Circular CSSF 25/870 amending Circular CSSF 24/853 on the revised long form report for investment firms

CIRCULAR CSSF 25/870
1/17
Circular CSSF 25/870
Update of Circular CSSF
24/853 on the Long Form
Report -
Practical rules concerning the self-assessment questionnaire to be submitted by investment firms Mission and related reports of the réviseurs d’entreprises agréés (approved statutory auditors)

CIRCULAR CSSF 25/870
2/17
Circular CSSF 25/870
Update of Circular CSSF 24/853 on the Long Form Report - Practical rules concerning the self-assessment questionnaire to be submitted by investment firms Mission and related reports of the réviseurs d’entreprises agréés (approved statutory auditors) To investment firms and Luxembourg branches of non-EU investment firms Luxembourg, 9 January 2025 Ladies and Gentlemen, The purpose of this circular is to amend Circular CSSF 24/853 on the revised long form report (revised LFR) by enlarging its scope of application for the financial year ending 31 December 2024 compared to 31 December 2023. Whereas, for the financial year ending 31 December 2023, the revised LFR was applicable only to a sample of investment firms, namely (i) all non-SNI IFR investment firms1 incorporated under Luxembourg law, including their branches2 and (ii) certain3 SNI IFR investment firms4 incorporated under Luxembourg law, including their branches, the requirements with regard to the revised LFR now apply to all investment firms for the financial year ending 31 December 2024. However, considering the principle of proportionality, the CSSF introduces a reduced scope of the requirements for the investment firms that are subject to the provisions of Circular CSSF 24/853 for the first time as from the year ending 31 December 2024, as regards the reports to be prepared by their réviseur d’entreprises agréé. These investment firms5 (the Partial Scope IF) are exempted from the requirement to submit the Agreed Upon Procedure (AUP) reports as part of their revised LFR. However, the report on the protection of financial instruments and funds belonging to clients to be produced in accordance with the Grand-ducal Regulation of 30 May 2018 and the report on anti-money laundering and countering the financing of terrorism (AML/CFT) based on Articles 49(2) and 49(3) of CSSF Regulation No 12-02 of 14 December 2012 are mandatory for all investment firms and shall therefore also be submitted by these investment firms. Finally, certain investment firms may be exempted by the CSSF from this Circular notably where the requirements would represent an undue burden, in consideration of their specific and exceptional situation (e.g. investment firms that have announced the winding down of their operations). These investment firms remain subject to Circular CSSF 03/113. 1 As defined in point (9a-2) of Article 1 of the Law of 5 April 1993 on the financial sector, as amended (the LFS). 2 As of the date of issuance of this circular, there is no CRR investment firm as defined in point (9a) of Article 1 of the LFS being incorporated in Luxembourg nor are there Luxembourg branches of third-country investment firms. 3 The In-Scope Class 3 IF concerned have been selected by the CSSF using a risk-based approach, considering certain representative risk attributes (e.g. business model, size). They were informed bilaterally that they are required to submit the revised LFR for the financial year ending 31 December
2023. 4 Small and non-interconnected investment firms as set out in Article 12(1) of Regulation (EU) 2019/2033. 5 Certain SNI IFR investment firms incorporated under Luxembourg law, including their branches which, by reference to their risk attributes, represent a comparably lesser risk.

CIRCULAR CSSF 25/870
3/17
Please refer to Annex 1 for the details of the amendments to Circular CSSF 24/853. Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General
Annex 1: Circular CSSF 24/853, as amended by Circular CSSF 25/870

