Circular CSSF 23/839 — Update of Circular CSSF 21/789

CIRCULAR CSSF 23/839 1/10 Circular CSSF 23/839 Update of Circular CSSF 21/789

In case of discrepancies between the French and the English texts, the French text shall prevail. CIRCULAR CSSF 23/839 2/10 Circular CSSF 23/839 Update of Circular CSSF 21/789 To all Investment Fund Managers governed by Luxembourg Law and to those involved in the operation and control of these entities Luxembourg, 26 July 2023 Ladies and Gentlemen,

1. This circular amends Circular CSSF 21/789 by specifying the following: a. the scope of application of the circular for management companies subject to Article 125- 1 of Chapter 16 of the UCI Law b. the repeal of Circulars CSSF 18/698 and 19/708 as regards the procedures for the transmission of the management letter
2. Circular CSSF 21/789 is amended in accordance with the annex to this circular which includes the amendments brought to Circular CSSF 21/789 in tracked changes in order to facilitate reading and understanding. Yours faithfully, Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General Annex: Circular CSSF 21/789 as amended by Circular CSSF 23/839

CIRCULAR CSSF 23/839 3/10 Circular CSSF 21/789 as amended by Circular CSSF 23/839 Practical rules concerning the self-assessment questionnaire to be submitted annually by investment fund managers. Engagement of the réviseurs d'entreprises agréés (approved statutory auditors) of investment fund managers and practical rules concerning the management letter and the separate report to be drawn up annually To all authorised investment fund managers incorporated under Luxembourg law and to those involved in the operation and audit of such entities Luxembourg, 26 July 2023 Ladies and Gentlemen, The purpose of this circular is to define the practical rules concerning the preparation and annual submission of the below-mentioned documents by investment fund managers (“IFMs”) and their réviseurs d'entreprises agréés (approved statutory auditors, “REA”). More specifically, this circular introduces, on the one hand, a self-assessment questionnaire to be completed on an annual basis by IFMs (“self-assessment questionnaire”). and details the information to be spontaneously transmitted by IFMs to the CSSF in case the REA issues a modified audit opinion in the context of the statutory audit of accounting data included in the annual report of an IFM (“statutory audit”). On the other hand, this circular broadly details the role and engagement of a REA in the context of the statutory audit of IFMs. Moreover, it establishes a specific regulatory framework applicable to the management letter, and also introduces a separate report (“separate report”). Both documents must be drawn up by the IFMs’ REAs on an annual basis. The separate report includes specific procedures that the CSSF requests the REA to perform in relation to the IFM’s self-assessment questionnaire.

CIRCULAR CSSF 23/839 4/10 TABLE OF CONTENTS

1. Scope and legal basis..................................................................................................... 5
2. Background and purpose of this circular ........................................................................... 6
3. Rules applicable to IFMs: The self-assessment questionnaire to be submitted annually by IFMs and the practical rules associated with it................................................................................ 6
4. Practical rules concerning the engagement of REAs for IFMs ............................................... 7 4.1. The statutory audit of an IFM .................................................................................... 7 4.2. The management letter ............................................................................................ 7 4.3. The separate report ................................................................................................. 9
5. Procedures for the preparation and filing of the self-assessment questionnaire, the separate report and the management letter ........................................................................................ 9
6. Entry into force ........................................................................................................... 10

