Circular CSSF 23/845 — Update of Circular CSSF 22/821 on the long form report and Circular CSSF 22/826 on the statutory audit mandate

CIRCULAR CSSF 23/845 1/21 Circular CSSF 23/845 Update of Circular CSSF 22/821 on the Long Form Report and of Circular CSSF 22/826 on practical rules concerning the statutory audit mandate of the approved statutory auditors

CIRCULAR CSSF 23/845 2/21 Circular CSSF 23/845 Update of Circular CSSF 22/821 on the Long Form Report and of Circular CSSF 22/826 on practical rules concerning the statutory audit mandate of the approved statutory auditors To all Luxembourg credit institutions and Luxembourg branches of non-EU credit institutions Luxembourg, 15 November 2023 Ladies and Gentlemen, The purpose of this circular is to amend Circular CSSF 22/821 on the long form report (LFR) with the aim to include clarifications based on the feedback from the industry and to further align the content of the self-assessment questionnaire (SAQ) with supervisory points of focus. As a result, the following 5 thematic sections have been included in the revised SAQ: a. credit and counterparty risk; b. interest rate risk in the banking book (IRRBB) and credit spread risk arising from non-trading book activities (CSRBB); c. liquidity risk; d. strong customer authentication and secure communication following the Payment Services Directive (PSD 2); e. climate-related and environmental risks. This circular also introduces changes in relation to the reports to be established by the réviseurs d’entreprises agréés (approved statutory auditors or “REA”). Whereas both the report on the protection of financial instruments and funds belonging to clients and the report on anti-money laundering and countering the financing of terrorism (AML/CFT) remain, it is no longer foreseen that Agreed Upon Procedure (AUP) reports are required from all banks on a recurring basis. While the CSSF might request such AUPs in the future on an ad hoc basis, no such AUPs are to be submitted with respect to financial year-end 2023 information. The purpose of this circular is also to amend Circular CSSF 22/826 on the practical rules concerning the statutory audit mandate of the REA. In particular, the submission deadline for the management letter is adapted in order to ensure a better alignment with the submission deadline foreseen for the reports to be established by the REA pursuant to Circular CSSF 22/821 on the Long Form Report, as amended. Please refer to Annex I for the details of the amendments to Circular CSSF 22/821 and to Annex II for the details of the amendments to Circular CSSF 22/826. Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General Annex I: Circular CSSF 22/821, as amended by Circular CSSF 23/845 Annex II: Circular CSSF 22/826, as amended by Circular CSSF 23/845

CIRCULAR CSSF 23/845 3/21 Annex I: Circular CSSF 22/821 as amended by Circular CSSF 23/845 Long Form Report Practical rules concerning the self-assessment questionnaire to be submitted by institutions. Mission and related reports of the approved statutory auditors (réviseurs d’entreprises agréés). To all Luxembourg credit institutions and Luxembourg branches of non-EU credit institutions Luxembourg, 25 October 2022 Ladies and Gentlemen, Circular 22/821 published on 25 October 2022 The purpose of this circular is to introduced a revised version of the long form report following on from the regulatory developments and the evolving supervisory practices since 2001. The revision of the long form report as contemplated under Circular CSSF 01/27 is was the result of a thorough reconsideration of its objective, scope and content in order to realign it with supervisory and prudential points of focus as well as to suppress redundancies between existing reportsing requirementss. Theis circular introduceds the a self-assessment questionnaire to be filled in on an annual basis by the institutions. It also introduceds the Agreed Upon Procedure report(s) and the an annual separate report on the protection of financial instruments and funds belonging to clients as required under Article 7 of the Grand-ducal Regulation of 30 May 2018 to be established by the réviseurs d’entreprises agréés (REA) of the institutions. The self-assessment questionnaire and the Agreed Upon Procedure report(s) do did not cover include matters relating to anti-money laundering and countering the financing of terrorism (AML/CFT) that have to be covered by. In this regard, it is expected that the REA in its annual, provides, on an annual basis, a separate and additional report covering AML/CFT further to CSSF Regulation No 12-02. Under the current revised version of Circular CSSF 22/821, no Agreed Upon Procedure reports are foreseen. As a result, the REA would only have to provide the annual separate report on the protection of financial instruments and funds belonging to clients as required under Article 7 of the Grand-ducal Regulation of 30 May 2018 as well as the annual separate AML/CFT report further to CSSF Regulation No 12-02.

