Circular CSSF 25/898 — Update of Circular CSSF 07/325 on Provisions Relating to Credit Institutions and Investment Firms of EU Origin

Circular CSSF 25/898 Update of Circular CSSF 07/325 on the provisions relating to credit institutions and investment firms of EU origin established in Luxembourg by way of branches or exercising activities in Luxembourg by way of free provision of services (as amended by Circulars CSSF 21/765 and CSSF 22/827)

CIRCULAR CSSF 25/898 2/2 Circular CSSF 25/898 Update of the Circular CSSF 07/325 on the provisions relating to credit institutions and investment firms of EU origin established in Luxembourg by way of branches or exercising activities in Luxembourg by way of free provision of services (as amended by Circulars CSSF 21/765 and CSSF 22/827) To all credit institutions and investment firms Luxembourg, 31 October 2025 Ladies and Gentlemen, The purpose of this circular is to amend Circular CSSF 07/325 on provisions relating to credit institutions and investment firms of EU origin established in Luxembourg by way of branches or exercising activities in Luxembourg by way of free provision of services with the aim to further align the content of the self-assessment questionnaire (SAQ) with supervisory points of focus. As a result, the following thematic module has been included in the revised SAQ: • UCI administration Some existing modules have been updated either to better align with supervisory objectives or to request information in a more proportionate manner, according to the nature of banks’ activities. The list of SAQ modules and their descriptions have been removed from the circular and are now available on the CSSF website (www.cssf.lu/en/prudential-reporting-credit-institutions). Please refer to Annex I for the details of the amendments to Circular CSSF 07/325 (as amended by Circulars CSSF 21/765, CSSF 22/827 and 25/898). Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General Annex I: Circular CSSF 07/325 as amended by Circulars CSSF 21/765, CSSF 22/827 and 25/898

Circular CSSF 07/325 as amended by Circulars CSSF 21/765, CSSF 22/827 and CSSF 25/898 Provisions relating to credit institutions and investment firms of EU origin established in Luxembourg by way of branches or exercising activities in Luxembourg by way of free provision of services

In case of discrepancies between the French and the English texts, the French text shall prevail. CIRCULAR CSSF 07/325 as amended by Circulars CSSF 21/765, CSSF 22/827 and CSSF 25/898 2/13 Circular CSSF 07/325 as amended by Circulars CSSF 21/765, CSSF 22/827 and CSSF 25/898 Provisions relating to credit institutions and investment firms of EU origin established in Luxembourg by way of branches or exercising activities in Luxembourg by way of free provision of services To all credit institutions and investment firms Luxembourg, 19 November 2007 Ladies and Gentlemen, The purpose of this circular is to provide further details on the principle of freedom of establishment by way of branches and free provision of services for credit institutions and investment firms whose head office is in another Member State. The circular also provides additional information on the role of the CSSF as host authority and points out to credit institutions and investment firms whose head office is in another Member State the provisions that their Luxembourg branches must comply with under Directive 2014/65/EU of the European Parliament and of the Council on markets in financial instruments (“MiFID II Directive”), which was transposed into Luxembourg law through the Law of 30 May 2018 on markets in financial instruments (“MiFID II Law”). Most of the requirements concern both credit institutions and investment firms. Nevertheless, in certain cases, the legislator purposely differentiated between both statuses.

CIRCULAR CSSF 07/325 as amended by Circulars CSSF 21/765, CSSF 22/827 and CSSF 25/898 3/13 TABLE OF CONTENTS I. Scope .......................................................................................................................... 4 II. Luxembourg branches of credit institutions or investment firms whose head office is in another Member State (the “branch” or the “branches”)........................................................... 4 II.1. Notifications in connection with the establishment of a branch....................................... 4 II.1.1. Notification procedure for credit institutions or investment firms whose head office is in another Member State wishing to establish a branch in Luxembourg.................................... 4 II.1.2. Changes to the notification .................................................................................. 5 II.1.3. Opening of additional places of business ............................................................... 5 II.2. Branch infrastructure................................................................................................ 6 II.3. General legal framework........................................................................................... 6 II.4. Supervision of the branch ......................................................................................... 7 II.4.1. General provisions.............................................................................................. 7 II.4.2. Scope of the CSSF’s supervision........................................................................... 7 II.4.3. Instruments of supervision .................................................................................. 8