CIRCULAR CSSF 25/870
4/17
Annex 1: Circular CSSF 24/853 as amended by Circular CSSF
25/870
LONG FORM REPORT – Practical rules concerning the self￾assessment questionnaire to be submitted by investment firms Mission and related reports of the réviseurs d’entreprises agréés (approved statutory auditors) To investment firms and Luxembourg branches of non-EU investment firms Luxembourg, 30 January 2024 Ladies and Gentlemen, The purpose of this circular is to introduce the key aspects of the revised long form report (the revised LFR) that will applyies to all investment firms as from the financial year ending on 31 December 2024. for the financial year ending 31 December 2023 for the first time for a sample of investment firms, namely all non-SNI IFR investment firms6 incorporated under Luxembourg law, including their branches (the In-Scope Class 2 IF) 7 and certain8 SNI IFR investment firms9 incorporated under Luxembourg law, including their branches (the In-Scope Class 3 IF), (hereafter collectively the In-Scope IF). Class 3 IF that are out of scope of the revised LFR are required to submit the long form report drawn up in accordance with Circular CSSF 03/113 for the financial year ending 31 December 2023. As from the financial year ending after 31 December 2023, all investment firms will be subject to the revised LFR. The revision of the long form report is the result of a thorough reconsideration of its objective, scope and content in order to realign it with the supervisory and prudential points of focus of the CSSF. Accordingly, the revised LFR has been designed with a view to allowing the CSSF to obtain relevant information as regards investment firms’ compliance with key regulatory provisions. In this view, the revised LFR allows the CSSF to gather sufficient information all the while further facilitating the implementation of a risk-based approach to supervision. In the review process, due consideration has been given to the principle of proportionality, as investment firms will only be required to provide information that is both relevant against the background of their business model and incremental compared to information already provided by them to the CSSF via other reporting obligations and channels, thus reducing redundancies between existing reports. With respect to its form and in line with the CSSF’s digital strategy (CSSF 4.0), the revised LFR turns digital to allow a more efficient reporting processing and ease data analysis. Its completion and submission will be are required through the dedicated channel via the online portal of the CSSF. 6 As defined in point (9a-2) of Article 1 of the Law of 5 April 1993 on the financial sector, as amended (the LFS). 7 As of the date of issuance of this circular, there is no CRR investment firm as defined in point (9a) of Article 1 of the LFS being incorporated in Luxembourg nor are there Luxembourg branches of third-country investment firms. 8 The In-Scope Class 3 IF concerned have been selected by the CSSF using a risk-based approach, considering certain representative risk
attributes (e.g. business model, size). They were informed bilaterally that they are required to submit the revised LFR for the financial year ending 31 December 2023. 9 Small and non-interconnected investment firms as set out in Article 12(1) of Regulation (EU) 2019/2033.

CIRCULAR CSSF 25/870
5/17
.
Table of Contents

1. Scope of application....................................................................................................... 6
2. Overview of the revised LFR............................................................................................ 6
3. The self-assessment questionnaire (SAQ) ......................................................................... 7
4. The mission of the REA .................................................................................................. 8
   4.1. The AUP report(s) .................................................................................................... 8
   4.2. The MiFID report...................................................................................................... 9
   4.3. The AML/CFT report ................................................................................................. 9
5. Submission procedures ................................................................................................ 13
   5.1. SAQ ..................................................................................................................... 13
   5.2. Reports prepared by the REA................................................................................... 13
   5.3. Practical rules........................................................................................................ 13
6. Final provisions ........................................................................................................... 14

CIRCULAR CSSF 25/870
6/17

1. Scope of application
2. This Circular applies in full to all non-SNI IFR investment firms1
   incorporated under
   Luxembourg law, including their branches (the In-Scope Class 2 IF) 2 and certain3 SNI IFR investment firms4 incorporated under Luxembourg law, including their branches (the In￾Scope Class 3 IF), hereafter collectively the Full-Scope IF.
3. It also applies to Class 3 IF that by reference to their risk attributes represent a comparably
   lesser risk. These Class 3 IF are not subject to all the requirements of this Circular and are therefore designated as Partial Scope IF. In accordance with the principle of proportionality, the CSSF may adapt the requirements with respect to a specific Partial Scope IF on a case-by-case basis if the CSSF concludes that the IF’s risk profile5 has changed.
   1.2. Overview of the revised LFR
4. The revised LFR comprises four parts that shall be produced on a yearly basis in principle:

1. a Self-Assessment Questionnaire (the SAQ) to be filled in on a yearly basis by the
   investment firms. The requirement to complete an SAQ is based on the powers of the CSSF to obtain information from investment firms in the context of its legal supervisory mandate and in particular Article 53(1), second subparagraph, points (1) and (2) of the Law of 5 April 1993 on the financial sector, as amended (the LFS) and Article 45(2), points (1) and (2) of the Law of 30 May 2018 on markets in financial instruments, as amended (the MiFID Law);
2. an Agreed-Upon Procedures report to be prepared by the réviseurs d’entreprises agréés
   (approved statutory auditors, the REA) of the investment firms in accordance with the International Standard on Related Services (ISRS) 4400 (Revised), in application of the legal provisions which authorise the CSSF to request an REA to carry out an audit in relation to one or more specific aspects of the activities and operations of institutions (Article 54(2) of the LFS and Article 45(2), point (9) of the MiFID Law) (the AUP report6). Each year, the annual AUP report shall cover a sub-set of relevant MiFID aspects, whereas the AUP three-year-cycle will ensure the coverage of all relevant MiFID areas over a period of three (3) years; 1 As defined in point (9a-2) of Article 1 of the Law of 5 April 1993 on the financial sector, as amended (the LFS). 2 As of the date of issuance of this circular, there is no CRR investment firm as defined in point (9a) of Article 1 of the LFS being incorporated in Luxembourg nor are there Luxembourg branches of third-country investment firms. 3 The In-Scope Class 3 IF concerned have been selected by the CSSF using a risk-based approach, considering certain representative risk attributes (e.g. business model, size). They were informed bilaterally that they were required to submit the revised LFR for the financial year ending 31 December 2023. 4 Small and non-interconnected investment firms as set out in Article 12(1) of Regulation (EU) 2019/2033. 5 For this reassessment the CSSF considers all information available and assesses in particular whether the nature, size and complexity including the risks of the entity as a whole or of a specific risk attribute have changed. 6 This report must also cover the branches that the investment firm incorporated under Luxembourg law has abroad.

CIRCULAR CSSF 25/870
7/17
3) a separate report on the protection of financial instruments and funds belonging to
clients as required by Article 7 of the Grand-ducal Regulation of 30 May 20187 (the MiFID GDR) to be prepared on a yearly basis by the REA (the MiFID report8); and
4) a separate report on the procedures set up by the investment firm concerning anti￾money laundering and countering the financing of terrorism based on Articles 49(2) and
49(3) of CSSF Regulation No 12-02 of 14 December 2012 (the RCSSF 12-02) 9 to be prepared on a yearly basis by the REA (the AML/CFT report). Partial Scope IF subject to the revised LFR for the first time for the financial year ending 31 December 2024 are exempted from the submission of the AUP report for the AUP three￾year-cycle starting at the financial year ending 31 December 2024. Please refer to Annex II.
2. The revised LFR shall apply to investment firms on an individual basis only10. No consolidated
revised LFR is required where an investment firm is subject to supervision on a consolidated basis by the CSSF.
2.3. The four parts of the revised LFR form a single document. The SAQ to be completed by the
investment firms represents a key element for defining the contents of the mission of the REA. The REA’s mission is not to validate the SAQ. However, considering the interlinkages between the SAQ and the AUP and MIFID reports of the REA, the REA shall take contact with the CSSF11 should material errors having an impact on the extent of their work required under section 4 of this Circular be identified in the SAQ.
2.3. The self-assessment questionnaire (SAQ)

1. The aim of the SAQ is to receive relevant and precise information in digital form with respect
   to governance and MiFID topics.
2. The SAQ is composed of a “General information” section and 6 thematic sections. For more
   detailed information, please refer to Annex I.
3. To give due consideration to the varying business models of investment firms, the purpose
   of the “General information” section is to activate, based on the answers provided by the investment firmIn-Scope IF, only those thematic sections that are actually relevant against the background of an investment firm’s given business model.
4. The information communicated by the In-Scope IFinvestment firm via the SAQ shall be
   accurate and as concise as possible and be in line with the prudential reporting figures as at the end of the financial year, where applicable.
5. The In-Scope IFinvestment firm is required to upload specific supporting documents as
   attached documents in the SAQ (e.g. organisation chart, IT flowchart, outsourcing register, summary report of the internal audit function). 7 Grand-ducal Regulation of 30 May 2018 on the protection of financial instruments and funds belonging to clients, product governance obligations and the rules applicable to the provision or reception of fees, commissions or any monetary or non-monetary benefits, as amended. 8 This report must also cover the branches that the investment firm incorporated under Luxembourg law has abroad. 9 CSSF Regulation No 12-02 of 14 December 2012 on the fight against money laundering and terrorist financing, as amended. 10 Except for Section 6 of the SAQ “Recommendations or observations raised”. 11 In accordance with Article 54 (3) point 2.a of the LFS.

