Circular CSSF 20/747: Technical arrangements for the central electronic data retrieval system for IBAN accounts and safe-deposit boxes

CIRCULAR CSSF 20/747 1/4 Circular CSSF 20/747 Technical modalities relating to the application of the Law of 25 March 2020 establishing a central electronic data retrieval system related to payment account and bank accounts identified by IBAN and safe-deposit boxes held by credit institutions in Luxembourg (the “Law”)

CIRCULAR CSSF 20/747 2/4 Circular CSSF 20/747 Re: Technical modalities relating to the application of the Law of 25 March 2020 establishing a central electronic data retrieval system related to payment account and bank accounts identified by IBAN and safe-deposit boxes held by credit institutions in Luxembourg (the “Law”) Ladies and Gentlemen, The Law of 25 March 2020 (“the Law”) establishes a central electronic data retrieval system related to payment accounts and bank accounts identified by IBAN and safe-deposit boxes held by credit institutions in Luxembourg. This circular aims at providing the professionals, as defined in point 6 of Article 1 of the Law, with the necessary details in view of setting up and implementing in their IT systems, the technical infrastructure required to allow the central electronic data retrieval system established and managed by the CSSF to operate efficiently between the CSSF and professionals1. The purpose of this circular is more precisely to provide the professionals with an insight into the technical and IT related aspects of the central electronic data retrieval system in order to allow them to adapt their systems accordingly and assure conformity with the particular technical requirements of the system as established by the CSSF. The system is based on creating and making a file available to the CSSF by each of the professionals with regard to payment accounts2, bank accounts identified by IBAN and safe-deposit boxes held by credit institutions, excluding thus accounts held for internal or technical purposes. The CSSF, in its capacity as manager of the central electronic data retrieval system, will access the respective files submitted by the professionals, by means of a secure procedure in order to be able to conduct researches. The circular’s annexes break down the structure of the file and data to be entered, and provide details on the creation, backup, confidentiality and security of said file. Annex 1 describes the technical modalities the professionals are required to strictly follow. 1 The setup of such a system is required by 10 September 2020 at the latest in accordance with the requirements of Article 67(1) of Directive (EU) 2015/849, as amended by Directive (EU) 2018/843. 2 Cf. also the CSSF Q&A of 3 June 2020 on payment account definition, under the following link: https://www.cssf.lu/wp-content/uploads/QA_payment_account_definition.pdf Luxembourg, 23 July 2020 To all credit institutions and payment service providers in Luxembourg offering payment account services or bank account services for accounts identified by IBAN, within the meaning of Regulation (EU) No 260/2012 of the European Parliament and of the Council of 14 March 2012 establishing technical and business requirements for credit transfers and direct debits in euro and amending Regulation (EC) No 924/2009, as well as to any credit institution holding safe-deposit boxes in Luxembourg In case of discrepancies between the French and the English text, the French text shall prevail.

CIRCULAR CSSF 20/747 3/4 Annex 2 describes the structure of the data file to be submitted by the professionals to the CSSF. The CSSF reminds that professionals are responsible for the accuracy and completeness of the data they are required to enter in their files, which the CSSF accesses within the framework of the central electronic data retrieval system. As regards the data which, according to Annex 2, can be optionally registered within the file made available to the CSSF, it is noted that if professionals have these data in their system, they are required to reflect them in the files which the CSSF will access. It should be pointed out that the obligation to create a data file applies to payment accounts and bank accounts identified by IBAN, within the meaning of Regulation (EU) No 260/2012, which exist at the date of entry into force of the Law of 25 March 2020, i.e. on 26 March 2020, or which are closed since that date, as well as the accounts that were opened after that date. It should also be noted that this obligation concerns safe-deposit boxes leased on 26 March 2020, or closed since that date, as well as safe-deposit boxes leased out after that date. For all payment accounts and bank accounts identified by IBAN as well as all safe-deposit box closed after 26 March 2020, the retention periods laid down in Article 3(6) of the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended, shall apply. Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General

CIRCULAR CSSF 20/747 4 / 4 Commission de Surveillance du Secteur Financier 283, route d’Arlon L-2991 Luxembourg (+352) 26 25 1

1 direction@cssf.lu www.cssf.lu