1. Periodic reports to provide to the CSSF ................................................................. 8
2. External audit .................................................................................................. 10
3. On-site inspections by the competent authority of the home Member State and the CSSF ................................................................................................................. 11 II.4.4. Measures to be taken by the CSSF in case of non-compliance by the branch with the Luxembourg provisions or in case of emergency.............................................................. 11 III. Free provision of services in Luxembourg by credit institutions and investment firms whose head office is in another Member State................................................................................ 12 III.1. Notifications relating to the freedom to provide services .......................................... 12 III.2. Non-compliance with the Luxembourg provisions by credit institutions or investment firms performing activities/services under the freedom to provide services in Luxembourg ...... 13 IV. Repealing provisions and entry into force..................................................................... 13

CIRCULAR CSSF 07/325 as amended by Circulars CSSF 21/765, CSSF 22/827 and CSSF 25/898 4/13 I. Scope

1. The circular applies to credit institutions whose head office is in another Member State1 and which provide in Luxembourg, by way of a branch or by free provision of services, activities covered by their authorisation as defined in Annex I to Directive 2013/36/EU of the European Parliament and of the Council on access to the activity of credit institutions and the prudential supervision of credit institutions (“CRD Directive”). Pursuant to the aforementioned Annex, the services and activities provided for in sections A and B of Annex I to the MiFID II Directive, when referring to the financial instruments provided for in section C of Annex I of that Directive, are subject to mutual recognition in accordance with the CRD Directive.
2. The circular also concerns investment firms whose head office is in another Member State and which provide in Luxembourg, by way of a branch or by free provision of services, investment services/activities covered by their authorisation as defined by section A of Annex I to the MiFID II Directive.
3. Where a credit institution or investment firm whose head office is in another Member State appoints a tied agent established in Luxembourg (as defined in Article 4(1)(29) of the MiFID II Directive), this tied agent shall be subject to the notification provisions as described in point II.1. and will be listed on the CSSF website in the register of tied agents established in Luxembourg. For tied agents the provisions under point II.3. apply. II. Luxembourg branches of credit institutions or investment firms whose head office is in another Member State (the “branch” or the “branches”) II.1. Notifications in connection with the establishment of a branch II.1.1. Notification procedure for credit institutions or investment firms whose head office is in another Member State wishing to establish a branch in Luxembourg
4. Article 30 of the Law of 5 April 1993 on the financial sector (“LFS”) provides that credit institutions or investment firms whose head office is in another Member State are permitted to establish themselves in Luxembourg by way of a branch after having performed in their home Member State the notification procedure as referred to in Article 35 of the CRD Directive and Article 35 of the MiFID II Directive and provided that their services/activities are covered by their authorisation and fall within Annex I to the CRD Directive or section A or B of Annex I of 1 In accordance with Article 1(14) of the LFS, “Member State” shall mean a Member State of the European Union. The States that are contracting parties to the European Economic Area Agreement other than the Member States of the European Union, within the limits set forth by this agreement and related acts are considered as equivalent to Member States of the European Union. “Another Member State” shall mean a Member State other than Luxembourg.

