Circular CSSF 24/853: Practical Rules for Investment Firms' Long Form Report and Statutory Auditor Missions

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 1/13 Circular CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 LONG FORM REPORT – Practical rules concerning the self-assessment questionnaire to be submitted by investment firms Mission and related reports of the réviseurs d’entreprises agréés (approved statutory auditors)

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 2/13 Circular CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 LONG FORM REPORT – Practical rules concerning the self￾assessment questionnaire to be submitted by investment firms Mission and related reports of the réviseurs d’entreprises agréés (approved statutory auditors) To investment firms and Luxembourg branches of non-EU investment firms Luxembourg, 30 January 2024 Ladies and Gentlemen, The purpose of this circular is to introduce the key aspects of the revised long form report (the revised LFR) that applies to all investment firms as from the financial year ending on 31 December 2024. The revision of the long form report is the result of a thorough reconsideration of its objective, scope and content in order to realign it with the supervisory and prudential points of focus of the CSSF. Accordingly, the revised LFR has been designed with a view to allowing the CSSF to obtain relevant information as regards investment firms’ compliance with key regulatory provisions. In this view, the revised LFR allows the CSSF to gather sufficient information all the while further facilitating the implementation of a risk-based approach to supervision. In the review process, due consideration has been given to the principle of proportionality, as investment firms will only be required to provide information that is both relevant against the background of their business model and incremental compared to information already provided by them to the CSSF via other reporting obligations and channels, thus reducing redundancies between existing reports. With respect to its form and in line with the CSSF’s digital strategy (CSSF 4.0), the revised LFR turns digital to allow a more efficient reporting processing and ease data analysis. Its completion and submission will be required through the dedicated channel via the online portal of the CSSF.

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 3/13
Table of Contents

1. Scope of application.................................................................................................... 4
2. Overview of the revised LFR......................................................................................... 4
3. The self-assessment questionnaire (SAQ) ...................................................................... 5
4. The mission of the REA................................................................................................ 6
   4.1. The AUP report(s) .................................................................................................... 6
   4.2. The MiFID report...................................................................................................... 7
   4.3. The AML/CFT report ................................................................................................. 7
5. Submission procedures.............................................................................................. 11
   5.1. SAQ ..................................................................................................................... 11
   5.2. Reports prepared by the REA................................................................................... 11
   5.3. Practical rules........................................................................................................ 11
6. Final provisions ........................................................................................................ 12

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 4/13

1. Scope of application
2. This Circular applies in full to all non-SNI IFR investment firms1 incorporated under
   Luxembourg law, including their branches (the In-Scope Class 2 IF)2 and certain3 SNI IFR investment firms4 incorporated under Luxembourg law, including their branches (the In￾Scope Class 3 IF), hereafter collectively the Full-Scope IF.
3. It also applies to Class 3 IF that by reference to their risk attributes represent a comparably
   lesser risk. These Class 3 IF are not subject to all the requirements of this Circular and are therefore designated as Partial Scope IF. In accordance with the principle of proportionality, the CSSF may adapt the requirements with respect to a specific Partial Scope IF on a case-by-case basis if the CSSF concludes that the IF’s risk profile5 has changed.
4. Overview of the revised LFR
5. The revised LFR comprises four parts that shall be produced on a yearly basis in principle:

1. a Self-Assessment Questionnaire (the SAQ) to be filled in on a yearly basis by the
   investment firms. The requirement to complete an SAQ is based on the powers of the CSSF to obtain information from investment firms in the context of its legal supervisory mandate and in particular Article 53(1), second subparagraph, points (1) and (2) of the Law of 5 April 1993 on the financial sector, as amended (the LFS) and Article 45(2), points (1) and (2) of the Law of 30 May 2018 on markets in financial instruments, as amended (the MiFID Law);
2. an Agreed-Upon Procedures report to be prepared by the réviseurs d’entreprises agréés
   (approved statutory auditors, the REA) of the investment firms in accordance with the International Standard on Related Services (ISRS) 4400 (Revised), in application of the legal provisions which authorise the CSSF to request an REA to carry out an audit in relation to one or more specific aspects of the activities and operations of institutions (Article 54(2) of the LFS and Article 45(2), point (9) of the MiFID Law) (the AUP report6). Each year, the annual AUP report shall cover a sub-set of relevant MiFID aspects, whereas the AUP three-year-cycle will ensure the coverage of all relevant MiFID areas over a period of three (3) years; 1 As defined in point (9a-2) of Article 1 of the Law of 5 April 1993 on the financial sector, as amended (the LFS). 2 As of the date of issuance of this circular, there is no CRR investment firm as defined in point (9a) of Article 1 of the LFS being incorporated in Luxembourg nor are there Luxembourg branches of third-country investment firms. 3 The In-Scope Class 3 IF concerned have been selected by the CSSF using a risk-based approach, considering certain representative risk attributes (e.g. business model, size). They were informed bilaterally that they were required to submit the revised LFR for the financial year ending 31 December 2023. 4 Small and non-interconnected investment firms as set out in Article 12(1) of Regulation (EU) 2019/2033. 5 For this reassessment the CSSF considers all information available and assesses in particular whether the nature, size and complexity including the risks of the entity as a whole or of a specific risk attribute have changed. 6 This report must also cover the branches that the investment firm incorporated under Luxembourg law has abroad.