CIRCULAR CSSF 23/845 4/21 TABLE OF CONTENTS

1. Scope of application and legal basis ................................................................................. 5
2. The self-assessment questionnaire .................................................................................. 6
3. The mission of the REA ................................................................................................ 10 3.1. The report on the protection of financial instruments and funds belonging to clients....... 10 3.2. The AML/CFT report ............................................................................................... 11
4. Submission procedures ................................................................................................ 13 4.1. Self-assessment questionnaire ................................................................................ 13 4.2. Reports prepared by the REA................................................................................... 14 4.3. Practical rules........................................................................................................ 14
5. Final provisions ........................................................................................................... 15

CIRCULAR CSSF 23/845 5/21

1. Scope of application and legal basis The provisions of this circular are applicable to credit institutions1 incorporated under Luxembourg law, including their branches, as well as Luxembourg branches of third-country credit institutions (an institution). This circular does not apply to Luxembourg branches of EU credit institutions. The framework for the revised long form report consists of four three parts:

• a self-assessment questionnaire to be completed by institutions;
• the Agreed Upon Procedures report(s) (the AUP report(s)) to be prepared by the REA under ISRS 4400 (revised) Standard;
• a separate report to be prepared by the REA on the protection of financial instruments and funds belonging to clients;
• a separate report to be prepared by the REA on the procedures set up by institutions concerning the prevention of money laundering and terrorist financing (the AML/CFT report). The self-assessment questionnaire introduced by this circular is based on the following powers of the CSSF to obtain information from institutions in the context of its legal supervisory mandate:
• Article 53(1), points (2) and (8), of the lLaw of 5 April 1993 on the financial sector, as amended;
• Article 45(2) of the Llaw of 30 May 2018 on markets in financial instruments, as amended;
• Article 58-5 of the Llaw of 10 November 2009 on payment services, on the activity of electronic money institution and settlement finality in payment and securities settlement systems, as amended;
• Article 147(2) of the Llaw of 17 December 2010 relating to undertakings for collective investment, as amended and Article 50(2) of the Llaw of 12 July 2013 on Aalternative Iinvestment Ffund Mmanagers, as amended;
• Article 62(1) of the Llaw of 13 July 2005 on institutions for occupational retirement provision in the form of pension savings companies with variable capital (SEPCAVs) and pension savings associations (ASSEPs), as amended. The AUP report(s) to be prepared by the REA, as specified in section 3.1 of this circular, are based on the application of the following legal provisions which authorise the CSSF to request a REA to carry out an audit in relation to one or more specific aspects of the activities and operations of institutions:
• Article 54(2) of the law of 5 April 1993 on the financial sector as amended;
• point 9 of Article 45(2) of the law of 30 May 2018;
• point (c) of Article 147(2) of the law of 17 December 2010;
• point (m) of Article 50(2) of the law of 12 July 2013;
• point (h) of Article 62(1) of the law of 13 July 2005;
• point (9) of Article 58-5(1) of the law of 10 November 2009. 1 This circular applies to both significant supervised entities and less significant supervised entities as defined in Article 2, points (16) and (7) of Regulation (EU) No 468/2014 of the European Central Bank (ECB) of 16 April 2014, as amended (the SSM Framework Regulation) respectively.

CIRCULAR CSSF 23/845 6/21 The separate report prepared by the REA on the protection of financial instruments and funds belonging to clients is required under Article 7 of the Grand-ducal Regulation of 30 May 2018.2 The separate report prepared by the REA on AML/CFT is based on the application of Articles 49(2) and 49(3) of CSSF Regulation No 12-02 of 14 December 2012 (hereafter “RCSSF 12-02).3 The self-assessment questionnaire and the reports to be prepared by the REA covers domains in scope of the prudential supervision for which the CSSF or the European Central Bank are competent. Please note however that the sections of the self-assessment questionnaire and modules of the reports to be prepared by the REA covering matters relating to the Market in Financial Instruments Directive (MiFID), the Payment Services Directive (PSD 2) and undertaking for collective investments (UCI) depositaries as well as the separate reports to be prepared by the REA covering protection of financial instruments and funds belonging to clients and AML/CFT are under the exclusive competence of the CSSF. All parts of the framework have been designed in a proportionate way and targeting in-scope institutions all alike with a view to allowing the competent authorities to gather sufficient information to implement their risk-based approaches to supervision and to obtain information and assurances as regards in-scope institutions’ compliance with key regulatory provisions the control of which falls within the competent authorities’ legal mandate. 2. The self-assessment questionnaire The self-assessment questionnaire to be completed by institutions consists of the following sections: Section Description Level of application Exemptions Internal governance Overview of the operational and decision-making structure of the institutions, including the composition of its committees and internal control functions. Institutions, on an individual basis, excluding their branches, if any. / IT risk Overview of IT systems and processes, including an assessment of the level of risks and the controls in place. Institutions, on an individual basis, including their branches, if any. / Credit risk – IFRS 9 Overview of the methodologies applied for calculating impairment losses under IFRS 9 as well as a description of how the concept of “forborne” is implemented at the level of the institutions. This section shall also provide an overview of Institutions, on an individual basis, including their branches, if any. /Institutions for which the annual accounts are prepared in accordance with IFRS 9 2 Grand-ducal Regulation of 30 May 2018 on the protection of financial instruments and funds belonging to clients, product governance obligations and the rules applicable to the provision or reception of fees, commissions or any monetary or non-monetary benefits, as amended. 3 CSSF Regulation No 12-02 of 14 December 2012 on the fight against money laundering and terrorist financing, as amended.

