Circular CSSF 25/903 — Update of Circular CSSF 24/850 on annual reporting and auditor engagement for support PFS

In case of discrepancies between the French and the English texts, the French text shall prevail. CIRCULAR CSSF 25/903 1/25 Circular CSSF 25/903 Update of Circular CSSF 24/850 Practical rules concerning the descriptive report and the self￾assessment questionnaire to be submitted on an annual basis by support PFS Engagement of the réviseurs d'entreprises agréés (approved statutory auditors) of support PFS and practical rules concerning the management letter and the separate report to be drawn up on an annual basis

In case of discrepancies between the French and the English texts, the French text shall prevail. CIRCULAR CSSF 25/903 2/25 Circular CSSF 25/903 Update of Circular CSSF 24/850 Practical rules concerning the descriptive report and the self￾assessment questionnaire to be submitted on an annual basis by support PFS Engagement of the réviseurs d'entreprises agréés (approved statutory auditors) of support PFS and practical rules concerning the management letter and the separate report to be drawn up on an annual basis To all support PFS Luxembourg, 23 December 2025 Ladies and Gentlemen, The purpose of this circular is to amend the provisions relating to the preparation and annual submission of the descriptive report and its annexes, the documents required as part of the accounting year-end process (including the management letter from the approved statutory auditor), the self-assessment questionnaire, and the separate report prepared by support PFSs and their réviseur d’entreprises agréés (approved statutory auditors, “REAs”). The amendments concern:

• The method of transmission of the required documents, which must now be carried out via the CSSF eDesk platform;
• An adjustment to the test rotation plan, providing in particular for a three-year cycle for entities classified as low risk. A “tracked changes” version of Circular CSSF 24/850 is available in Annex to this circular. Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General Annex Circular CSSF 24/850 as amended by Circular CSSF 25/903

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 2/25 Circular CSSF 24/850 as amended by Circular CSSF 25/903 Practical rules concerning the descriptive report and the self￾assessment questionnaire to be submitted on an annual basis by support PFS Engagement of the réviseurs d'entreprises agréés (approved statutory auditors) of support PFS and practical rules concerning the management letter and the separate report to be drawn up on an annual basis

In case of discrepancies between the French and the English texts, the French text shall prevail. CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 3/25 Circular CSSF 24/850 as amended by Circular CSSF 25/903 Practical rules concerning the descriptive report and the self￾assessment questionnaire to be submitted on an annual basis by support PFS Engagement of the réviseurs d'entreprises agréés (approved statutory auditors) of support PFS and practical rules concerning the management letter and the separate report to be drawn up on an annual basis To all support PFS Luxembourg, 19 January 2024 Ladies and Gentlemen, The purpose of this circular is to define the practical rules concerning the preparation and annual submission of the below-mentioned documents by support PFS and their réviseurs d'entreprises agréés (approved statutory auditors, “REA”). More specifically, this circular introduces, on the one hand, a self-assessment questionnaire to be completed on an annual basis by support PFS (“self-assessment questionnaire”) and to be submitted to the CSSF as a replacement of the risk assessment report (“RAR”) required under Circular CSSF 12/5441 . The self-assessment questionnaire represents the result of an in-depth review of the objective and content of the information the CSSF requests to receive on the support PFS’ self￾assessment and management of the risks to that it may expose the financial sector. It takes into account the regulatory developments and the main points that the CSSF intends to bring to the support PFS’ attention. On the other hand, this circular broadly details the role and engagement of REAs in the context of the statutory audit of support PFS. Moreover, it establishes a specific regulatory framework applicable to the management letter, and also introduces a separate report (“separate report”). The separate report includes the specific procedures that the CSSF requests the REA to perform in relation to the support PFS’ self-assessment questionnaire. Both documents must be drawn up by the support PFS’ REAs on an annual basis. Lastly, this circular adapts and simplifies the descriptive report to be provided on an annual basis by support PFS and repeals Circulars CSSF 12/544 and CSSF 19/7272 following the introduction of the new supervisory tools by this circular. 1 Circular CSSF 12/544 on the optimisation of the supervision exercised on the “support PFS” by a risk-based approach, repealed by this circular. 2 Circular CSSF 19/727 on new arrangements for the transmission of the documents required under Circular CSSF 12/544, repealed by this circular.