CIRCULAR CSSF 25/870
8/17
3.4. The mission of the REA

1. Investment firms shall mandate in writing their REA to prepare, on annual basis, the reports
   listed below. The REA shall be the REA appointed by the investment firm for the statutory audit of its annual accounts. 3.1.4.1.The AUP report(s)
2. The agreed-upon procedures (the AUP) shall be performed in accordance with the ISRS)
   4400 (Revised) applicable to “Agreed-Upon Procedures Engagements”.
3. The REA’s findings shall be clearly documented in the AUP report(s) to be filled in using a
   CSSF digital solution.
4. The AUP report is composed of individual thematic sections. Depending on the individual
   business model of an investment firm, certain thematic sections or procedures of the AUP may not be (fully) applicable. In this case, the REA shall explicitly mention it.
5. The REA shall perform the AUP by using predefined sample sizes, as further specified in the
   relevant AUP thematic sections.
6. As regards the sample selections (e.g., clients, orders) by the AUP thematic section, the
   following guiding principles shall apply:
   a. the In-ScopeFull-Scope IF shall provide the REA with all relevant and complete information pertaining notably to its client database (e.g., client name, client reference, country of residence, date of account opening, MiFID categorisation, client risk profile), its transaction database (e.g., client reference, order reference, ISIN code of the financial instruments, type of financial instruments, nature of the order) and the nature of services effectively provided (discretionary asset management, advisory, execution only) to allow the REA to select a representative sample; b. the REA shall determine samples that are sufficiently diversified and representative in order to accurately reflect the composition of the In-ScopeFull-Scope IF’s client structure and the nature of the transactions performed. In this context, the REA shall notably provide an indication of the relative importance of the sample (for example, the number of the reviewed client files compared to the total number of client files of a specific nature) compared to the total population;
   c. the REA shall describe, if applicable, additional key elements taken into consideration for
   the composition of the sample.
7. The REA shall provide a detailed and meaningful description of the findings, if any, by type
   of clients, transactions and/or financial instruments.

CIRCULAR CSSF 25/870
9/17
3.2.4.2.The MiFID report
8. The MiFID report shall cover the adequacy of the arrangements under Article 37-1(7) and
(8) of the LFS, Article 13(4) of the Law of 5 August 2005 on financial collateral arrangements, as amended, and Section 2 of Chapter 1 of the MiFID GDR.
9. The purpose of the MiFID report is to assess the reliability of the answers provided by an
investment firm in the SAQ in relation to the protection of financial instruments and funds belonging to clients.
10. The authorised management of the investment firm is responsible for providing the REA with
the required information in the SAQ for the drafting of the descriptive parts of the MiFID report.
11. The structure of the MiFID report shall follow the structure of the relevant section of the SAQ
on the protection of financial instruments and funds belonging to clients.
12. The REA shall include in the MiFID report the descriptive elements provided by the
investment firm’s authorised management in the SAQ.
13. In this context, the REA shall (including on the reconciliation process of financial instruments
and funds belonging to clients):
a. verify and ensure that these elements are correct and adequate; b. assess the appropriateness of the description provided by the investment firm; and
c. perform appropriate control procedures to corroborate assertions set forth by the
investment firm in the SAQ.
Where applicable, the REA shall supplement the descriptive elements by items s/he deems appropriate. Where a specific item does not apply to the investment firm, the REA shall explicitly state it under the item concerned.
14. The REA shall describe the work performed and the findings, if any, and, where applicable,
provide additional information on the aspects of the SAQ., in accordance with point 16 of this section.
15. The MiFID report must be uploaded through a CSSF digital solution.
3.3.4.3.The AML/CFT report
16. The AML/CFT report shall describe the procedures set up by the investment firm concerning
the prevention of money laundering and terrorist financing as required for compliance with or as defined in:

• Chapter 5 of Part II of the LFS;
• the Law of 12 November 2004 on the fight against money laundering and terrorist
  financing, as amended (the AML/CFT Law);
• the Grand-ducal Regulation of 1 February 2010 providing details on certain provisions of
  the amended Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended (the Grand-ducal Regulation 2010);

CIRCULAR CSSF 25/870
10/17

• Regulation (EU) 2015/847 of the European Parliament and of the Council of 20 May 2015
  on information accompanying transfers of funds, as amended (the Regulation (EU) 2015/84712);
• international acts on the fight against terrorist financing brought to the attention of the
  investment firms through CSSF circulars;
• CSSF regulations on the fight against money laundering and terrorist financing;
• CSSF circulars relating to AML/CFT.