CIRCULAR CSSF 07/325 as amended by Circulars CSSF 21/765, CSSF 22/827 and CSSF 25/898 5/13 the MiFID II Directive. An additional authorisation procedure with Luxembourg authorities is not required. 5. Unless there is reason to doubt the adequacy of the administrative structure or the financial situation of the requesting professional, taking into account the activities envisaged, the competent authority of the home Member State shall communicate to the CSSF the notification file submitted to that authority by the notifying institution within three months of receipt of that file at the most. The CSSF shall inform the institution on how the supervision will be performed in the fields falling under its competence and shall draw its attention on the conduct of business rules, as well as on the rules of general interest governing the exercise of those services/activities. The branch may commence business on receipt of that information or, failing such information, within two months from the date of transmission of the communication by the competent authority of the home Member State. The branch informs the CSSF of the date at which business commences, which will be the date on which it will be registered on the official list of credit institutions or investment firms respectively. II.1.2. Changes to the notification 6. Any change to the information to be provided in a notification as mentioned below (Article 35(10) of the MiFID II Directive and Article 36(3) of the CRD Directive) shall be notified in writing at least one month before the change comes into force. The following information is concerned: (a) the programme of operations stating inter alia the banking and investment services/activities as well as the ancillary services which the branch intends to perform, and the organisational structure of the branch and the use, where applicable, of a tied agent; (b) the address in the host Member State from which documents may be obtained; (c) the name of the person(s) responsible for the management of the branch. 7. In accordance with Article 36(3) of the CRD Directive, credit institutions shall notify any change referred to in point 6 to the competent authority of their home Member State as well as to the CSSF. On the other hand, in accordance with Article 35(10) of the MiFID II Directive, investment firms shall notify any change as referred to in point 6 solely to the competent authority of the home Member State which shall communicate the change to the CSSF. II.1.3. Opening of additional places of business 8. A credit institution or investment firm of EU origin having a branch in Luxembourg may open additional places of business without having to use the notification procedure referred to in point II.1.1 of this circular. In accordance with Article 1(32) of the LFS, several places of business established in Luxembourg by a credit institution or investment firm whose head office is in another Member State are regarded as a single branch. 9. The credit institution or investment firm of EU origin shall designate one of the places of business as the main place of the establishment in Luxembourg. The managers of this main place shall have authority over all the places of business established in Luxembourg and shall be the contacts of the CSSF. Where opening additional places of business constitutes a change of the programme of operations and/or implies a change in the address of the main place of business,

CIRCULAR CSSF 07/325 as amended by Circulars CSSF 21/765, CSSF 22/827 and CSSF 25/898 6/13 the credit institution or investment firm of another Member State shall inform the competent authorities beforehand, in accordance with point 7 above, of the opening of additional places of business. II.2. Branch infrastructure 10. As opposed to the freedom to provide services, the establishment of a branch implies the existence in Luxembourg of an operational unit ensuring a permanent physical presence of the credit institution or investment firm. 11. On account of its geographical distance and its activity in specific markets, a Luxembourg branch enjoys a certain functional independence from its head office in the home Member State. Moreover, in the exercise of its activities, it shall comply with certain specific rules that apply under the Luxembourg legislation. These factors, together with the CSSF’s right to monitor as supervisory authority of the host Member State in accordance with its residual competences, imply that the branch, as an entity, must meet certain organisational and infrastructure requirements, as described below.

• The effective management of the branch must be exercised in Luxembourg in accordance with the rules and instructions set out by the head office of the branch. The branch in Luxembourg represents an operational entity whose staff numbers depend on the activities carried on. Another entity of the group may by no means enter into transactions on behalf of the Luxembourg branch.
• The credit institution or investment firm entrusts the management of the branch to one or more managers, of whom at least one must reside in Luxembourg. These persons must have adequate professional experience and competence.
• Any branch established in Luxembourg must have an administrative structure. All accounting and all transaction-related documents must be available at the branch. Records shall also include the recording of telephone conversations or electronic communications relating to, at least, transactions concluded when dealing on own account and the provision of client order services that relate to the reception, transmission and execution of client orders as well as those that are intended to result in such transactions, even if these conversations or communications do not result in the conclusion of such transactions or in the provision of client order services. In accordance with Article 45(5) of the LFS, the branch shall arrange for records to be kept of all services/activities and transactions undertaken by it, in accordance with the period laid down in the LFS or the Commercial Code, which shall be sufficient to allow the CSSF to monitor compliance with the requirements under the LFS and, in particular, its obligations towards clients or potential clients, without prejudice to the possibility for the competent authority of the home Member State to have direct access to these records. II.3. General legal framework

12. Branches shall respect the general legal framework (general laws, in particular as regards civil law, commercial law, labour law, AML/CFT law, law on the implementation of restrictive measures in financial matters and criminal law) applicable to all activities performed in Luxembourg.