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 4/25 TABLE OF CONTENTS

1. Scope and legal basis..................................................................................................... 5
2. Risk-based approach...................................................................................................... 5
3. Practical rules concerning the descriptive report and the self-assessment questionnaire to be submitted by support PFS on an annual basis ......................................................................... 6 3.1. Descriptive report .................................................................................................... 6 3.2. Self-assessment questionnaire .................................................................................. 6
4. Practical rules concerning the engagement of REAs............................................................ 8 4.1. The statutory audit of a support PFS .......................................................................... 8 4.2. The management letter ............................................................................................ 8 4.3. The separate report ................................................................................................. 9
5. Obligation of the REA to report to the CSSF .................................................................... 11
6. Instructions for the preparation and filing of the expected documents ................................ 12 6.1. Documents to be submitted and submission modalities............................................... 12 6.2. Practical modalities ................................................................................................ 14
7. Entry into force ........................................................................................................... 14

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 5/25

1. Scope and legal basis This circular applies to all PFS exercising one or several support PFS activities as defined in Articles 29-1 to 29-6 of the Law of 5 April 1993 on the financial sector (“LFS”) and classified as "I" by the CSSF. Support PFS must refer to the identification codes as published on the CSSF website in the “Search Entities” application. The requirements introduced by this circular are notably based on the following legal provisions:

• the self-assessment questionnaire, as specified in Section 3.2 of this circular, is introduced pursuant to point (2) of Article 53(1) of the LFS which allows the CSSF to require or demand the provision of information from support PFS for the exercise of its functions;
• the definition of the specific regulatory framework applicable to the management letter to be drawn up by the REA, as specified in Section 4.2 of this circular, results from Article 54(1) of the LFS which allows the CSSF to set rules on the scope of the mandate for the audit of the annual accounting documents of support PFS and on the content of the reports and written comments issued by the REA;
• the separate report to be drawn up by the REA, as specified in Section 4.3. of this circular, is introduced: o pursuant to Article 49 of CSSF Regulation No 12-02 of 14 December 2012 (“RCSSF 12- 02”)3 as regards the section of the separate report relating to the prevention of money laundering and terrorist financing (Section “AML/CFT Aspects”); o pursuant to Article 54(2) of the LFS which allows the CSSF to instruct a REA to carry out audits on one or several specific aspects of the activity and operation of support PFS, as regards all the other sections of the separate report.

2. Risk-based approach The extent of the self-assessment questionnaire and of the list of specific procedures to be performed by the REA is linked to the application of the principle of proportionality and of a risk-based supervisory approach. In practice, a support PFS that is considered to be less risky will have to respond to a limited number of questions and will be subject to a smaller number of specific procedures to be performed by its REA. In this context, a rating system is put in place by the CSSF in order to determine the risk to which every support PFS is exposing the financial sector. This rating system is based on several criteria and takes into account, in particular, the nature of the activities performed that require a support PFS authorisation, the turnover, the clients of the financial sector and the size of the support PFS. Each year, and at the latest at the closing of its financial year, the CSSF will inform the support PFS of the risk category that has been assigned to it (low, medium, high). However, for the first year of application, as defined in Section 7 of this circular, the CSSF may, on an exceptional basis, provide the support PFS with this information at the latest one month after the publication of this circular. The support PFS may request the CSSF to provide details on the criteria that have been selected for the risk rating. 3 CSSF Regulation No 12-02 of 14 December 2012 on the fight against money laundering and terrorist financing, as amended

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 6/25 3. Practical rules concerning the descriptive report and the self-assessment questionnaire to be submitted by support PFS on an annual basis 3.1. Descriptive report Support PFS must provide the descriptive report on an annual basis, describing in particular their administrative and accounting organisation, internal control system, IT infrastructure and the activities provided to the financial sector. The structure of the descriptive report, as well as the list of documents expected as part of the descriptive report, are available on the website of the CSSF. When a specific section of the structure or an expected document does not apply to the support PFS, the latter shall explicitly state it. The descriptive report includes the information that must be provided in accordance with the structure set out in Annex 1 of this circular as well as the documents expected in the context of the descriptive report as detailed in Annex 2 of this circular. Where a specific item of the structure or an expected document does not apply to the support PFS, the latter shall explicitly mention it. 3.2. Self-assessment questionnaire This circular introduces a self-assessment questionnaire to be completed by support PFS for each year or period subject to statutory audit. The objective of the self-assessment questionnaire is to request support PFS to perform a self￾assessment of certain risks and of their compliance with regard to legal and regulatory requirements. The themes of the questions applicable to support PFS are determined in accordance with the activities provided to the financial sector, and thus in accordance with the authorisations held by the support PFS. The self-assessment questionnaire is split into four sections that each support PFS must fill in in accordance with the authorisation held, according to the allocation set out in Table 1 (“Allocation of the self-assessment questionnaire sections”) below.

