Circular CSSF 22/821: Practical rules for the Long Form Report and statutory auditor self-assessment

Circular CSSF 22/821 as amended by Circulars CSSF 23/845, 24/865 and 25/897 Long Form Report Practical rules concerning the self-assessment questionnaire to be submitted by institutions. Mission and related reports of the approved statutory auditors (réviseurs d’entreprises agréés).

CIRCULAR CSSF 22/821 as amended by Circulars CSSF 23/845, 24/865 and 25/897 2/9 Circular CSSF 22/821 as amended by Circulars CSSF 23/845, 24/865 and 25/897 Long Form Report Practical rules concerning the self-assessment questionnaire to be submitted by institutions. Mission and related reports of the approved statutory auditors (réviseurs d’entreprises agréés). To all Luxembourg credit institutions and Luxembourg branches of non-EU credit institutions Luxembourg, 25 October 2022 Ladies and Gentlemen, Circular 22/821 published on 25 October 2022 introduced a revised version of the long form report following on from the regulatory developments and the evolving supervisory practices since 2001. The revision of the long form report as contemplated under Circular CSSF 01/27 was the result of a thorough reconsideration of its objective, scope and content in order to realign it with supervisory and prudential points of focus as well as to suppress redundancies between existing reporting requirements. The circular introduced a self-assessment questionnaire to be filled in on an annual basis by the institutions. It also introduced Agreed Upon Procedure report(s) and an annual separate report on the protection of financial instruments and funds belonging to clients as required under Article 7 of the Grand-ducal Regulation of 30 May 2018 to be established by the réviseurs d’entreprises agréés (REA) of the institutions. The self-assessment questionnaire and the Agreed Upon Procedure report(s) did not include matters relating to anti-money laundering and countering the financing of terrorism (AML/CFT) that have to be covered by the REA in its annual, separate report further to CSSF Regulation No 12-02. Following the revision of Circular 22/821 as amended by Circular CSSF 23/845, no more Agreed Upon Procedure reports are foreseen. As a result, the REA would only have to provide the annual separate report on the protection of financial instruments and funds belonging to clients as required under Article 7 of the Grand-ducal Regulation of 30 May 2018 as well as the annual separate AML/CFT report further to CSSF Regulation No 12-02.

CIRCULAR CSSF 22/821 as amended by Circulars CSSF 23/845, 24/865 and 25/897 3/9
TABLE OF CONTENTS

1. Scope of application and legal basis ................................................................................. 4
2. The self-assessment questionnaire .................................................................................. 4
3. The mission of the REA .................................................................................................. 5
   3.1. The report on the protection of financial instruments and funds belonging to clients......... 5
   3.2. The AML/CFT report ................................................................................................. 6
4. Submission procedures .................................................................................................. 8
   4.1. Self-assessment questionnaire .................................................................................. 8
   4.2. Reports prepared by the REA..................................................................................... 8
   4.3. Practical rules.......................................................................................................... 9
5. Final provisions ............................................................................................................. 9

CIRCULAR CSSF 22/821 as amended by Circulars CSSF 23/845, 24/865 and 25/897 4/9

1. Scope of application and legal basis
   The provisions of this circular are applicable to credit institutions1 incorporated under Luxembourg law, including their branches, as well as Luxembourg branches of third-country credit institutions (institution). This circular does not apply to Luxembourg branches of EU credit institutions. The framework for the revised long form report consists of three parts:

• a self-assessment questionnaire to be completed by institutions;
• a separate report to be prepared by the REA on the protection of financial instruments and
  funds belonging to clients;
• a separate report to be prepared by the REA on the procedures set up by institutions
  concerning the prevention of money laundering and terrorist financing (AML/CFT report). The self-assessment questionnaire introduced by this circular is based on the following powers of the CSSF to obtain information from institutions in the context of its legal supervisory mandate:
• Article 53(1), points (2) and (8), of the Law of 5 April 1993 on the financial sector, as
  amended;
• Article 45(2) of the Law of 30 May 2018 on markets in financial instruments, as amended;
• Article 58-5 of the Law of 10 November 2009 on payment services, on the activity of
  electronic money institution and settlement finality in payment and securities settlement systems, as amended;
• Article 147(2) of the Law of 17 December 2010 relating to undertakings for collective
  investment, as amended and Article 50(2) of the Law of 12 July 2013 on alternative investment fund managers, as amended;
• Article 62(1) of the Law of 13 July 2005 on institutions for occupational retirement provision
  in the form of pension savings companies with variable capital (SEPCAVs) and pension savings associations (ASSEPs), as amended. The separate report prepared by the REA on the protection of financial instruments and funds belonging to clients is required under Article 7 of the Grand-ducal Regulation of 30 May 2018.2 The separate report prepared by the REA on AML/CFT is based on the application of Articles 49(2) and (3) of CSSF Regulation No 12-02 of 14 December 2012 (RCSSF 12-02).3