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 5/13
3) a separate report on the protection of financial instruments and funds belonging to
clients as required by Article 7 of the Grand-ducal Regulation of 30 May 20187 (the MiFID GDR) to be prepared on a yearly basis by the REA (the MiFID report8); and
4) a separate report on the procedures set up by the investment firm concerning anti￾money laundering and countering the financing of terrorism based on Articles 49(2) and
49(3) of CSSF Regulation No 12-02 of 14 December 2012 (the RCSSF 12-02)9 to be prepared on a yearly basis by the REA (the AML/CFT report). Partial Scope IF subject to the revised LFR for the first time for the financial year ending 31 December 2024 are exempted from the submission of the AUP report for the AUP three￾year-cycle starting at the financial year ending 31 December 2024. Please refer to Annex I.
2. The revised LFR shall apply to investment firms on an individual basis only10. No consolidated
revised LFR is required where an investment firm is subject to supervision on a consolidated basis by the CSSF.
3. The four parts of the revised LFR form a single document. The SAQ to be completed by the
investment firms represents a key element for defining the contents of the mission of the REA. The REA’s mission is not to validate the SAQ. However, considering the interlinkages between the SAQ and the AUP and MIFID reports of the REA, the REA shall take contact with the CSSF11 should material errors having an impact on the extent of their work required under section 4 of this Circular be identified in the SAQ.
3. The self-assessment questionnaire (SAQ)

1. The aim of the SAQ is to receive relevant and precise information in digital form with respect
   to governance and MiFID topics.
2. The SAQ is composed of a “General information” section and several thematic sections. The
   individual modules of the SAQ and their level of application as well as the applicable exemptions are directly recorded in the CSSF’s digital solution and are also described on the CSSF website.
3. To give due consideration to the varying business models of investment firms, the purpose
   of the “General information” section is to activate, based on the answers provided by the investment firm, only those thematic sections that are actually relevant against the background of an investment firm’s given business model.
4. The information communicated by the investment firm via the SAQ shall be accurate and as
   concise as possible and be in line with the prudential reporting figures as at the end of the financial year, where applicable. 7 Grand-ducal Regulation of 30 May 2018 on the protection of financial instruments and funds belonging to clients, product governance obligations and the rules applicable to the provision or reception of fees, commissions or any monetary or non-monetary benefits, as amended. 8 This report must also cover the branches that the investment firm incorporated under Luxembourg law has abroad. 9 CSSF Regulation No 12-02 of 14 December 2012 on the fight against money laundering and terrorist financing, as amended. 10 Except for Section 6 of the SAQ “Recommendations or observations raised”. 11 In accordance with Article 54 (3) point 2.a of the LFS.