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 7/25 Table 1 - Allocation of the self-assessment questionnaire sections Section Support PFS concerned ICT-related aspects4 - IT systems and communication networks operators of the financial sector (Article 29-3 of the LFS)

• Dematerialisation service providers of the financial sector (Article 29- 5 of the LFS)
• Conservation service providers of the financial sector (Article 29-6 of the LFS) Operational aspects5 - Client communication agents (Article 29-1 of the LFS)
• Administrative agents of the financial sector (Article 29-2 of the LFS) Transversal aspects (except “AML/CFT”)
• Client communication agents (Article 29-1 of the LFS)
• Administrative agents of the financial sector (Article 29-2 of the LFS)
• IT systems and communication networks operators of the financial sector (Article 29-3 of the LFS)
• Dematerialisation service providers of the financial sector (Article 29- 5 of the LFS)
• Conservation service providers of the financial sector (Article 29-6 of the LFS) Anti-money laundering and counter-terrorist financing aspects (“AML/CFT aspects”)
• Client communication agents (Article 29-1 of the LFS)
• Administrative agents of the financial sector (Article 29-2 of the LFS)
• IT systems and communication networks operators of the financial sector (Article 29-3 of the LFS)
• Dematerialisation service providers of the financial sector (Article 29- 5 of the LFS)
• Conservation service providers of the financial sector (Article 29-6 of the LFS) By way of derogation from the foregoing: a) Where a support PFS authorised under Articles 29-3, 29-5 or 29-6 of the LFS also holds one or more authorisations under Articles 29-1 or 29-2 of the LFS, it must only fill in the sections “ICT￾related aspects”, “Transversal aspects” and “AML/CFT aspects”; it does thus not have to complete the questions and procedures under “Operational aspects”. b) Depending on the activities carried out and the risk to that the support PFS may expose the financial sector, and as opposed to the section allocation provided for in Table 1, the CSSF may request a support PFS, on an exceptional basis, to fill in a section of the questionnaire which has not been allocated to it or, on the contrary, exempt the support PFS from providing it. The CSSF will transmit the requests as per point (b) above to the support PFS concerned at the latest at the closing of their financial year. However, for the first year of application, as defined in Section 7 of this circular, the CSSF may transmit such request to the support PFS concerned at the 4 Information and Communication Technology (ICT) 5 It should be noted that the sections covering the operational and transversal aspects also include a certain number of ICT-related questions.

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 8/25 latest one month after the publication of this circular. In the absence of such communication, support PFS must comply with the allocation as set out in Table 1. In accordance with the risk-based approach detailed in Section 2 of this circular, the number of questions that a support PFS must answer depends on the risk category that has been assigned by the CSSF to this support PFS. Hence, two support PFS with the same authorisation and that have to fill in the same sections of the self-assessment questionnaire may have to respond to a different volume of questions based on their risk category. The self-assessment questionnaire detailing the questions for each section and their allocation in accordance with the different support PFS risk categories is available on the CSSF website. Depending on the developments of the legal and regulatory requirements applicable to support PFS as well as on the prudential supervision requirements, the self-assessment questionnaire may be adapted over the coming years. 4. Practical rules concerning the engagement of REAs In accordance with Article 22(1) of the LFS, support PFS must entrust the statutory audit of their accounts to a REA on an annual basis. In this context, this circular defines, pursuant to Article 54(1) of the LFS, a specific regulatory framework applicable to the management letter that the REA will have to draw up to the attention of the persons responsible for the support PFS and the CSSF. Moreover, pursuant to Article 54(2) of the LFS and Article 49 of RCSSF 12-02, this circular introduces a separate report to be drawn up by the REA on an annual basis, in compliance with the details provided in Section 4.3 below. 4.1. The statutory audit of a support PFS Pursuant to Article 33 of the Law of 23 July 2016 concerning the audit profession, the statutory audit of a support PFS must be carried out in compliance with the international auditing standards as adopted by the CSSF. On this basis, the REA presents the results of the statutory audit in an audit report which includes its audit opinion. 4.2. The management letter This circular introduces a specific legal framework for the management letter that REAs must draw up, for each year or period subject to a statutory audit, to the attention of the persons responsible for the support PFS. The management letter must include the recommendations in the form of a table. The template for this table, which must be complied with, is available on the CSSF website. be completed by the REA through the eDesk platform. In the context of the management letter, the REA is not required to carry out any further procedures other than those already performed during the statutory audit, as referred to in Section 4.1 of this circular.

