs’ obligations and explain the role played by the stress testing in this assessment.
2.7. Describe the counterparty risk management policy.
2.8. Describe the credit risk management policy.
2.9. Describe the operational risk management policy, detail the significant operational risks
(including the legal risk) to which the AIFs are subject and explain the manner in which they are assessed and managed.
2.10. Describe the valuation policy of assets.
2.11. Describe the policy on the use of leverage.
2.12. Provide the list of AIFs covered by this specific complementary section.
3. Specific complementary section: exercise of discretionary management
Briefly describe the manner in which the IFM providing services of management of portfolios of investments on a discretionary and individual basis in the framework of a mandate given by the investors pursuant to Article 5(4) of the 2013 Law complies with the risk management requirements under MiFID II Regulation.

Circular CSSF 18/698 Page 91/96
ANNEX 2: Summary table of the arrangements for the communication to
the CSSF according to the nature of the change (non-exhaustive list)

Changes subject to prior notification with a view to authorisation by the CSSF (nonexhaustive list):
Amendments to the articles of incorporation (for example, increase and decrease of
statutory capital, change of head office implying a change in the articles of incorporation, etc.);
Change in qualified shareholding and crossing of thresholds;
Changes affecting the conditions for compliance with eligible capital, such as:

subordinated loans;
addition/cessation of a bank guarantee;
acquisition of a professional indemnity insurance and amendments made to the
insurance policy;
capital increase, etc;

Acquisition of holdings/creation of a subsidiary;
Approval of the members of the management body/governing body, the conducting
officers and, where appropriate, of the members of the supervisory board;
Change in the distribution of responsibilities between the conducting officers;
Specific authorisation to exercise wholly or partially UCI administration function
internally;
Specific authorisation to act as UCI administration and to delegate some tasks relating to
the UCI administration function;
Request for an exemption to the permanent presence of the conducting officers in
Luxembourg;
Request for an exemption (if applicable) to the shared staff;
Implementation of a delegation or change in the delegation model of the UCI management
function (for example, change of delegates) or decision to perform internally a function which had been previously delegated;
Designation/change of the external valuer;
Decision to delegate the performance of the internal control function, or change of the
programme of operations in order to perform internally functions which have been previously performed by third parties;
Initial decision of the IFM to invest part of its non-regulatory capital in units of UCIs as,
for example, during the launch of UCIs or share classes of managed UCIs (seeding);
Change of the réviseur d'entreprises agréé (approved statutory auditor);
Application of the principle of proportionality for the organisation of its compliance,
internal audit and risk management functions;
Extension of the investment strategies of AIFs as defined in Annex IV of Delegated
Regulation (EU) 231/2013;
Intention to manage AIFs qualifying as money market funds;
Case of branches:

notification in accordance with the applicable directives (for example, change of
the scope of activities, change of address, change of branch manager, etc.);
change of the conducting officer responsible for the monitoring of the branch’s
activity;

Case of free provision of services: notification in accordance with the applicable
directives.

Circular CSSF 18/698 Page 92/96
2. Changes subject to notification to the CSSF (non-exhaustive list):

Change in the shareholding not subject to authorisation (i.e. new shareholder representing
less than 10% of the shareholding, including indirect shareholders, restructuring of the group, crossing the thresholds for an AIFM, etc.)
Delegation of the performance of the accounting function or IT function;
Resignation of members of the management body/governing body, the conducting
officers and, where appropriate, of the members of the supervisory board;
Delegation of complaint handling;
Substantial change in the programme of operations;
Change in the identity of the following persons:

Compliance Officer;
person responsible for the monitoring of the work of third parties in charge of the
compliance function where the performance of the function is delegated;
person responsible for the internal audit function;
person responsible for the monitoring of the work of the internal auditor where the
performance of the function is delegated;
person responsible for the permanent risk management function;
AML/CFT compliance officer at the management level;
AML/CFT Compliance Officer;
person responsible for the accounting function of the IFM;
person responsible for the accounting administration of UCIs;

Change affecting the consolidated prudential supervision;
Change of the premises (where it is not subject to an amendment in the articles of
incorporation);
Important change in the risk management procedure;
Case of branches: change affecting the organisation of the branch or any substantial
change affecting the number of staff in the branch as well as the nature and volume of activity carried out from the branch;
Application of the principle of proportionality with respect to the remuneration policy.