2. The self-assessment questionnaire
   The self-assessment questionnaire covers domains in scope of the prudential supervision for which the CSSF or the European Central Bank are competent. Please note however that the modules of the self-assessment questionnaire covering matters relating to the Market in Financial Instruments 1 This circular applies to both significant supervised entities and less significant supervised entities as defined in Article 2, points (16) and (7) of Regulation (EU) No 468/2014 of the European Central Bank (ECB) of 16 April 2014, as amended (the SSM Framework Regulation) respectively. 2 Grand-ducal Regulation of 30 May 2018 on the protection of financial instruments and funds belonging to clients, product governance obligations and the rules applicable to the provision or reception of fees, commissions or any monetary or non-monetary benefits, as amended. 3 CSSF Regulation No 12-02 of 14 December 2012 on the fight against money laundering and terrorist financing, as amended.

CIRCULAR CSSF 22/821 as amended by Circulars CSSF 23/845, 24/865 and 25/897 5/9 Directive (MiFID), the Payment Services Directive (PSD 2) and undertaking for collective investments (UCI) depositaries and the European Market Infrastructure Regulation (EMIR) are under the exclusive competence of the CSSF. All parts of the self-assessment questionnaire have been designed in a proportionate way and target in-scope institutions with a view to allowing the CSSF to gather sufficient information to implement risk-based approaches to supervision and to obtain information and assurances as regards in-scope institutions’ compliance with key regulatory provisions the control of which falls within the competent authorities’ legal mandate. The information communicated as part of the self-assessment questionnaire shall be accurate and as concise as possible, while providing a true and fair view, and be based on the prudential reporting figures (FINREP/COREP/LAREX) under IFRS as at the closure of the financial year.4 The self-assessment questionnaire is available in digital form as described in section 4.1. Its content is adapted on a yearly basis as required, including in response to developments of the legal and regulatory framework. The individual modules of the self-assessment questionnaire and their level of application as well as the applicable exemptions are directly recorded in the CSSF’s digital solution and are also reflected on the CSSF website (www.cssf.lu/en/prudential-reporting-credit-institutions).
3. The mission of the REA
3.1. The report on the protection of financial instruments and
funds belonging to clients
If applicable, institutions are required to mandate their REA to prepare, on an annual basis, a separate report on the protection of financial instruments and funds belonging to clients. This report shall cover the adequacy of the arrangements under Article 37-1(7) and (8) of the Law of 5 April 1993 on the financial sector, as amended, Article 13(4) of the Law of 5 August 2005 on financial collateral arrangements, as amended, and Section 2 of the Grand-ducal Regulation of 30 May 2018. The authorised management of the institution is responsible for providing the REA with the required information for the drafting of the descriptive parts of the report. The REA may include in its report descriptive elements directly provided by the institution’s authorised management, but s/he shall verify and ensure that these elements are correct and adequate. If needed, s/he may have to perform some amendments. The purpose of this separate report, which must be uploaded through a CSSF digital solution, is notably to ensure the reliability of the answers provided by an institution in the self-assessment questionnaire in relation to the protection of financial instruments and funds belonging to clients. However, this does not preclude the REA to perform further assessments beyond those set forth in the self-assessment questionnaire. 4 For institutions for which the date of the closure of the financial year is not aligned with the remittance date of the prudential reporting, the questionnaire should be based on the last prudential reporting submitted before the closure of the financial year.