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 9/25 In accordance with the applicable auditing standards, the REA must report, in a management letter addressed to the persons responsible for the support PFS, the weaknesses and points needing improvement that it observed during its statutory audit of the support PFS, and that are, based on the REA’s professional judgement, of sufficient importance to be brought to the attention of the persons responsible for the support PFS or of the CSSF. The management letter must also include the follow-up of the weaknesses or points needing improvement raised in the management letters issued in preceding financial years and that have not been “closed” in the previous management letter, only where those weaknesses or points needing improvement relate to the statutory audit. The weaknesses and points needing improvement that are not related to the statutory audit must be followed up internally by the support PFS and must no longer be mentioned in the management letter6 . The REA must consider the weakness or point needing improvement as “closed” where the necessary corrective measures have been put in place to remedy this weakness or point needing improvement and where the persons responsible for the support PFS have put in place appropriate measures to prevent such issues from arising in the future. Moreover, every for each weakness or point needing improvement , the REA must obtainbe accompanied by t the comments of the persons responsible for the support PFS before submitting the management letter through the eDesk platform. Such comments , which must mandatorily include, among others, the following information:

• a detailed explanation of the reasons and circumstances relating to the occurrence of the weakness or point needing improvement identified by the REA;
• a detailed explanation of the measures taken or decided in order to remedy the weakness or the point needing improvement and to prevent their recurrence in the future. These measures must be complemented by a detailed remediation plan and timetable. If the persons responsible for the support PFS doid not respond in a timely manner and within a reasonable time frame to the weaknesses or points needing improvement raised by the REA in the management letter , the REA will issue this management letter specifying that no comments have been received by the persons responsible for the support PFS on the weaknesses or points raised. Where the REA did not identify any issue to be included in the management letter, the REA issues a certificate of non-issuance of a management letter. 4.3. The separate report This circular introduces a separate report to be completed by the REAs of support PFS, for each year or period for which a self-assessment questionnaire has been submitted by the support PFS. The purpose of the separate report, a model of which is available on the CSSF website, is notably to ensure the reliability of the answers provided by the support PFS in the self-assessment questionnaire and to provide answers to a set of questions determined by the CSSF. The REA that performs the tests provided for in the separate report must be the REA appointed by the support PFS to carry out the statutory audit, as referred to in Section 4.1 of this circular. 6 The approach and the expectations described in this paragraph also apply to the weaknesses and points needing improvement indicated in the reports relating to the compliance with financial sector laws, regulations and circulars issued in previous financial years.