17. The AML/CFT report shall provide, in particular:

• the description of the AML/CFT policy set up by the investment firm in order to prevent
  money laundering and terrorist financing, the verification of its compliance with the provisions of Part II, Chapter 5 of the LFS, the AML/CFT Law, the Grand-ducal Regulation 2010, the Regulation (EU) 2015/847, the CSSF regulations and the CSSF circulars relating to AML/CFT and the control of their sound application;
• the assessment of the investment firm’s analysis of money laundering and terrorist
  financing risks to which it is exposed. The REA must verify if the implemented procedures, infrastructures and controls, as well as the scope of the AML/CFT measures are appropriate considering the money laundering or terrorist financing (ML/FTF) risks to which the investment firm is exposed, particularly through its activities, the nature of its customers and the provided products and services;
• a declaration on whether an audit of compliance with the investment firm's AML/CFT
  policy has been performed by the internal audit function and the compliance officer in charge of the control of compliance with the professional obligations13;
• a short description of the training and awareness-raising measures for employees as
  regards money laundering and terrorist financing, and, in particular, with respect to the identification of money laundering and terrorist financing transactions;
• statistics concerning the detected suspicious transactions which indicate the number of
  suspicious transaction cases reported to the FIU by the investment firm, as well as the total amount of funds involved during the financial year;
• the control of the application of the provisions of Regulation (EU) 2015/847 by the
  investment firm, in its respective role, and the percentage of the transfers of funds for which data on the payer or payee were missing or incomplete and the measures taken in this context by the investment firm. The AML/CFT report shall also provide:
• a description of roles and responsibilities with regard to AML/CFT within the investment
  firm, including the roles and responsibilities of and the interactions between the management and the different departments and services, indicating the corresponding number of staff involved on AML/CFT matters. The AML/CFT report shall also include a description of the committees and the corresponding hierarchical and functional structures by indicating the general and particular delegations of power with respect to AML/CFT. It shall also provide a description by the investment firm and an assessment 12 which has been replaced by the Regulation (EU) 2023/1113 which applies as of 30 December 2024. Please refer to draft bill 8387 which will operationalise said regulation. 13 As defined in Article 1(1) of RCSSF 12-02.

CIRCULAR CSSF 25/870
11/17 by the REA of the three-lines-of-defence model, as defined in Article 39(7) of RCSSF 12- 02;

• the list of persons involved in AML/CFT matters, as referred to in RCSSF 12-02 and
  Circular CSSF 20/758 on central administration, internal governance and risk management, as amended (compliance officer, person responsible for compliance, Chief Compliance Officer, etc.). It shall also state all the changes with regard to these persons which occurred during the financial year. Since these persons may delegate to members of staff certain operational tasks in relation to these functions, the AML/CFT report shall provide, where appropriate, a description of the delegation mechanism;
• a description of the network of national agencies, national and foreign subsidiaries, the
  branches abroad, the foreign representative offices and the tied agents, as well as the main related ML/FT risks. The AML/CFT report shall also indicate if the investment firm uses the services of external managers as regards the clients' assets and shall, where appropriate, provide a description of the manner in which the relationships with external managers are managed and documented from an AML/CFT perspective;
• a description of the investment firm’s commercial policy as well as the strategy regarding
  the management of the related ML/FT risks. It shall also include a description of how the investment firm monitors and ensures compliance with its internal objectives with regard to ML/FT risk management. The REA shall assess if the investment firm has sufficient financial resources and the appropriate infrastructure to control ML/FT risks to which it is exposed.