Circular CSSF 18/698 Page 93/96
3. List of closing documents to be provided yearly, within five months following the end of the
financial year of the IFM at the latest, except for the elements referred to in points 1 and 2 which must be submitted within one month after the ordinary general meeting that approved the annual accounts of the IFM and seven months following the closing date of the financial year of the IFM at the latest:

Audited annual report of the IFM;
Management letter;
Report on the permanent risk management function;
Report containing information giving a true picture of the types of financial instruments
used for each managed UCITS, the underlying risks, the quantitative limits and the methods chosen for assessing the risks associated with transactions in derivative instruments (ManCo);
Report on the compliance function;
Report on the internal audit function;
Report of the AML/CFT compliance officer at the management level;
Handling of complaints: a table including the number of complaints registered by the
professional, classified by type of complaints, as well as a summary report of the complaints and of the measures taken to handle them;
List of third parties authorised to handle complaints;
Risk management procedure;
Organisation chart of the group (if changed);
Summary table of the mandates of the members of the management body/governing body,
the conducting officers and, where appropriate, of the members of the supervisory board;
Annual list of all the delegates of the IFM, including the intermediaries ensuring
marketing with whom the IFM has a direct relationship;
Report on the activity of the branch;
Final calculation of the capital ratio of IFMs authorised to carry out discretionary
management.

Circular CSSF 18/698 Page 94/96
ANNEX 3: Specific information applicable to SIAGs and FIAAGs
FINANCIAL SITUATION AS AT …
(Expressed in the currency of the capital)
Company:
Status: ☐ SICAV ☐ Other
Person in charge:
Frequency: quarterly
ASSETS AMOUNT

Formation expenses
Fixed assets
2.1. Intangible assets
2.2. Tangible assets
2.3. Financial fixed assets
Current assets
3.1. Securities portolio
3.1.1. Shares and other variable-yield transferable securities
3.1.1.1. Shares excluding units of UCIs
3.1.1.2. Shares listed or traded on another regulated market
3.1.1.3. Unlisted shares
3.1.1.4. Other holdings
3.1.1.5. Units of UCIs
3.1.2 Debt securities and other debt instruments
3.1.2.1. Short-term securities (original maturity: not exceeding one year)
3.1.2.2. Medium-/long-term securities (original maturity: exceeding one year)
3.1.3 Money market instruments
3.1.4. Warrants and other rights
Financial instruments
4.1. Option contracts
4.1.1. Call options
4.1.2. Put options
4.2. Futures
4.3. Others
Liquid assets
Other assets
Overall total
(1+2+3+4+5+6)
LIABILITIES AMOUNT
Capital and reserves
Loans
Provisions for liabilities and charges
3.1. Provisions for pensions and similar obligations
3.2. Provisions for taxation
3.3. Other provisions
Debts
Profit for the financial year
Overall total
(1+2+3+4+5)

Circular CSSF 18/698 Page 95/96
PROFIT AND LOSS ACCOUNT AS AT …
(Expressed in the currency of the capital)
Company:
Status: ☐ SICAV ☐ Other
Person in charge:
Frequency: quarterly
AMOUNT
Total income

Dividend
Interest on debt securities and other debt instruments
Bank interest
Other income
a) Commissions received b) Other
Total charges
Commissions
a) Advice and/or management commissions b) Depositary bank commissions c) Other commissions
Administrative expenses
a) Central administration expenses b) Audit and inspection expenses c) Other administrative expenses
Taxes
a) Subscription tax b) Other taxes
Interest paid
Other charges
Net profit or loss on investments
Net realised gains or losses
Change in unrealised gains or losses
Net profit or net loss on operations

Circular CSSF 18/698 Page 96/96
TABLE EMPLOYEES
NUMBER OF EMPLOYEES AS AT 00/01/00
Company: 0
Person in charge: 0
Male Female Total
Luxembourgish Foreign Luxembourgish Foreign Luxembourgish Foreign Conducting officers* 0 0 Employees 0 0 Workers 0 0 Total 0
Part-time staff 0 0
TOTAL
Total number of employees in the self-managed investment company 0 Including the number of people on secondment or made available by a company having its registered office in Luxembourg

Circular CSSF 18/698: Authorization and Organization of Luxembourg Investment Fund Managers and AML/CFT Provisions

Lineage: Superseded

Timeline