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 10/25 The drawing-up of a separate report consists of a set of procedures, defined by the CSSF, to be implemented by the REA and that are broken down into predefined topics. Pursuant to Article 49 of RCSSF 12-02, the separate report also covers matters relating to anti￾money laundering and countering the financing of terrorism (AML/CFT), taking notably into account the “very low” risk level allocated to the support PFS sector due to the low-risk nature of their activities. Depending on the activities of a support PFS, a procedure may not be applicable. In this case, the REA must explicitly indicate this in the separate report. The procedures are directly indicated in the separate report and consist in sample testing or verifications to be carried out by the REA. The sizes of the samples are determined by the CSSF based on a risk-based approach and they must be detailed in the separate report. Similarly to the number of questions asked to support PFS as part of the self-assessment questionnaire, the number of procedures to be carried out by the REA depends on the risk category that has been assigned by the CSSF to the support PFS. Hence, two support PFS with the same authorisation and that have to fill in the same sections of the self-assessment questionnaire may have to provide separate reports with a different number of specific procedures depending on the risk category assigned to them. A rotation plan will be established for the tests to be performed by the REA based on the activities and risk categories of the support PFS, and the allocation of specific procedures according to the risk categories of the support PFS will also be directly integrated into the eDesk platform.. The REA of a support PFS authorised under Articles 29-1 and/or 29-2 of the LFS must carry out the specific procedures provided for in the sections “Operational aspects”, “Transversal aspects” and “AML/CFT aspects” every year. The REA of a support PFS authorised under Articles 29-3, 29-5 and/or 29-6 of the LFS must carry out the specific procedures in accordance with a rotation plan established by the CSSF. All the specific procedures of the separate report, their allocation in accordance with the different risk categories of support PFS and the above-mentioned rotation plan are available on the CSSF website. Depending on the developments of the legal and regulatory requirements applicable to support PFS as well as on the prudential supervision requirements, the procedures to be implemented by the REA and the rotation plan of the specific procedures may be adapted over the coming years, following the amendments that might also be made to the self-assessment questionnaire. The results of these procedures are reported by the REA in the separate report in the form of answers to a set of mainly closed-ended questions or confirmations and they do not result in an opinion in accordance with auditing, insurance or any related services standards. Any comments provided, where applicable, by the REA in the empty text fields of this the report must be concise, clear and meet the objectives and provide answers to the questions asked. The REA submits the report to the support PFS, which mustay issue comments on the observations made by the REA (providing its response – agreement or disagreement – and, where applicable, the action plan and the implementation date) before transmitting the report through the eDesk platform.

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 11/25 5. Obligation of the REA to report to the CSSF The REA is required to report to the CSSF pursuant to Article 54(3) of the LFS. Such reporting shall not only relate to adverse effects in the short term (as it is the case for the certification of annual accounts) but also in the medium and long term (objective of the prudential supervision). Consequently, the REA shall communicate to the CSSF the information of which s/he became aware while carrying out the statutory audit of a support PFS, or, where applicable, while performing any other legal or regulatory mission concerning the support PFS, and which is relevant from a prudential point of view and/or likely to require an urgent action by the CSSF. The facts to be considered are, among others, items constituting a material infringement of legislation, affecting the continuous functioning of the institution or leading to refusal to certify the accounts or to reservations thereto. The legal requirement to “promptly” report the relevant information to the CSSF does not prevent the REA from consulting first the persons responsible for the support PFS, provided that the latter are not conflicted and that the discussion does not unduly delay the transmission of information to the CSSF. As regards the communication modalities, it is understood that:

• the reporting of the REA is carried out spontaneously, in written or oral form; in case of serious problems, it is recommended that the oral communications be followed by a written confirmation as quickly as possible;
• the priority should be given to timely rather than precise and complete reporting in the first place;
• in the reporting to the CSSF, the REA shall explicitly inform on the actual or possible problems noted. Examples of facts or decisions falling or likely to fall under the reporting obligation to the CSSF include, among others, the following:
• major conflicts within the decision-making bodies of the institution;
• unexpected departure of a key function holder;
• major financial difficulties in a branch or subsidiary;
• serious deficiencies in the internal control framework;
• significant errors in the prudential reporting;
• granting of an interim dividend while the institution has insufficient or barely sufficient own funds;
• major incidents in the IT organisation or infrastructure;
• activity change without appropriate infrastructure;
• frauds likely to generate important losses;
• important legal disputes;
• inappropriate assessment in relation to a merger/split project of undertakings. As a reminder, Article 54(4) of the LFS guarantees that the disclosure in good faith to the CSSF by a REA of any fact or decision as referred to in paragraph 3 of that Article shall not constitute a violation of the obligation of professional secrecy or a breach of any restriction on disclosure of information imposed by contract, and shall not expose that REA to liability of any kind.