CIRCULAR CSSF 22/821 as amended by Circulars CSSF 23/845, 24/865 and 25/897 6/9
3.2. The AML/CFT report
Institutions are also required to mandate their REA to prepare, on an annual basis, a separate report covering AML/CFT further to RCSSF 12-02. The AML/CFT report describes the procedures set up by the institution concerning the prevention of money laundering and terrorist financing as required for compliance with or as defined in:

• Chapter 5 of Part II of the Law of 5 April 1993 on the financial sector, as amended;
• the Law of 12 November 2004 on the fight against money laundering and terrorist
  financing, as amended;
• the Grand-ducal Regulation of 1 February 2010 providing details on certain provisions of
  the amended Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended;
• Regulation (EU) 2015/847 of the European Parliament and of the Council of 20 May 2015
  on information accompanying transfers of funds, as amended;
• international acts on the fight against terrorist financing brought to the attention of the
  institutions through CSSF circulars;
• CSSF regulations on the fight against money laundering and terrorist financing;
• CSSF circulars with regard to AML/CFT.
  The AML/CFT report shall provide, in particular:
• the description of the AML/CFT policy set up by the institution in order to prevent money
  laundering and terrorist financing, the verification of its compliance with the provisions of Part II, Chapter 5 of the Law of 5 April 1993 on the financial sector, as amended, the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended, the Grand-ducal Regulation of 1 February 2010, as amended, Regulation (EU) 2015/847, as amended, CSSF regulations and CSSF circulars relating to AML/CFT and the control of their sound application;
• the assessment of the institution's analysis of money laundering and terrorist financing
  risks to which it is exposed. The REA must verify if the implemented procedures, infrastructures and controls, as well as the scope of the AML/CFT measures are appropriate considering the ML/FT risks to which the institution is exposed, particularly through its activities, the nature of its customers and the provided products and services;
• a declaration on whether an audit of compliance with the institution's AML/CFT policy has
  been performed by the internal audit function and the compliance officer in charge of the control of compliance with the professional obligations5;
• a short description of the training and awareness-raising measures for employees as
  regards money laundering and terrorist financing, and, in particular, with respect to the identification of money laundering and terrorist financing transactions;
• statistics concerning the detected suspicious transactions which indicate the number of
  suspicious transaction cases reported to the FIU by the institution, as well as the total amount of funds involved during the financial year;
• the control of the application of the provisions of Regulation (EU) 2015/847, as amended
  by the institution, in its respective role, and the percentage of transfers of funds for which data on the payer or payee were missing or incomplete and the measures taken in this context by the institution. The AML/CFT report shall also provide:
  5 As defined in Article 1(1) of RCSSF 12-02.

CIRCULAR CSSF 22/821 as amended by Circulars CSSF 23/845, 24/865 and 25/897 7/9

• a description of roles and responsibilities with regard to AML/CFT within the institution,
  including the roles and responsibilities of and the interactions between the management and the different departments and services, indicating the corresponding number of staff involved on AML/CFT matters. The AML/CFT report shall also include a description of the committees and the corresponding hierarchical and functional structures by indicating the general and particular delegations of power with respect to AML/CFT. It shall also provide a description by the institution and an assessment by the REA of the three-lines-of￾defence model, as defined in Article 39(7) of the RCSSF 12-02;
• the list of persons involved in AML/CFT matters, as referred to in the RCSSF 12-02 and
  Circular CSSF 12/552, as amended (compliance officer, person responsible for compliance, Chief Compliance Officer, etc.). It shall also state all the changes with regard to these persons which occurred during the financial year. Since these persons may delegate to members of staff certain operational tasks in relation to these functions, the AML/CFT report shall provide, where appropriate, a description of the delegation mechanism;
• a description of the network of national agencies, national and foreign subsidiaries, the
  branches abroad, the foreign representative offices and the tied agents, as well as the main related ML/FT risks. The AML/CFT report shall also indicate if the institution uses the services of external managers as regards the clients' assets and shall, where appropriate, provide a description of the manner in which the relationships with external managers are managed and documented from an AML/CFT perspective;
• a description of the institution’s commercial policy as well as the strategy regarding the
  management of the related ML/FT risks. It shall also include a description of how the institution monitors and ensures compliance with its internal objectives with regard to ML/FT risks management. The REA shall assess if the institution has sufficient financial resources and the appropriate infrastructure to control ML/FT risks to which it is exposed. The REA shall state how the sample of reviewed files was selected. When determining the sample, the CSSF expects the REA to apply a risk-based approach, taking into account the different business activities performed. The REA shall state the reference date of the sample data and provide relevant information on the methodology adopted for determining the sample (for example, the number of files reviewed compared to the total number of clients or the volume of deposits reviewed compared to the total volume of deposits). Where the REA identifies cases of non-compliance with the legal or regulatory provisions or deficiencies, the REA shall give detailed indications enabling the CSSF to assess the situation (number of pending incomplete files as a percentage of the total number of reviewed files, details of the deficiencies identified, etc.). Where applicable, the AML/CFT report must encompass the institution's branches, majority-owned subsidiaries abroad and the tied agents. It must cover, in particular, the branches', majority-owned subsidiaries' and the tied agents’ compliance with the applicable provisions as regards the prevention of money laundering and terrorist financing and it must include, in that respect:
• an analysis of money laundering and terrorist financing risks incurred by the branches,
  majority-owned subsidiaries and the tied agents;
• a description and assessment of the money laundering and terrorist financing risk
  management in the branches, majority-owned subsidiaries and the tied agents;
• the verification of the implementation of and compliance with the institution's AML/CFT
  policy in the branches, majority-owned subsidiaries and the tied agents.
  The AML/CFT report must be sufficiently exhaustive and transparent, providing detailed descriptions and assessments, in order to allow a precise and informed judgement on the risks incurred by the