CIRCULAR CSSF 07/325 as amended by Circulars CSSF 21/765, CSSF 22/827 and CSSF 25/898 7/13 13. Where a branch does not comply with these legal requirements, Article 46(2) of the LFS authorises the CSSF to take the necessary steps as described in point 41 below in order to remedy such situation. Articles 8-2 and 8-4 of the Law of 12 November 2004 on the fight against money laundering and terrorist financing (“AML/CFT Law”) and Article 6(4) of the Law of 19 December 2020 on the implementation of restrictive measures in financial matters provide the CSSF with similar powers. II.4. Supervision of the branch II.4.1. General provisions 14. The competent authorities of the home Member State shall be responsible for the supervision of services/activities provided by the branch without prejudice to the provisions on the competences conferred upon the CSSF by the LFS or other sectoral legislation. 15. The competent authorities of the home Member State and the CSSF shall actively cooperate in the context of their respective supervisory missions; the arrangements for this cooperation may be fixed in bilateral Memoranda of Understanding between the authorities concerned. II.4.2. Scope of the CSSF’s supervision 16. In accordance with Article 45(4) of the LFS, the supervision of investment services/activities and ancillary services which the branch provides in Luxembourg falls under the responsibility of the CSSF, which shall ensure that the branch complies with the obligations set out in Articles 37-3 (conduct of business rules when providing investment services to clients), 37-5 (obligation to execute orders on terms most favourable to the client) and 37-6 (client order handling rules) of the LFS. 17. The CSSF is also competent to ensure that the investment services/activities and ancillary services provided by the branch in Luxembourg comply with the obligations set out in Articles 14 to 26 of Regulation (EU) No 600/2014 on markets in financial instruments (“MiFIR”). 18. In accordance with Article 45(6) of the LFS, the branches shall provide the CSSF, upon request, with the information necessary to the monitoring of their compliance with the standards applicable in Luxembourg for the cases provided for in points 16 and 17 above. The information to be provided by these branches is the same information as the CSSF requires for these purposes from credit institutions and investment firms authorised in Luxembourg. 19. The supervision of the CSSF as described above is a limited exception to the principle of supervision by the competent authority of the home Member State, which remains responsible for the supervision of services/activities of branches established in Luxembourg as regards the services/activities performed within the territory of the home Member State of the credit institution or investment firm and all services/activities provided in another Member State. Indeed, all services/activities provided by a branch outside the Luxembourg territory are considered as services/activities performed by the credit institution or investment firm, and not by the branch established in Luxembourg.

CIRCULAR CSSF 07/325 as amended by Circulars CSSF 21/765, CSSF 22/827 and CSSF 25/898 8/13 20. Branches dealing only with eligible counterparties, as defined in Article 37-7 of the LFS, are exempted from the application of Articles 37-3 (conduct of business rules), with the exception of its paragraph 2a, 37-5 (best execution) and 37-6(1) (client order handling rules) of the LFS. II.4.3. Instruments of supervision