CIRCULAR CSSF 23/845 7/21 Section Description Level of application Exemptions scenarios and forecasts used by the institution to account for its exposure to credit risk. accounting standard. Credit and counterparty risk Overview of the organisation, internal governance, methodology, reporting and monitoring of the credit and counterparty risk. Institutions, on an individual basis, including their branches, if any. / Interest rate risk in the banking book (IRRBB) and credit spread risk arising from non-trading book activities (CSRBB) Overview of the IRRBB/CSRBB risk controls in place. Institutions, on an individual basis, including their branches, if any. / Liquidity risk Overview of liquidity risk documentation, liquid assets, intraday liquidity risk and parent company funding. Institutions, on an individual basis, including their branches, if any. / Large exposures Qualitative information on large exposures reported by the institutions. Institutions, on an individual basis, including their branches, if any. / Related parties Overview of intragroup exposures, including a description of the purpose of these exposures. In addition, this section shall also provide an overview of services provided to / received from related parties. Institutions, on an individual basis, including their branches, if any. / Foreign branches Overview of the foreign branches, including a description of how corporate, commercial and risk group policies are applied in the foreign branches, as well as an overview of the controls in place. Foreign branches located in another Member State or in a third country. Institutions that did not have any foreign branches located in another Member State or in a third country at the closure of the financial year.

CIRCULAR CSSF 23/845 8/21 Section Description Level of application Exemptions MiFID Overview of organisational and operational setup with regard to MiFID, as well as a description of investment services and financial instruments offered by the institutions to their clients. This section shall include information on distribution and communication means and on the client database. Institutions, on an individual basis, excluding their branches, if any. Institutions that did not provide any investment services or sell or advise in relation to structured deposits during the financial year. PSD 2 – payment services provided Overview of payment services and a description of the interface through which those payment services are offered to clients. Institutions, on an individual basis, including their branches, if any. Institutions that did not provide any payment services during the financial year. PSD 2 – RTS on strong customer authentication and secure communication (SCA & CSC) Overview of applicability and compliance with the provisions of Commission Delegated Regulation (EU) 2018/389 (RTS on SCA & CSC). Institutions, on an individual basis, including their branches, if any. Institutions that did not provide any payment services during the financial year. Depositary bank Quantitative and qualitative overview of the UCI depositary function and the related services. In addition, this section contains a self￾assessment against the main legal requirements. Institutions, on an individual basis, excluding their branches, if any. Institutions that do not provide depositary and related services. Climate-related and environmental risks Information relating to materiality assessment and relevance of climate-related and environmental risks, action plan and alignment with supervisory expectations. Institutions, on an individual basis, excluding their branches, if any. / Consolidation aspects Information relating to the oversight of the subsidiaries (organisation, control function, IT systems) and quantitative information on each subsidiary. Covering all subsidiaries included in the scope of prudential consolidation according to the provisions of Chapter 2 of Title II of Part One of Institutions that did not consolidate other entities from a prudential perspective at the closure of the relevant financial year.

CIRCULAR CSSF 23/845 9/21 Section Description Level of application Exemptions Regulation (EU) No 575/2013. The information communicated as part of the self-assessment questionnaire shall be accurate and as concise as possible, while providing a true and fair view, and be based on the prudential reporting figures (FINREP/COREP/LAREX) under IFRS as at the closure of the financial year.4 The self-assessment questionnaire is available in digital form as described in section 4.1. It will be adapted for subsequent financial years as required, including in response to developments of the legal and regulatory framework. 4 For institutions for which the date of the closure of the financial year is not aligned with the remittance date of the prudential reporting, the questionnaire should be based on the last prudential reporting submitted before the closure of the financial year.