18. When determining the sample, the CSSF expects the REA to apply a risk-based approach,
    taking into account the different business activities performed. The REA shall state the reference date of the sample data and provide relevant information on the methodology adopted for determining the sample (for example, the number of files reviewed compared to the total number of clients). Where the REA identifies cases of non-compliance with the legal or regulatory provisions or deficiencies, the REA shall give detailed indications enabling the CSSF to assess the situation (number of pending incomplete files as a percentage of the total number of reviewed files, details of the deficiencies identified, etc.).
19. Where applicable, the AML/CFT report must encompass the investment firm's branches,
    majority-owned subsidiaries abroad and tied agents. It must cover, in particular, the branches', majority-owned subsidiaries' and tied agents’ compliance with the applicable provisions as regards the prevention of money laundering and terrorist financing and it must include, in that respect:

• an analysis of money laundering and terrorist financing risks incurred by the branches,
  majority-owned subsidiaries and tied agents;
• a description and assessment of the money laundering and terrorist financing risk
  management in the branches, majority-owned subsidiaries and tied agents;
• the verification of the implementation of, and compliance with, the investment firm's
  AML/CFT policy in the branches, majority-owned subsidiaries and tied agents.

CIRCULAR CSSF 25/870
12/17
20. The AML/CFT report must be sufficiently exhaustive and transparent, providing detailed
descriptions and assessments, in order to allow a precise and informed judgement on the risks incurred by the investment firm with respect to money laundering and terrorist financing. With regard to the language used for the assessments, the AML/CFT report shall not include imprecise negative formulations (e.g. “We did not encounter serious weaknesses”) or global and approximative assessments (e.g. “We noted that most of the points comply with the laws and regulations”). The AML/CFT report shall rather provide a positive assessment for each area and subject by providing an overview of the adopted methodology (e.g. use of the sample technique, method for selecting the sample, etc.) and, where applicable, provide a description of the identified findings in order to allow the CSSF to better understand and judge the extent of the noticed irregularities and weaknesses.
21. The REA shall also perform the follow-up to the findings observed during the previous audits
and described in detail in the previous AML/CFT report.
22. The REA shall provide a description of any potential issues in relation to AML/CFT the
investment firm may have with foreign competent authorities.
23. The authorised management of the investment firm is responsible for providing the REA with
the required information for the drafting of the descriptive parts of the AML/CFT report. The REA may include in its report descriptive elements directly provided by the investment firm’s authorised management, but s/he shall verify and ensure that these elements are correct and adequate. If needed, s/he may have to perform some amendments.
24. In addition to the descriptive parts, the REA shall perform independently a detailed
assessment of the ML/FT risks to which the investment firm is exposed as well as of the organisational aspects. This assessment shall be duly documented.
25. It should be noted that the REA must also inform the CSSF of all the suspicious transactions
reported pursuant to Article 5 of the AML/CFT Law, and which concern the investment firms. Similarly, the REA must inform the CSSF in case they deem that the investment firm should have reported a suspicious transaction but has not, explaining his/hertheir reasoning and having regard to the investment firm’s rationale. When discussing the cases with the investment firm, the REA needs to be mindful of applicable professional obligations.
26. The AML/CFT report must be uploaded through a CSSF digital solution.

CIRCULAR CSSF 25/870
13/17
4.5. Submission procedures
4.1.5.1.SAQ

1. The SAQ must be approved and electronically signed by the authorised management before
   submitting it to the CSSF14
   .
2. The SAQ must be transmitted on an annual basis15 to the CSSF in an electronic form via a
   CSSF digital solution within three months after the end of the financial year, in accordance with the procedure described in Section 54.3.
3. By derogation, Partial Scope IF submitting the revised LFR for the first time shall provide
   their self-assessment questionnaire for the financial year ending 31 December 2024
4. For the financial year ending 31 December 2023, the self-assessment questionnaire must be
   transmitted within four months after the end of the financial year.
   4.2.5.2.Reports prepared by the REA
   3.4. The AUP report(s), the MiFID report and the AML/CFT report must include the digital
   signature of the partner in charge of the mandate with the audit firm s/he represents.
   4.5. The REA submits the AUP report(s) to the investment firm, which can provide comments on
   the findings identified by the REA. These comments do not form part of the AUP report(s). The AUP report(s) must be submitted subsequently by the investment firm to the CSSF.
   5.6. The REA submits the MiFID report and the AML/CFT report to the investment firm, which
   submits them subsequently to the CSSF.
   6.7. These three reports must be transmitted by the investment firm to the CSSF in electronic
   form via a CSSF digital solution within six seven months after the end of the financial year, in accordance with the procedure described in Section 54.3.
5. By derogation, Ffor the financial year ending 31 December 20243, the three reports must
   be transmitted within seven months after the end of the financial year.
   4.3.5.3.Practical rules
6. Procedures and explanations on the practical modalities regarding the preparation and
   transmission of (i) the SAQ, (ii) the AUP report(s), (iii) the MiFID report and (iv) the AML/CFT report will be available to investment firms and their REA, on the website of the CSSF.
7. A user guide “Authentication and user account management” will beis available to
   investment firms via the eDesk portal of the CSSF.
   14 The CSSF will only have access to the answers of the investment firm once the SAQ is approved and uploaded (i.e. the CSSF has no access to preliminary answers provided in the draft SAQ by the investment firm). 15 It has to be noted that the CSSF digital solution includes a roll-forward functionality that will allow investment firm to update the SAQ of year N+1 based on the answers provided in the SAQ of year N.