CIRCULAR CSSF 23/839 5/10

1. Scope and legal basis This circular applies to the following IFMs:

• management companies subject to Chapter 15 of the Law of 17 December 2010 relating to undertakings for collective investment, as amended, (“UCI Law”);
• management companies subject to Chapter 15 of the UCI Law and that are also registered alternative investment fund managers;
• management companies subject to Chapter 15 of the UCI Law and that are also authorised alternative investment fund managers subject to the Law of 12 July 2013 on alternative investment fund managers, as amended (“AIFM Law”);
• authorised alternative investment fund managers subject to the AIFM Law;
• management companies subject to Article 125-2 of Chapter 16 of the UCI Law and that are also authorised alternative investment fund managers subject to the AIFM Law;
• alternative investment funds that did not appoint an external AIFM within the meaning of point (b) of Article 4(1) of the AIFM Law (“FIAAGs”);
• SICAVs that did not designate a management company under Article 27(1) of the UCI Law (“SIAGs”);
• Luxembourg branches of IFMs subject to Chapter 17 of the UCI Law; and
• foreign branches of Luxembourg IFMs. The provisions of this circular do not apply to:
• management companies subject to Article 125-1 of Chapter 16 of the UCI Law (except for points 4.1. and 4.2. of this circular regarding the statutory audit of an IFM and the management letter, respectively);
• management companies referred to in Chapter 18 of the UCI Law; and
• the entities referred to in Article 3 of the AIFM Law and not included in the above definitions of IFMs. The requirements introduced by this circular are notably based on the following legal provisions:
• The self-assessment questionnaire as well as the requirement to spontaneously transmit information to the CSSF where the REA issues a modified audit opinion in the context of the statutory audit, as specified in Section 3 of this circular, are is introduced pursuant to Article 147(2) of the UCI Law and Article 50 of the AIFM Law, which allow the CSSF to require, as part of its supervisory mission, the provision of information from IFMs falling within the scope of this circular.
• The definition of the specific regulatory framework applicable to the management letter to be drawn up by the REA, as specified in Section 4.2 of this circular, results from Article 104(4) of the UCI Law and Article 7a of the AIFM Law, which allow the CSSF to set rules on the scope of the mandate for the audit of the annual accounting documents of the IFMs falling within the scope of this circular and on the content of the reports and written comments issued by the REA.
• The separate report to be drawn up by the REA, as specified in Section 4.3 of this circular, is introduced pursuant to Article 147(2) of the UCI Law and Article 50 of the AIFM Law, which allow the CSSF to instruct a REA to carry out audits on one or several aspects of the activity and operation of the IFMs falling within the scope of this circular. • Please note that this circular repeals Circulars CSSF 18/698 and 19/708 as regards the procedures for the transmission of the management letter.

CIRCULAR CSSF 23/839 6/10 2. Background and purpose of this circular Over the past few years, IFMs were subjected to a strengthening of the legal, regulatory and prudential provisions applicable to them. These provisions thus reinforced the IFMs’ need for, inter alia, financial soundness, governance, substance, organisation, internal control and supervision of delegates. In this context, the implementation of new prudential supervisory tools at the level of IFMs was deemed useful by the CSSF. The purpose of this circular is thus to detail these new prudential supervisory tools. 3. Rules applicable to IFMs: The self-assessment questionnaire to be submitted annually by IFMs and the practical rules associated with it This circular introduces, pursuant to Article 147(2) of the UCI Law and Article 50 of the AIFM Law, a new self-assessment questionnaire to be completed by IFMs for each year or period in respect of which a statutory audit is carried out in accordance with Article 104(1) or 154(1) of the UCI Law and Article 7a of the AIFM Law. The self-assessment questionnaire is available to IFMs via the eDesk Portal (https://edesk.apps.cssf.lu). The self-assessment questionnaire includes questions on predefined topics that are customised according to the type of authorisation held by the IFM. Its main purpose is to request IFMs to perform a self-assessment of their compliance with the legal and regulatory requirements. Depending on the developments of the legal and regulatory requirements applicable to IFMs as well as on the prudential supervision requirements, the self-assessment questionnaire may be adapted over the coming years. The fight against money laundering and terrorist financing, which has been addressed, among others, in Circular CSSF 21/788, is not covered in this self-assessment questionnaire. The management body, within the meaning of Article 1(26a) of the UCI Law and/or the governing body, within the meaning of Article 1 of Commission Delegated Regulation (EU) No 231/2013 of 19 December 2012 supplementing Directive 2011/61/EU of the European Parliament and of the Council with regard to exemptions, general operating conditions, depositaries, leverage, transparency and supervision (“Delegated Regulation 231/2013”), as well as the senior management as defined in Part I “Definitions and abbreviations” of Circular CSSF 18/698, are responsible for the content of the self-assessment questionnaire. For the purpose of filling out the self-assessment questionnaire, the above-mentioned responsible persons (“responsible persons”) shall put in place adequate organisational processes within the IFM to allow the retrieval of any information needed to provide answers to different questions. Before submitting the self-assessment questionnaire to the CSSF, the responsible persons of the IFM must review and validate its content. Upon validation by the responsible persons of the IFM, the self-assessment questionnaire must be submitted to the CSSF within four months after the end of the IFM’s financial year. However, for the first year of application, as specified in Section 6 of this circular, the IFM benefits from an exceptional time frame of six months after the end of its financial year to provide the CSSF with the self￾assessment questionnaire.