CIRCULAR CSSF 23/845 10/21 3. The mission of the REA 3.1. The AUP report(s) Institutions have to mandate their REA to perform a predefined list of agreed-upon procedures (AUPs) broken down into different modules. For the year 2023, based on the information related to the financial year 2022, this list comprises the MiFID and PSD2 modules. According to the individual business models of an institution, one or both of these modules may not be applicable. However, where a specific AUP within the applicable module(s) does not apply to an institution, the REA shall explicitly mention it. The CSSF intends to update the present circular for the subsequent financial years notably to include further modules to be performed, in principle within a three-year cycle. The determination of the applicable modules for an institution will follow a risk-based approach. The REA performing the AUPs must be the REA appointed by an institution for the audit of its financial statements. The REA’s findings shall be documented in the AUP report(s) to be filled in using the CSSF digital solution. The AUPs shall be performed in accordance with the International Standard on Related Services 4400 applicable to AUPs engagements. 3.2.3.1.The report on the protection of financial instruments and funds belonging to clients If applicable, institutions are also required to mandate their REA to prepare, on an annual basis, a separate report on the protection of financial instruments and funds belonging to clients. This report shall cover the adequacy of the arrangements under Article 37-1(7) and (8) of the Law of 5 April 1993 on the financial sector, as amended, Article 13, paragraph(4) of the Law of 5 August 2005 on financial collateral arrangements, as amended, and Section 2 of the Grand-ducal Regulation of 30 May 2018. The authorised management of the institution is responsible for providing the REA with the required information for the drafting of the descriptive parts of the report. The REA may include in its report descriptive elements directly provided by the institution’s authorised management, but s/he shall verify and ensure that these elements are correct and adequate. If needed, s/he may have to perform some amendments. The purpose of this separate report, which must be uploaded through the a CSSF digital solution, is notably to ensure the reliability of the answers provided by an institution in the self-assessment questionnaire in relation to the protection of financial instruments and funds belonging to clients. However, this does not preclude the REA to perform further assessments beyond those set forth in the self-assessment questionnaire.

CIRCULAR CSSF 23/845 11/21 3.3.3.2.The AML/CFT report Institutions are also required to mandate their REA to prepare, on an annual basis, a separate report covering AML/CFT further to RCSSF 12-02. The AML/CFT report describes the procedures set up by the institution concerning the prevention of money laundering and terrorist financing as required for compliance with or as defined in:

• Chapter 5 of Part II of the lLaw of 5 April 1993 on the financial sector, as amended;
• the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended;
• the Grand-ducal Regulation of 1 February 2010 providing details on certain provisions of the amended Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended;
• Regulation (EU) 2015/847 of the European Parliament and of the Council of 20 May 2015 on information accompanying transfers of funds, as amended;
• international acts on the fight against terrorist financing brought to the attention of the institutions through CSSF circulars;
• CSSF regulations on the fight against money laundering and terrorist financing;
• CSSF circulars with regard to AML/CFT. The AML/CFT report shall provide, in particular: • the description of the AML/CFT policy set up by the institution in order to prevent money laundering and terrorist financing, the verification of its compliance with the provisions of Part II, Chapter 5 of the Law of 5 April 1993 on the financial sector, as amended, the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended, the Grand-ducal Regulation of 1 February 2010, as amended, Regulation (EU) 2015/847, as amended, CSSF regulations and CSSF circulars relating to AML/CFT and the control of their sound application; • the assessment of the institution's analysis of money laundering and terrorist financing risks to which it is exposed. The REA must verify if the implemented procedures, infrastructures and controls, as well as the scope of the AML/CFT measures are appropriate considering the ML/FT risks to which the institution is exposed, particularly through its activities, the nature of its customers and the provided products and services; • a declaration on whether an audit of compliance with the institution's AML/CFT policy has been performed by the internal audit function and the compliance officer in charge of the control of compliance with the professional obligations5; • a short description of the training and awareness-raising measures for employees as regards money laundering and terrorist financing, and, in particular, with respect to the identification of money laundering and terrorist financing transactions; • statistics concerning the detected suspicious transactions which indicate the number of suspicious transaction cases reported to the FIU by the institution, as well as the total amount of funds involved during the financial year; • the control of the application of the provisions of Regulation (EU) 2015/847, as amended by the institution, in its respective role, and the percentage of transfers of funds for which data on the payer or payee were missing or incomplete and the measures taken in this context by the institution. The AML/CFT report shall also provide: 5 As defined in Article 1(1) of CSSF Regulation 12-02 of 14 December 2012RCSSF 12-02.