CIRCULAR CSSF 25/870
14/17
5.6. Final provisions

1. This circular shall apply with immediate effect.
2. This circular shall apply with immediate effect only to In-Scope IF since only In-Scope IF are
   required to submit the revised LFR for the financial year ending 31 December 2023.
3. This circular will ultimately apply to all investment firms as from the financial year ending
   after 31 December 2023 since all investment firms are required to submit the revised LFR as from this date.
4. Part 3 “Annual long form audit report” and Part 4 “Consolidated long form audit report” of
   Circular CSSF 03/113, as amended by Circulars CSSF 10/486 and CSSF 21/768, related to practical rules concerning the role of the réviseurs d’entreprises agréés (approved statutory auditors) in investment firms no longer apply from the respective dates of entry into force of this circular, as provided for in paragraphs 1 and 2 of this section. Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General
   Annex I Overview of the SAQ sections and the level of application of each section
   Annex II Overview of the scope of application of Circular CSSF 24/853 as amended by
   Circular CSSF 25/870

CIRCULAR CSSF 25/870 15/17
Annex 1I: Overview of the SAQ sections and the level of application of each section
Section Description Level of application
Internal governance
1.a. Governance - Management body and key function holders Overview of the composition of the management body and key function holders and of the allocation of role and responsibilities within the investment firm. on an individual basis, excluding branches, if any. 1.b. Governance - Internal governance arrangements Overview of the organisation and functioning of the management body, of the internal control functions, of the financial and accounting function and IT function as well as internal governance arrangements pertaining to the code of conduct, the management of conflicts of interest, the remuneration policy of the investment firm. on an individual basis, excluding branches, if any. MiFID 2.a. MiFID internal control framework Overview of internal control framework regarding MiFID implemented by the investment firm, taking into account the MiFID investment activities effectively carried out and MiFID service effectively provided by the investment firm. on an individual basis, excluding branches, if any. 2.b. MiFID Protection of financial instruments and funds belonging to clients Overview of the arrangements put in place by the investment firm to ensure the safeguarding of client financial instruments and funds. on an individual basis, including branches, if any. 2.c. MiFID - Portfolio managers, tied agents, business providers, representation offices and free provision of services. Overview of the portfolio managers, tied agents, business providers, representation offices as well as of the free provision of services by the investment firm within the territory of another member country of the EEA. on an individual basis, excluding branches, if any.

CIRCULAR CSSF 25/870 16/17
Section Description Level of application
Other topics
3. Table listing the claims
Overview of the claims registered by the investment firm during the financial year in accordance with CSSF Regulation No 16-07 relating to out-of-court complaint resolution and Circular CSSF 17/671. on an individual basis, including branches, if any.
4. Foreign branches
Overview of the foreign branches, including a description of how corporate, commercial and risk group policies are applied in the foreign branches, as well as an overview of the controls in place. Foreign branches located in another Member State or in a third country.
5. Related parties
Overview of the internal control framework in place in connection with related parties. on an individual basis, including branches, if any.
6. Recommendations or observations raised
Overview of the recommendations and/or observations raised by the REA or internal control functions, if any. on an individual basis, including branches, if any and subsidiaries (in case of prudential consolidation) if any.

CIRCULAR CSSF 25/870
Annex II: Overview of the scope of application of Circular CSSF 24/853 as amended by
Circular CSSF 25/870
Questionnaire / Report required
Full Scope IF Partial Scope IF
SAQ Required Required
AUP report Required Exempted
MiFID report Required Required
AML/CFT report Required Required