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 6/13
5. The investment firm is required to upload specific supporting documents as attached
documents in the SAQ (e.g. organisation chart, IT flowchart, outsourcing register, summary report of the internal audit function).
4. The mission of the REA

1. Investment firms shall mandate in writing their REA to prepare, on annual basis, the reports
   listed below. The REA shall be the REA appointed by the investment firm for the statutory audit of its annual accounts.
   4.1. The AUP report(s)
2. The agreed-upon procedures (the AUP) shall be performed in accordance with ISRS 4400
   (Revised) applicable to “Agreed-Upon Procedures Engagements”.
3. The REA’s findings shall be clearly documented in the AUP report(s) to be filled in using a
   CSSF digital solution.
4. The AUP report is composed of individual thematic sections. Depending on the individual
   business model of an investment firm, certain thematic sections or procedures of the AUP may not be (fully) applicable. In this case, the REA shall explicitly mention it.
5. The REA shall perform the AUP by using predefined sample sizes, as further specified in the
   relevant AUP thematic sections.
6. As regards the sample selections (e.g., clients, orders) by the AUP thematic section, the
   following guiding principles shall apply:
   a. the Full-Scope IF shall provide the REA with all relevant and complete information pertaining notably to its client database (e.g., client name, client reference, country of residence, date of account opening, MiFID categorisation, client risk profile), its transaction database (e.g., client reference, order reference, ISIN code of the financial instruments, type of financial instruments, nature of the order) and the nature of services effectively provided (discretionary asset management, advisory, execution only) to allow the REA to select a representative sample; b. the REA shall determine samples that are sufficiently diversified and representative in order to accurately reflect the composition of the Full-Scope IF’s client structure and the nature of the transactions performed. In this context, the REA shall notably provide an indication of the relative importance of the sample (for example, the number of the reviewed client files compared to the total number of client files of a specific nature) compared to the total population;
   c. the REA shall describe, if applicable, additional key elements taken into consideration for
   the composition of the sample.
7. The REA shall provide a detailed and meaningful description of the findings, if any, by type
   of clients, transactions and/or financial instruments.

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 7/13
4.2. The MiFID report
8. The MiFID report shall cover the adequacy of the arrangements under Article 37-1(7) and
(8) of the LFS, Article 13(4) of the Law of 5 August 2005 on financial collateral arrangements, as amended, and Section 2 of Chapter 1 of the MiFID GDR.
9. The purpose of the MiFID report is to assess the reliability of the answers provided by an
investment firm in the SAQ in relation to the protection of financial instruments and funds belonging to clients.
10. The authorised management of the investment firm is responsible for providing the REA with
the required information in the SAQ for the drafting of the descriptive parts of the MiFID report.
11. The structure of the MiFID report shall follow the structure of the relevant section of the SAQ
on the protection of financial instruments and funds belonging to clients.
12. The REA shall include in the MiFID report the descriptive elements provided by the
investment firm’s authorised management in the SAQ.
13. In this context, the REA shall (including on the reconciliation process of financial instruments
and funds belonging to clients):
a. verify and ensure that these elements are correct and adequate; b. assess the appropriateness of the description provided by the investment firm; and
c. perform appropriate control procedures to corroborate assertions set forth by the
investment firm in the SAQ.
Where applicable, the REA shall supplement the descriptive elements by items s/he deems appropriate. Where a specific item does not apply to the investment firm, the REA shall explicitly state it under the item concerned.
14. The REA shall describe the work performed and the findings, if any, and, where applicable,
provide additional information on the aspects of the SAQ.
15. The MiFID report must be uploaded through a CSSF digital solution.
4.3. The AML/CFT report
16. The AML/CFT report shall describe the procedures set up by the investment firm concerning
the prevention of money laundering and terrorist financing as required for compliance with or as defined in:

• Chapter 5 of Part II of the LFS;
• the Law of 12 November 2004 on the fight against money laundering and terrorist
  financing, as amended (the AML/CFT Law);
• the Grand-ducal Regulation of 1 February 2010 providing details on certain provisions of
  the amended Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended (the Grand-ducal Regulation 2010);
• Regulation (EU) 2023/1113 of the European Parliament and of the Council of 31 May
  2023 on information accompanying transfers of funds and certain crypto-assets and amending Directive (EU) 2015/849 (Regulation (EU) 2023/1113)

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 8/13

• international acts on the fight against terrorist financing brought to the attention of the
  investment firms through CSSF circulars;
• CSSF regulations on the fight against money laundering and terrorist financing;
• CSSF circulars relating to AML/CFT.