CIRCULAR CSSF 23/845 12/21 • a description of roles and responsibilities with regard to AML/CFT within the institution, including the roles and responsibilities of and the interactions between the management and the different departments and services, indicating the corresponding number of staff involved on AML/CFT matters. The AML/CFT report shall also include a description of the committees and the corresponding hierarchical and functional structures by indicating the general and particular delegations of power with respect to AML/CFT. It shall also provide a description by the institution and an assessment by the REA of the three-lines-of￾defence model, as defined in Article 39(7) of the RCSSF 12-02; • the list of persons involved oin AML/CFT matters, as referred to in the RCSSF 12-02 and Circular CSSF 12/552, as amended (compliance officer, person responsible for compliance, Chief Compliance Officer, etc.). It shall also state all the changes with regard to these persons which occurred during the financial year. Since these persons may delegate to members of staff certain operational tasks in relation to these functions, the AML/CFT report shall provide, where appropriate, a description of the delegation mechanism; • a description of the network of national agencies, national and foreign subsidiaries, the branches abroad, the foreign representative offices and the tied agents, as well as the main related ML/FT risks. The AML/CFT report shall also indicate if the institution uses the services of external managers as regards the clients' assets and shall, where appropriate, provide a description of the manner in which the relationships with external managers are managed and documented from an AML/CFT perspective; • a description of the institution’s commercial policy as well as the strategy regarding the management of the related ML/FT risks. It shall also include a description of how the institution monitors and ensures compliance with its internal objectives with regard to ML/FT risks management. The REA shall assess if the institution has sufficient financial resources and the appropriate infrastructure to control ML/FT risks to which it is exposed. The REA shall state how the sample of reviewed files was selected. When determining the sample, the CSSF expects the REA to apply a risk-based approach, taking into account the different business activities performed. The REA shall state the reference date of the sample data and provide relevant information on the methodology adopted for determining the sample (for example, the number of files reviewed compared to the total number of clients or the volume of deposits reviewed compared to the total volume of deposits). Where the REA identifies cases of non-compliance with the legal or regulatory provisions or deficiencies, the REA shall give detailed indications enabling the CSSF to assess the situation (number of pending incomplete files as a percentage of the total number of reviewed files, details of the deficiencies identified, etc.). Where applicable, the AML/CFT report must encompass the institution's branches, majority-owned subsidiaries abroad and the tied agents. It must cover, in particular, the branches', majority-owned subsidiaries' and the tied agents’ compliance with the applicable provisions as regards the prevention of money laundering and terrorist financing and it must include, in that respect: • an analysis of money laundering and terrorist financing risks incurred by the branches, majority-owned subsidiaries and the tied agents; • a description and assessment of the money laundering and terrorist financing risk management in the branches, majority-owned subsidiaries and the tied agents; • the verification of the implementation of and compliance with the institution's AML/CFT policy in the branches, majority-owned subsidiaries and the tied agents. The AML/CFT report must be sufficiently exhaustive and transparent, providing detailed descriptions and assessments, in order to allow a precise and informed judgement on the risks incurred by the