CIRCULAR CSSF 22/821 as amended by Circulars CSSF 23/845, 24/865 and 25/897 8/9 institution with respect to money laundering and terrorist financing. With regard to the language used for the assessments, the AML/CFT report shall not include imprecise negative formulations (e.g. “We did not encounter serious weaknesses”) or global and approximative assessments (e.g. “We noted that most of the points comply with the laws and regulations”). The AML/CFT report shall rather provide a positive assessment for each area and subject by providing an overview of the methodology adopted (e.g. use of the sample technique, method for selecting the sample, etc.) and, where applicable, provide a description of the identified findings in order to allow the CSSF to better understand and judge the extent of the noticed irregularities and weaknesses. The REA shall also perform the follow-up of findings observed during the previous audits and described in detail in the previous AML/CFT report. The REA shall provide a description of any potential issues in relation to AML/CFT the institution may have with foreign competent authorities. The authorised management of the institution is responsible for providing the REA with the required information for the drafting of the descriptive parts of the AML/CFT report. The REA may include in its report descriptive elements directly provided by the institution’s authorised management, but s/he shall verify and ensure that these elements are correct and adequate. If needed, s/he may have to perform some amendments. In addition to the descriptive parts, the REA shall perform independently a detailed assessment of the ML/FT risks to which the institution is exposed as well as organisational aspects. This assessment shall be duly documented. It should be noted that the REA shall also inform the CSSF of all the suspicious transactions reported pursuant to Article 5 of the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended, and which concern the institutions. Similarly, the REA must inform the CSSF in case they deem that the institution should have reported a suspicious transaction but has not, explaining their reasoning and having regard to the institution’s rationale. When discussing the cases with the institution, the REA need to be mindful of applicable professional obligations.
4. Submission procedures
4.1. Self-assessment questionnaire
The self-assessment questionnaire will be accessible through a CSSF digital solution for each institution within three months before the closure of the institution’s financial year. The self-assessment questionnaire must be reviewed and electronically signed by the authorised management before submitting it to the CSSF. The self-assessment questionnaire must be transmitted on an annual basis to the CSSF in an electronic form via a CSSF digital solution within three months after the closure of the financial year, in accordance with the procedure described in section 4.3.
4.2. Reports prepared by the REA
The separate report on the protection of financial instruments and funds belonging to clients and the AML/CFT report shall include the digital signature of the partner in charge of the mandate with the

CIRCULAR CSSF 22/821 as amended by Circulars CSSF 23/845, 24/865 and 25/897 9/9 audit firm s/he represents. The REA submits the reports to the institution, which submits them subsequently to the CSSF. The reports prepared by the REA must be transmitted by the institution to the CSSF in electronic form via a CSSF digital solution within five months after the closure of the financial year, in accordance with the procedure described in section 4.3.
4.3. Practical rules
Procedures and explanations on the practical modalities regarding the preparation and transmission of the self-assessment questionnaire, the separate report on the protection of financial instruments and funds belonging to clients and the AML/CFT report are made available to institutions and their REA, on the website of the CSSF under the following link: https://edesk.apps.cssf.lu/edesk￾dashboard/api/v1/documentation/LFRB_GU/en. A user guide “Authentication and user account management” is available to institutions via the eDesk portal of the CSSF.
5. Final provisions
Circular CSSF 22/821, as published on 25 October 2022, repealed Circular CSSF 01/27, as amended by Circulars CSSF 08/340, CSSF 10/484, CSSF 11/521 and CSSF 21/765, as well as Circular IML 96/125. It applied from 31 December 2022. The current revised version shall apply as from 31 December 2025. Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General