17. The AML/CFT report shall provide, in particular:

• the description of the AML/CFT policy set up by the investment firm in order to prevent
  money laundering and terrorist financing, the verification of its compliance with the provisions of Part II, Chapter 5 of the LFS, the AML/CFT Law, the Grand-ducal Regulation 2010, the Regulation (EU) 2023/1113, the CSSF regulations and the CSSF circulars relating to AML/CFT and the control of their sound application;
• the assessment of the investment firm’s analysis of money laundering and terrorist
  financing risks to which it is exposed. The REA must verify if the implemented procedures, infrastructures and controls, as well as the scope of the AML/CFT measures are appropriate considering the money laundering or terrorist financing (ML/TF) risks to which the investment firm is exposed, particularly through its activities, the nature of its customers and the provided products and services;
• a declaration on whether an audit of compliance with the investment firm's AML/CFT
  policy has been performed by the internal audit function and the compliance officer in charge of the control of compliance with the professional obligations12;
• a short description of the training and awareness-raising measures for employees as
  regards money laundering and terrorist financing, and, in particular, with respect to the identification of money laundering and terrorist financing transactions;
• statistics concerning the detected suspicious transactions which indicate the number of
  suspicious transaction cases reported to the FIU by the investment firm, as well as the total amount of funds involved during the financial year;
• the control of the application of the provisions of Regulation (EU) 2023/1113 by the
  investment firm, in its respective role, and the percentage of the transfers of funds for which data on the payer or payee were missing or incomplete and the measures taken in this context by the investment firm. The AML/CFT report shall also provide:
• a description of roles and responsibilities with regard to AML/CFT within the investment
  firm, including the roles and responsibilities of and the interactions between the management and the different departments and services, indicating the corresponding number of staff involved on AML/CFT matters. The AML/CFT report shall also include a description of the committees and the corresponding hierarchical and functional structures by indicating the general and particular delegations of power with respect to AML/CFT. It shall also provide a description by the investment firm and an assessment by the REA of the three-lines-of-defence model, as defined in Article 39(7) of RCSSF 12- 02;
• the list of persons involved in AML/CFT matters, as referred to in RCSSF 12-02 and
  Circular CSSF 20/758 on central administration, internal governance and risk management, as amended (compliance officer, person responsible for compliance, Chief 12 As defined in Article 1(1) of RCSSF 12-02.

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 9/13 Compliance Officer, etc.). It shall also state all the changes with regard to these persons which occurred during the financial year. Since these persons may delegate to members of staff certain operational tasks in relation to these functions, the AML/CFT report shall provide, where appropriate, a description of the delegation mechanism;

• a description of the network of national agencies, national and foreign subsidiaries, the
  branches abroad, the foreign representative offices and the tied agents, as well as the main related ML/FT risks. The AML/CFT report shall also indicate if the investment firm uses the services of external managers as regards the clients' assets and shall, where appropriate, provide a description of the manner in which the relationships with external managers are managed and documented from an AML/CFT perspective;
• a description of the investment firm’s commercial policy as well as the strategy regarding
  the management of the related ML/FT risks. It shall also include a description of how the investment firm monitors and ensures compliance with its internal objectives with regard to ML/FT risk management. The REA shall assess if the investment firm has sufficient financial resources and the appropriate infrastructure to control ML/FT risks to which it is exposed.

18. When determining the sample, the CSSF expects the REA to apply a risk-based approach,
    taking into account the different business activities performed. The REA shall state the reference date of the sample data and provide relevant information on the methodology adopted for determining the sample (for example, the number of files reviewed compared to the total number of clients). Where the REA identifies cases of non-compliance with the legal or regulatory provisions or deficiencies, the REA shall give detailed indications enabling the CSSF to assess the situation (number of pending incomplete files as a percentage of the total number of reviewed files, details of the deficiencies identified, etc.).
19. Where applicable, the AML/CFT report must encompass the investment firm's branches,
    majority-owned subsidiaries abroad and tied agents. It must cover, in particular, the branches', majority-owned subsidiaries' and tied agents’ compliance with the applicable provisions as regards the prevention of money laundering and terrorist financing and it must include, in that respect:

• an analysis of money laundering and terrorist financing risks incurred by the branches,
  majority-owned subsidiaries and tied agents;
• a description and assessment of the money laundering and terrorist financing risk
  management in the branches, majority-owned subsidiaries and tied agents;
• the verification of the implementation of, and compliance with, the investment firm's
  AML/CFT policy in the branches, majority-owned subsidiaries and tied agents.