CIRCULAR CSSF 23/845 13/21 institution with respect to money laundering and terrorist financing. With regard to the language used for the assessments, the AML/CFT report shall not include imprecise negative formulations (e.g. “We did not encounter serious weaknesses”) or global and approximative assessments (e.g. “We noted that most of the points comply with the laws and regulations”). The AML/CFT report shall rather provide a positive assessment for each area and subject by providing an overview of the methodology adopted (e.g. use of the sample technique, method for selecting the sample, etc.) and, where applicable, provide a description of the identified findings in order to allow the CSSF to better understand and judge the extent of the noticed irregularities and weaknesses. The REA shall also perform the follow-up of findings observed during the previous audits and described in detail in the previous AML/CFT report. The REA shall provide a description of any potential issues in relation to AML/CFT the institution may have with foreign competent authorities. The authorised management of the institution is responsible for providing the REA with the required information for the drafting of the descriptive parts of the AML/CFT report. The REA may include in its report descriptive elements directly provided by the institution’s authorised management, but s/he shall verify and ensure that these elements are correct and adequate. If needed, s/he may have to perform some amendments. In addition to the descriptive parts, the REA shall perform independently a detailed assessment of the ML/FT risks to which the institution is exposed as well as organisational aspects. This assessment shall be duly documented. It should be noted that the REA shall also inform the CSSF of all the suspicious transactions reported pursuant to Article 5 of the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended, and which concern the institutions. Similarly, the REA must inform the CSSF in case they deem that the institution should have reported a suspicious transaction but has not, explaining his/hertheir reasoning and having regard to the institution’s rationale. When discussing the cases with the institution, the REA needs to be mindful of applicable professional obligations. 4. Submission procedures 4.1. Self-assessment questionnaire The self-assessment questionnaire will be accessible through the a CSSF digital solution for each institution at least within three months before the closure of the institution’s financial year. The self-assessment questionnaire must be reviewed and electronically signed by the authorised management before submitting it to the CSSF. The self-assessment questionnaire must be transmitted on an annual basis to the CSSF in an electronic form via the a CSSF digital solution within three months after the closure of the financial year, in accordance with the procedure described in section 4.3. For the year 2023, the self-assessment questionnaire must be transmitted within four months after the closure of the financial year.

CIRCULAR CSSF 23/845 14/21 4.2. Reports prepared by the REA The AUP report(s), the separate report on the protection of financial instruments and funds belonging to clients and the AML/CFT report shall include the digital signature of the partner in charge of the mandate with the audit firm s/he represents. With regard to the AUP report(s), the REA submits the report(s) to the institution, which can provide comments on the findings identified by the REA. These comments do not form part of the AUP report(s). The AUP report(s) shall be submitted subsequently by the institution to the CSSF. With regard to the separate report on the protection of financial instruments and funds belonging to clients and the AML/CFT report, theThe REA submits the reports to the institution, which. These two reports shall be submitsted them subsequently by the institution to the CSSF. All The reports prepared by the REA must be transmitted by the institution to the CSSF in electronic form via the a CSSF digital solution within five months after the closure of the financial year, in accordance with the procedure described in section 4.3. For the year 2023, the reports prepared by the REA must be transmitted within six months after the closure of the financial year. 4.3. Practical rules Procedures and explanations on the practical modalities regarding the preparation and transmission of the self-assessment questionnaire, the AUP report(s), the separate report on the protection of financial instruments and funds belonging to clients and the AML/CFT report are made available to institutions and their REA, via the eDesk portalon the website of the CSSF under the following link: https://edesk.apps.cssf.lu/edesk-dashboard/api/v1/documentation/LFRB_GU/en. A user guide “Authentication and user account management” is available to institutions via the eDesk portal of the CSSF.

CIRCULAR CSSF 23/845 15/21 5. Final provisions Circular CSSF 22/821, as published on 25 October 2022, This circular repealeds Circular CSSF 01/27, as amended by Circulars CSSF 08/340, CSSF 10/484, CSSF 11/521 and CSSF 21/765, as well as Circular IML 96/125. It applied from 31 December 2022. The current revised versionis circular shall apply as from 31 December 20222023. Yours faithfully, Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General

CIRCULAR CSSF 23/845 16/21 Annex II: Circular CSSF 22/826 as amended by Circular CSSF 23/845 Practical rules concerning the statutory audit mandate of the approved statutory auditors (réviseurs d’entreprises agréés) To all Luxembourg credit institutions and Luxembourg branches of non-EU credit institutions Luxembourg, 23 December 2022 Ladies and Gentlemen, The purpose of this circular is to define the scope of the statutory audit mandate and the content of the reports and written comments issued by the réviseur d’entreprises agréé (REA) in the context of its audit of the annual accounting documents (audit reports) prepared pursuant to Article 54(1) of the Law of 5 April 1993 on the financial sector, as amended (LFS). The circular also clarifies the REA’s reporting obligations under Article 54(3) of the LFS. The circular draws upon the provisions formerly contained in the Circular CSSF 01/27. The latter will bewas repealed by Circular CSSF 22/821 as of 31 December 2022.