CIRCULAR CSSF 23/839 7/10 The self-assessment questionnaire must be submitted on an annual basis, in accordance with the above-mentioned time frame. In case of withdrawal/deregistration of the IFM from the official list(s) held by the CSSF during the year, the self-assessment questionnaire covering the period from its last year-end to the date of withdrawal/deregistration will be required, in principle, within the same time frame of four months. The above-mentioned submission deadlines may be reviewed by the CSSF over the coming years. 4. Practical rules concerning the engagement of REAs for IFMs IFMs must entrust the statutory audit to a REA on an annual basis, in accordance with Article 104(1) or 154(1) of the UCI Law and Article 7a of the AIFM Law. In this context, this circular defines, pursuant to Article 104 or 154(3) of the UCI Law and Article 7a of the AIFM Law, a specific regulatory framework applicable to the management letter that the REA will have to draw up to the attention of the responsible persons of the IFM and the CSSF. Moreover, in accordance with these same articles, this circular introduces a separate report to be drawn up annually by the REA in relation to the IFMs’ self-assessment questionnaire, in compliance with the details provided in Section 4.3. below. In accordance with Article 32(2) of the Law of 23 July 2016 concerning the audit profession, the audited entity and the REA, the cabinet de révision agréé (approved audit firm) or the audit firm must inform the CSSF of the dismissal or resignation of the REA, the cabinet de révision agréé (approved audit firm) or the audit firm during the term of appointment and provide an adequate explanation of the reasons therefor. The CSSF will analyse for each request to change the cabinet de révision agréé (approved audit firm) the reasons for the envisaged change and will assess whether, when selecting a new cabinet de révision agréé (approved audit firm), the IFM has carefully assessed the adequacy of the competences and resources of the new cabinet de révision agréé (approved audit firm) considering the type and volume of the IFM’s activities. 4.1. The statutory audit of an IFM Pursuant to Article 33 of the Law of 23 July 2016 concerning the audit profession, the statutory audit of an IFM must be performed in compliance with the international auditing standards as adopted by the European Commission and the standards issued by the CSSF. On this basis, the REA must present the results of the statutory audit in an audit report which includes its audit opinion. 4.2. The management letter This circular introduces a specific regulatory framework for the management letter that REAs must draw up, for each year or period subject to a statutory audit, to the attention of the IFM’s responsible persons. The management letter is available to REAs via the eDesk Portal (https://edesk.apps.cssf.lu).

CIRCULAR CSSF 23/839 8/10 Once drawn up by the REAs, the IFM’s responsible persons must submit the management letter to the CSSF via the eDesk Portal. In the context of the management letter, the REA is not required to carry out any further procedures other than those already performed during the statutory audit of the accounting documents included in the annual report and any other legal or regulatory duties concerning IFMs for the same financial year. Among the weaknesses identified or points needing improvement having been brought to the attention of the IFM’s responsible persons, the REA determines, according to his/her professional judgement, the items whose importance requires that they have to be reported in the management letter. The management letter must take into account, at least, the following findings:

• an important weakness or a point needing improvement communicated to whom it concerns in accordance with: o ISA 260 “Communication with those charged with governance”; o ISA 265 “Communicating deficiencies in internal control to those charged with governance and management”;
• any other weakness or point needing improvement which, based on the professional judgement of the REA, is of sufficient importance to be brought to the attention of the IFM’s responsible persons or the CSSF. The management letter must also include the follow-up of the weaknesses or points needing improvement raised in the management letters issued in preceding financial years and that have not been “closed” in the previous management letter. The weakness or point needing improvement is considered as “closed” where the necessary corrective measures have been taken to remedy this weakness or point needing improvement and where the responsible persons of the IFM have put in place appropriate measures to prevent their recurrence. Moreover, every weakness or point needing improvement must be accompanied by the comments of the IFM’s responsible persons, which must mandatorily include, among others, the following information:
• a detailed explanation of the reasons and circumstances related to the occurrence of the weakness or point needing improvement raised by the REA;
• a detailed explanation of the measures taken or decided in order to remedy the weakness or point needing improvement and to prevent their recurrence in the future. These measures must be accompanied by a detailed remediation plan and a related timetable. If the IFM’s responsible persons do not remedy the weaknesses or points needing improvement raised by the REA in the management letter in a timely manner and within a reasonable time frame, the REA will issue this management letter specifying that no comments have been received by the IFM’s responsible persons on the weaknesses or points raised. Where the REA did not identify any issue to be included in the management letter, the REA will still have to validate the form “management letter” via the eDesk Portal, specifying that no issue has been raised by using the specific field provided for that purpose in the form (i.e. “No comment ML”). The management letter must then be submitted to the CSSF by the IFM’s responsible persons within seven months after the end of the IFM’s financial year, at the latest.

CIRCULAR CSSF 23/839 9/10 4.3. The separate report This circular introduces a new separate report to be completed by the IFMs’ REAs, for each year or period for which a self-assessment questionnaire has been submitted by the IFM. The purpose of this new separate report, which must be filled in via the eDesk Portal under https://edesk.apps.cssf.lu, is notably to ensure the reliability of the answers provided by the IFM in the self-assessment questionnaire and to provide answers to a set of questions determined by the CSSF. The drawing-up of a separate report consists of a set of procedures defined by the CSSF to be implemented by the REA, broken down into predefined topics. These procedures are directly indicated in the separate report. Depending on the developments of the legal and regulatory requirements applicable to IFMs as well as on the prudential supervision requirements, the procedures to be implemented by the REA may be adapted over the coming years following any amendments to the self-assessment questionnaire. The results of these procedures are documented in the separate report in the form of answers to a set of mainly closed-ended questions and they do not entail an opinion in accordance with auditing, insurance or any related services standards. Any comments by the REA in the empty text fields of this report must be concise, clear and meet the objectives and provide answers to the questions asked. The separate report must be submitted by the IFM’s responsible persons within seven months after the end of the IFM’s financial year, at the latest. For the first year of application, as indicated in Section 6 of this circular, the REA IFM’s responsible persons will be granted an exceptional time frame of nine months after the end of the IFM’s financial year to submit the separate report to the CSSF. In case of withdrawal/deregistration of the IFM from the official list(s) held by the CSSF during the year, the separate report covering the period from its last year-end to the date of withdrawal/deregistration will be required, in principle, within the same time frame of seven months. The above-mentioned submission deadlines may be reviewed by the CSSF for the following years. 5. Procedures for the preparation and filing of the self￾assessment questionnaire, the separate report and the management letter The procedures and explanations on the practical arrangements for the preparation and filing of the self-assessment questionnaire, the separate report and the management letter will be made available to the IFM and its REA on the eDesk Portal (https://edesk.apps.cssf.lu) under the heading “Investment funds and vehicles / Investment fund managers”. The requirements relating to the procedures and requests to the CSSF via the eDesk Portal are detailed in Circular CSSF 19/721. The “Authentication and user account management” user guide is available to IFMs and REAs on the eDesk Portal of the CSSF.

CIRCULAR CSSF 23/839 10/10 6. Entry into force The instructions laid down in this circular must be complied with in their entirety for the financial years ending on or after 31 December 2021 (first year of application). All financial years closing as from that date will thus fall within the scope of this circular. Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General Commission de Surveillance du Secteur Financier 283, route d’Arlon L-2991 Luxembourg (+352) 26 25 1-1 direction@cssf.lu www.cssf.lu