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 10/13
20. The AML/CFT report must be sufficiently exhaustive and transparent, providing detailed
descriptions and assessments, in order to allow a precise and informed judgement on the risks incurred by the investment firm with respect to money laundering and terrorist financing. With regard to the language used for the assessments, the AML/CFT report shall not include imprecise negative formulations (e.g. “We did not encounter serious weaknesses”) or global and approximative assessments (e.g. “We noted that most of the points comply with the laws and regulations”). The AML/CFT report shall rather provide a positive assessment for each area and subject by providing an overview of the adopted methodology (e.g. use of the sample technique, method for selecting the sample, etc.) and, where applicable, provide a description of the identified findings in order to allow the CSSF to better understand and judge the extent of the noticed irregularities and weaknesses.
21. The REA shall also perform the follow-up to the findings observed during the previous audits
and described in detail in the previous AML/CFT report.
22. The REA shall provide a description of any potential issues in relation to AML/CFT the
investment firm may have with foreign competent authorities.
23. The authorised management of the investment firm is responsible for providing the REA with
the required information for the drafting of the descriptive parts of the AML/CFT report. The REA may include in its report descriptive elements directly provided by the investment firm’s authorised management, but s/he shall verify and ensure that these elements are correct and adequate. If needed, s/he may have to perform some amendments.
24. In addition to the descriptive parts, the REA shall perform independently a detailed
assessment of the ML/FT risks to which the investment firm is exposed as well as of the organisational aspects. This assessment shall be duly documented.
25. It should be noted that the REA must also inform the CSSF of all the suspicious transactions
reported pursuant to Article 5 of the AML/CFT Law, and which concern the investment firm. Similarly, the REA must inform the CSSF in case they deem that the investment firm should have reported a suspicious transaction but has not, explaining their reasoning and having regard to the investment firm’s rationale. When discussing the cases with the investment firm, the REA needs to be mindful of applicable professional obligations.
26. The AML/CFT report must be uploaded through a CSSF digital solution.

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 11/13
5. Submission procedures
5.1. SAQ

1. The SAQ must be approved and electronically signed by the authorised management before
   submitting it to the CSSF13.
2. The SAQ must be transmitted on an annual basis14 to the CSSF in an electronic form via a
   CSSF digital solution within three months after the end of the financial year, in accordance with the procedure described in Section 5.3.
   5.2. Reports prepared by the REA
3. The AUP report(s), the MiFID report and the AML/CFT report must include the digital
   signature of the partner in charge of the mandate with the audit firm s/he represents.
4. The REA submits the AUP report(s) to the investment firm, which can provide comments on
   the findings identified by the REA. These comments do not form part of the AUP report(s). The AUP report(s) must be submitted subsequently by the investment firm to the CSSF.
5. The REA submits the MiFID report and the AML/CFT report to the investment firm, which
   submits them subsequently to the CSSF.
6. These three reports must be transmitted by the investment firm to the CSSF in electronic
   form via a CSSF digital solution within seven months after the end of the financial year, in accordance with the procedure described in Section 5.3.
   5.3. Practical rules
7. Procedures and explanations on the practical modalities regarding the preparation and
   transmission of (i) the SAQ, (ii) the AUP report(s), (iii) the MiFID report and (iv) the AML/CFT report will be available to investment firms and their REA, on the website of the CSSF.
8. A user guide “Authentication and user account management” is available to investment firms
   via the eDesk portal of the CSSF.
   13 The CSSF will only have access to the answers of the investment firm once the SAQ is approved and uploaded (i.e. the CSSF has no access to preliminary answers provided in the draft SAQ by the investment firm). 14 It has to be noted that the CSSF digital solution includes a roll-forward functionality that will allow investment firm to update the SAQ of year N+1 based on the answers provided in the SAQ of year N.

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 12/13
6. Final provisions

1. This circular shall apply with immediate effect.
   Claude WAMPACH
   Director
   Marco ZWICK
   Director
   Jean-Pierre FABER
   Director
   Françoise KAUTHEN
   Director
   Claude MARX
   Director General
   Annex I Overview of the scope of application of Circular CSSF 24/853 as amended by
   Circulars CSSF 25/870 and 26/904

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 13/13
Annex I: Overview of the scope of application of Circular CSSF 24/853 as amended by
Circulars CSSF 25/870 and 26/904
Questionnaire / Report required
Full Scope IF Partial Scope IF
SAQ Required Required
AUP report Required Exempted
MiFID report Required Required
AML/CFT report Required Required