CIRCULAR CSSF 23/845 17/21 TABLE OF CONTENTS

1. Scope of application and legal basis ............................................................................... 18
2. Mandate..................................................................................................................... 18
3. Report on annual accounts ........................................................................................... 19
4. Reporting to the CSSF.................................................................................................. 20
5. Final provisions ........................................................................................................... 21

CIRCULAR CSSF 23/845 18/21

1. Scope of application and legal basis The provisions of this circular are applicable to credit institutions6 incorporated under Luxembourg law, including their branches, as well as Luxembourg branches of third-country credit institutions (an institution). The provisions of this circular are not applicable to Luxembourg branches of EU credit institutions. For the purpose of this circular, the term “annual accounts” shall be understood as: • the balance sheet, the profit and loss account and the notes to the accounts, as drawn up by an institution on a statutory or consolidated basis, pursuant to Article 2(1) and Article 85(1) of the Law of 17 June 1992 relating to the accounts of credit institutions, as amended (Law on the accounts of banks) and according to the Luxembourg statutory format for annual accounts. • the statement of financial position, the statement of profit or loss and other comprehensive income, the statement of changes in equity, the statement of cash flows and the notes to the financial statements, pursuant to Article 76a of the Law on the accounts of banks. These documents shall constitute a composite whole. As concerns Luxembourg branches of non-EU credit institutions (third-country branches), the term “annual accounts” is to be understood as the final annual accounting information drawn up according to the Law on the accounts of banks with regard to the branches’ activities in Luxembourg. The requirements outlined in this circular are based on Article 54(1) of the LFS.
2. Mandate The institutions must give a written and detailed mandate to their REA, containing at least the following provisions:
3. The statutory audit of annual accounts as drawn up by an institution on a statutory or consolidated basis must be carried out in accordance with EU Regulation No 537/20147, the Law of 23 July 2016 concerning the audit profession, as amended (Audit Law) and with International Standards on Auditing (ISAs) and the International Code of Ethics for Professional Accountants, including the International Independence Standards, issued by the International Ethics Standards Board for Accountants (IESBA) as adopted for Luxembourg by the CSSF;
4. The statutory audit must cover, to the extent relevant for the purpose of the statutory audit of annual accounts and in line with the applicable auditing standards, the pertinent business areas of the institution, whether they are recorded on the balance sheet or as off-balance sheet items. The mandate given to the REA must not exclude a type of activity, a category of transactions or a specific transaction from the scope of the audit. Furthermore, the audit must encompass the banking risks, as well as the financial, organisational and internal control-related aspects of the institution pertaining to the annual accounts; 6 This circular applies to both significant supervised entities and less significant supervised entities as defined in Article 2, points (16) and (7) of Regulation (EU) No 468/2014 of the European Central Bank (ECB) of 16 April 2014, as amended(the SSM Framework Regulation) respectively. 7 Regulation (EU) No 537/2014 of the European pParliament and of the Ccouncil of 16 April 2014 on specific requirements regarding statutory audit of public-interest entities, as amended.

CIRCULAR CSSF 23/845 19/21 3. The mandate for the statutory audit of the institution must cover all the institution's branches abroad; 4. For the purpose of his statutory audit, the REA has to ensure that the account balance “Provisions” is not significantly misstated. The CSSF would like to highlight that as part of his/her diligence, the REA shall also cover the risk, in line with applicable International Standards on Auditing as adopted by the CSSF, that, if securities entrusted with the bank in its depositary/custody services would turn out to be unavailable for restitution, the corresponding provision would be adequately reflected in the audited accounts. In this context, the REA should ensure that the going concern assumption still applies to the audited entity audited. 5. In accordance with Article 111 of the Law on the accounts of banks, the institution which prepares the consolidated accounts for publication must have them audited by the REA to whom the audit of the annual accounting documents has been entrusted. The audit shall lead to the drawing-up of a report on consolidated accounts. The institutions and the REA must immediately inform the CSSF if the REA terminates his/her mandate before expiry of the term or if s/he decides not to renew his/her mandate. Institutions must also notify the CSSF of their duly justified intention to terminate the mandate of their REA or not to renew it. The CSSF will analyse, for each request to change the REA, the reasons for the envisaged change and will assess whether the institution’s management body has, during the selection procedure of the new REA, carefully assessed the adequacy of the competence and resources of the latter based on the type and volume of the institution’s activities and the nature and complexity of its internal systems. At the same time, the institutions shall transmit to the CSSF a copy of the mandate given to the new REA. 3. Report on annual accounts The provisions of the Law on the accounts of banks and the rules and instructions issued by the CSSF for the drawing-up of institutions' accounts shall be strictly complied with. Any departure requires the prior consent from the CSSF. Where an REA notifies an institution that s/he will give an opinion other than unqualified, or refuses to certify the accounts, this institution and his/her REA must immediately inform the CSSF thereon (cf. also Section 4 below on the Reporting to the CSSF) in accordance with Article 54 of the LFS. The REA must report, in accordance with the applicable auditing standards, the weaknesses and points needing improvement that s/he observed during the course of his/her statutory audit of annual accounts of an institution in a management letter addressed to the management of the institution. The observations of the REA must come with comments of the institution's management. As described in Circular CSSF 19/731, theThe report of the REA on the annual accounts shall be submitted to the CSSF and, in case of a significant institution, to the ECB at least 2 weeks ahead of the ordinary general meeting of shareholders; the management letter (on a statutory or consolidated basis) shall be submitted one monthwithin six months after the ordinary general meetingclosure of shareholdersthe financial year. For Luxembourg branches of third-country credit institutions the report of the REA on the annual accounts and the management letter shall be submitted to the CSSF within six months after the closure of the financial yearby 30 June. Besides the report on the annual accounts, the institutions shall also spontaneously, and without being specifically requested to do so, communicate to the CSSF all the other documents issued by the REA during his/her statutory audit of annual accounts as referred above.