1. Periodic reports to provide to the CSSF a) Requirement for branches to report transactions on financial instruments
2. In accordance with Article 45(4) of the LFS, the CSSF is the authority competent for ensuring that the investment services/activities and ancillary services provided in Luxembourg by the branch fulfil the obligations laid down in Article 26 of MiFIR.
3. As per the provisions of Article 14 of Commission Delegated Regulation (EU) 2017/590, credit institutions and investments firms that execute transactions shall report these transactions to the competent authority of the home Member State. Where transactions are executed wholly or partly through a branch of a credit institution or an investment firm established in another Member State, the transactions shall be reported only once by the credit institution or the investment firm to the competent authority of the home Member State.
4. As a result of these provisions, credit institutions and investment firms established in another Member State shall report to the competent authority of their home Member State transactions executed through their branches established in Luxembourg. The CSSF will receive these transaction reports from the concerned competent authorities.
5. Circular CSSF 17/674 provides further clarifications on the obligation to report transactions on financial instruments b) Specific provisions relating to branches of credit institutions whose head office is in another Member State
6. In accordance with Article 45(6) of the LFS, the details and procedures of the reporting by branches are indicated in the summary of periodic information to be provided by credit institutions to the CSSF in Circular CSSF 14/593 as amended.
7. Luxembourg branches of credit institutions whose head office is in another Member State shall fill in and submit to the CSSF on a yearly basis a self-assessment questionnaire (“SAQ”). This SAQ is based on the following powers of the CSSF to obtain information from branches in the context of its legal supervisory mandate:

• Article 53(1) points (2) and (8) of the LFS;
• Article 45(2) of the MiFID II Law;
• Article 58-5 of the Law of 10 November 2009 on payment services, on the activity of electronic money institution and settlement finality in payment and securities settlement systems;

CIRCULAR CSSF 07/325 as amended by Circulars CSSF 21/765, CSSF 22/827 and CSSF 25/898 9/13

• Article 147(2) of the Law of 17 December 2010 relating to undertakings for collective investment and Article 50(2) of the Law of 12 July 2013 on Alternative Investment Fund Managers;
• Article 62(1) of the Law of 13 July 2005 on institutions for occupational retirement provision in the form of pension savings companies with variable capital (SEPCAVs) and pension savings associations (ASSEPs).

27. The sectionsindividual modules of the SAQ to be completed annually by branches and applicable exemptions are directly recorded in the CSSF’s digital solution and consists of the following sectionsare also described on the CSSF website (www.cssf.lu/en/prudential-reporting-credit￾institutions).: Section Description Exemptions MiFID Overview of the organisational and operational setup with regard to MiFID, as well as a description of investment services and financial instruments offered by the branches to their clients. This section shall include information on distribution and communication means and on the client database. Branches that did not provide any investment services or sell or advise in relation to structured deposits2 during the financial year. PSD 23 Overview of payment services and a description of the interface through which those payment services are offered to clients. Branches that did not provide any payment services during the financial year. Depositary bank Quantitative and qualitative overview of the UCI depositary function and the related services as well as a self-assessment against the main legal requirements. Branches that did not provide depositary and related services.
28. The information communicated in the SAQ shall be accurate and as concise as possible, while providing a true and fair view. The SAQ is available in digital form and will be adapted for subsequent financial years as required, including in response to developments of the legal and regulatory framework.
29. The SAQ must be reviewed and electronically signed by the authorised management and transmitted via the CSSF eDesk portal within six months after the closure of the financial year.
30. Procedures and explanations on the practical modalities regarding the preparation and transmission of the SAQ as well as the user guide “Authentication and user account management” are made available via the CSSF eDesk portal. 2 Structured deposits are defined in Article 1(7c) of the LFS. 3 Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC

CIRCULAR CSSF 07/325 as amended by Circulars CSSF 21/765, CSSF 22/827 and CSSF 25/898 10/13 c) Specific provisions relating to branches of investment firms whose head office is in another Member State 31. In accordance with Article 45(6) of the LFS, branches must submit a statistical balance sheet (and off-balance sheet) and a statistical profit and loss account. 2. External audit 32. The procedure for the external audit of branches’ accounts falls under the competence of the competent authorities of the home Member State. 33. Branches are required, however, to have a review executed by an external réviseur d’entreprises (statutory auditor) in accordance with the provisions of this circular for specific subjects on which the CSSF maintains a control responsibility as supervisory authority of their host Member State, in particular as regards compliance with the rules on the prevention of money laundering and compliance with the applicable conduct of business rules when providing investment services/activities as well as ancillary services to clients. 34. The réviseur d’entreprises agréé (approved statutory auditor, “REA”) shall prepare on a yearly basis a report on the compliance with the rules on the prevention of money laundering and the fight against terrorism (“AML/CFT”) and on the applicable conduct of business rules when providing investment services/activities as well as ancillary services to clients. The AML/CFT part of the report shall follow, as far as applicable, the provisions of section 3.2 of Circular CSSF 22/821, as amended, on the long form report. The part on the applicable conduct of business rules when providing investment services/activities as well as ancillary services to clients shall describe the arrangements under, and assess compliance with, the requirements incumbent on the branch pursuant to the scope of application defined in Article 37a of the LFS as well as the fair application of internal procedures for the implementation of the conduct of business rules. This report shall include a description of the procedures and controls in place within the branch4 as well as an appraisal by the REA. Instead of providing a single report covering both topics, the REA may provide two separate reports. 35. In accordance with Article 54(2) of the LFS, the CSSF has the right to appoint the external réviseur (auditor) of the credit institution or investment firm to execute controls at the Luxembourg branch on subjects for which the CSSF is competent. Article 8-2 of the AML/CFT Law and Article 6(4) of the Law on the implementation of restrictive measures in financial matters provide the CSSF with similar powers. 36. Where the CSSF decides to make use of this facility, it shall communicate to the managers of the branch the terms of the mandate to be given to the réviseurs. The managers of the branch shall liaise with the réviseur of the head office of the credit institution or investment firm or, where applicable, its local representative and organise the practical schedule of the audit. The branch shall communicate the audit report issued by the external réviseur to the CSSF. 4 The authorised management of the branch is responsible for providing the REA with the required information for the drafting of the descriptive parts of the report. The REA may include in its report descriptive elements directly provided by the branch’s authorised management, but s/he shall verify and ensure that these elements are correct and adequate. If needed, s/he may have to perform some amendments.

CIRCULAR CSSF 07/325 as amended by Circulars CSSF 21/765, CSSF 22/827 and CSSF 25/898 11/13 37. The REA submits the report(s) to the branch, which shall submit it/them in electronic form subsequently to the CSSF within six months after the closure of the financial year as described in Circular CSSF 19/731. 3. On-site inspections by the competent authority of the home Member State and the CSSF 38. The competent authorities of the home Member State may carry on on-the-spot verifications at the branches of credit institutions (Article 45(7) of the LFS) and investment firms (Article 45(9) of the LFS) established in Luxembourg whose head office is in another EU Member State, after having informed the CSSF. They may also request the CSSF to verify some information. In this case, the CSSF shall either carry out the verification itself or appoint a réviseur d’entreprises or any other independent expert at the expenses of the branch. 39. According to Article 9-2a(9) of the AML/CFT Law, the CSSF may act on a duly reasoned and substantiated request from a competent home authority to carry out an investigation or on-site inspection, in the framework of its duties in the field of anti-money laundering and counter terrorist financing, of persons subject to their respective supervisory powers, subject to the following conditions:

• the investigation or on-site inspection does not adversely affect the sovereignty, security or public policy of the State of Luxembourg;
• the investigation or on-site inspection is not likely to impede proceedings initiated in Luxembourg in respect of the same facts and against the same persons;
• no final judgement has been delivered in relation to such persons for the same facts in Luxembourg;
• the competent home authority grants the same right to the CSSF; and
• the competent home authority provides guarantees of professional secrecy that are at least equivalent to the professional secrecy to which the CSSF is subject. The CSSF may, upon request, allow the presence of staff of the competent home authority during the investigation or on-site inspection. The investigation or on-site inspection shall, however, be subject to the overall control of the CSSF. Where the CSSF is not able to act on such a request, it has to inform the competent home authority thereof in as detailed a manner as possible. II.4.4. Measures to be taken by the CSSF in case of non￾compliance by the branch with the Luxembourg provisions or in case of emergency