CIRCULAR CSSF 23/845 20/21 The report of the REA on the annual accounts8 is subject to statutory publication together with the annual accounts and the management report9 it refers to, pursuant to Article 71 and Article 112 of the Law on the accounts of banks. 4. Reporting to the CSSF The REA shall report to the CSSF pursuant to Article 54(3) of the LFS. Such reporting shall not only relate to adverse effects in the short term (as it is the case for the certification of annual accounts) but also in the medium and long term (objective of the prudential supervision). Consequently, the REA shall communicate to the CSSF the information of which s/he became aware while carrying out his/her mission and which is relevant from a prudential point of view and/or likely to require an urgent action by the CSSF. The facts to be considered are, among others, items constituting a material infringement of legislation, affecting the continuous functioning of the institution or leading to refusal to certify the accounts or to reservations thereto. The REA is also required to promptly inform the CSSF of any fact or decision concerning an institution, and fulfilling the criteria enumerated in Article 54(3) of the LFS, of which s/he becomes aware while auditing the annual accounting documents or performing any other statutory task within an undertaking which is linked to that institution by a close link (as defined by Article 1, point (21) of the LFS). The legal requirement to report “promptly” the relevant information to the CSSF does not prevent the REA to consult first the institution’s management body, provided that the latter is not conflicted and that the discussion does not unduly delay the transmission of information to the CSSF. As regards the communication modalities, it is understood that: • the reporting of the REA is carried out spontaneously, in written or oral form; in case of serious problems, it is recommended that the oral communications be followed by a written confirmation as quickly as possible; • the priority should be given to timely rather than precise and complete reporting in the first place; • in the reporting to the CSSF, the REA shall explicitly inform on the actual or possible problems noted. Examples of facts or decisions falling or likely to fall under the reporting obligation to the CSSF include, among others, the following: • major conflicts within the decision-making bodies of the institution; • non-compliance with the professional obligations notably as regards the prevention of money laundering and terrorist financing or the conduct of business rules; • unexpected departure of a key function holder; • major financial difficulties in a branch or subsidiary; • serious deficiencies in the internal control framework; • significant errors in the prudential reporting; • important and repeated exceeding of internal limits; • inappropriate assessment in relation to a contribution in kind; 8 As defined under point (1). 9 The management report should be understood as the management report defined under Article 70 of the Law on the accounts of banks or as the consolidated management report defined under Article 110 of the Law on the accounts of banks.

CIRCULAR CSSF 23/845 21/21 • inappropriate assessment in relation to credit risk; • granting of an interim dividend while the institution has insufficient or barely sufficient own funds; • important increase of the risks linked to the institution's activity; • important loss of depositors likely to create a liquidity problem; • major incidents in the IT organisation or infrastructure; • activity change without appropriate infrastructure; • non-respect ofcompliance with the common procedures10 (e.g. qualifying holdings); • frauds likely to generate important losses; • important legal disputes; • inappropriate assessment in relation to a merger/split project of undertakings. As a reminder, Article 54(4) of the LFS guarantees that the disclosure in good faith to the CSSF by an REA of any fact or decision as referred to in paragraph 3 of that Aarticle shall not constitute a violation of the obligation of professional secrecy or a breach of any restriction on disclosure of information imposed by contract, and shall not expose that REA to liability of any kind. 5. Final provisions This circular shall apply as from 31 December 2022. Yours faithfully, Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General 10 Procedures which are ultimately decided on by the ECB regardless of the significance of the credit institution concerned.