40. Article 46 of the LFS describes the precautionary measures available to the CSSF as supervisory authority of the host Member State.
41. Paragraph 1 of that Article provides that the CSSF shall refer to the competent authority of the home Member State of the credit institution or investment firm whenever it has clear and demonstrable grounds for believing that one of its branches in Luxembourg is in breach of the obligations arising from the provisions of the LFS which do not confer powers on the CSSF. If the irregular situation persists, despite the measures taken by the competent authority of the

CIRCULAR CSSF 07/325 as amended by Circulars CSSF 21/765, CSSF 22/827 and CSSF 25/898 12/13 home Member State of the credit institution or investment firm or because such measures prove inadequate, the CSSF may take, after informing the competent authority of the home Member State, all appropriate measures needed in order to protect investors or the proper functioning of the markets in Luxembourg. 42. If a branch does not comply with the requirements of the LFS which confer powers on the CSSF, the latter may address an injunction to the credit institution or the investment firm as provided for in Article 59 of the LFS. If the credit institution or investment firm concerned fails to take the necessary steps, the CSSF may take all appropriate measures to ensure that the credit institution or investment firm puts an end to the irregular situation. The CSSF shall inform the competent authority of the home Member State of the measures taken. If, despite the measures taken, the irregular situation persists, the CSSF may take, after having informed the competent authority of the home Member State, the appropriate measures to prevent or penalise further irregularities, or even prevent the credit institution or investment firm from initiating any new transaction in Luxembourg. Such measures shall be notified to the European Commission. 43. Article 46(4) of the LFS provides that, in emergencies and before following the procedure described in point 42 above, the CSSF may take any precautionary measures necessary to protect the interests of depositors, investors or others to whom services are provided. Such measures shall be notified to the European Commission and to the competent authorities of the home Member State. III. Free provision of services in Luxembourg by credit institutions and investment firms whose head office is in another Member State III.1. Notifications relating to the freedom to provide services 44. According to Article 39(1) of the CRD Directive, any credit institution whose head office is in another Member State wishing to exercise the freedom to provide services by carrying on its activities in Luxembourg for the first time shall notify the competent authorities of its home Member State of the activities it intends to carry on. These activities must be included in Annex I of that Directive. 45. According to Article 34(1) of the MiFID II Directive, any investment firm authorised and supervised by the competent authority of another Member State may exercise the freedom to provide investment services/activities as well as ancillary services in Luxembourg by way of the free provision of services, provided that such services/activities are covered by its authorisation. Ancillary services may only be provided together with an investment service/activity. The exercise of these services/activities is not subject to an additional authorisation by the CSSF. A notification to the competent authority of the home Member State is sufficient. 46. The competent authority of the home Member State shall transmit the notification of the institution to the CSSF within one month. The credit institution or investment firm may commence the provision of its services/activities in Luxembourg as soon as it is informed of this transmission.

CIRCULAR CSSF 07/325 as amended by Circulars CSSF 21/765, CSSF 22/827 and CSSF 25/898 13/13 47. Any change in the initial details included in the notification must be notified in writing to the competent authority of the home Member State at least one month before the implementation of this change, which will transmit it to the CSSF. III.2. Non-compliance with the Luxembourg provisions by credit institutions or investment firms performing activities/services under the freedom to provide services in Luxembourg 48. The provisions of point 41 of this circular also apply to credit institutions and investment firms performing activities/services under the freedom to provide services in Luxembourg. IV. Repealing provisions and entry into force 49. This circular enters into force on 19 November 2007. Circulars IML 93/100 and IML 98/147 are repealed with effect on 19 November 2007. Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General