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 12/25 6. Instructions for the preparation and filing of the expected documents 6.1. Descriptive report and documents expected in the context of the descriptive report and of the financial year￾endDocuments to be submitted and submission modalities All documents to be submitted in the context of this cCircular must be transmitted in electronic form through the eDesk platform:

• The descriptive report and its annexes ;
• The documents required in the context of the financial year-end (including the REA’s management letter) ;
• The self-assessment questionnaire ;
• The separate report. The descriptive report and the self-assessment questionnaire must be electronically approved and signed by the authorised management prior to their transmission to the CSSF. The separate report and the management letter issued by the REA must be electronically signed by the partner in charge of the mandate within the audit firm s/he represents. Once signed, these documents must be submitted by the support PFS to the CSSF. All documents must be transmitted at the latest within seven months following the closing date of the financial year of the support PFS. As soon as it comes to their attention, the support PFS must inform the CSSF of any reported delay and indicate the reasons for and the probable duration of the delay. In case of withdrawal or deregistration of the support PFS from the official list held by the CSSF during the year, the self-assessment questionnaire and the separate report covering the period from the last financial year-end to the date of withdrawal or deregistration will, in principle, be required within the same seven-month time frame. The above-mentioned submission deadlines may be reviewed by the CSSF for subsequent financial years. The procedure available on the eDesk platform will clearly specify the documents to be submitted; an exhaustive list of the required documents will also be published on the CSSF website. 6.1. Descriptive report and documents expected in the context of the descriptive report and of the financial year￾end The descriptive report and the documents expected in the context of the descriptive report, as introduced in Section 3.1 of this circular, as well as the documents expected in the context of the

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 13/25 financial year-end as detailed in Annex 2 of this circular7 must be transmitted in electronic form8 , and in the original file format made available by the CSSF for certain annexes (as detailed in Annex 2 of this circular) within seven months after the closure of the support PFS’ financial year, at the latest. Moreover, any document with a handwritten signature, and, in particular, the cover letter accompanying these documents, must also be transmitted on paper. For instance, for descriptive reports, only the signed pages must be transmitted on paper. For each document received in digital form, the name of the file must include the prefix set out in Annex 2 of this circular and the internal CSSF “Ixxx” identification number must be added, as well as the year concerned, formatted as “yyyy” here below. For instance, the file including the descriptive report for support PFS “I102” for the financial year closing on 31 December 2023 will be named “I102-2023-RD-0”. Moreover, the descriptive report must be submitted in two versions: a final version (without comments) and a “track changes”9 version identifying all the changes as compared to the previous financial year. The documents must be transmitted in a secured way and deposited with the CSSF through its online MFT system. To obtain an ID allowing to connect to the online system, the support PFS concerned must provide the following information to the CSSF, at the email address psfsupport@cssf.lu:

• Identification number allocated by the CSSF (“Ixxxx”)
• Name of the company
• Last name and first name of the contact person for the transmission
• Contact email address (only a generic email address will be accepted)
• Contact phone number. As soon as it comes to their attention, the support PFS must inform the CSSF of any reported delays and indicate the reasons for and the probable duration of the delay. 6.2. Self-assessment questionnaire Before submitting the self-assessment questionnaire to the CSSF, the persons responsible for the support PFS must review and validate its content. The self-assessment questionnaire must be submitted to the CSSF by the persons responsible for the support PFS on an annual basis, within seven months of the closing of the support PFS’ financial year at the latest:
• via MFT in the original file format made available by the CSSF; and 7 With the exception of the final figures (prefix CL-8 in Annex 2) which must be transmitted through the usual E￾File or SOFiE transmission channels, within seven months of the closing of the financial year, at the latest. 8 Preferably in a version allowing text selection. 9 PDF version of the document corresponding to a printed version including the changes and comments in “track changes”.

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 14/25

• via MFT in PDF format including the electronic signature of at least two persons responsible for the support PFS or, where applicable, via mail with a handwritten signature of at least two persons responsible for the support PFS. As soon as it comes to their attention, the support PFS must inform the CSSF of any reported delays and indicate the reasons for and the probable duration of the delay. In case of withdrawal/deregistration of the support PFS from the official list held by the CSSF during the year, the self-assessment questionnaire covering the period from the last year-end to the date of withdrawal/deregistration will be required, in principle, within the same time frame of seven months. The above-mentioned submission deadlines may be reviewed by the CSSF over the coming years. 6.3. Management letter and separate report The management letter (including the table with the recommendations) or the certificate of non￾issuance of a management letter, as the case may be, and the separate report must be submitted to the CSSF by the persons responsible for the support PFS on an annual basis, within seven months of the closing of the support PFS’ financial year at the latest:
• via MFT in the original file format made available by the CSSF; and
• via MFT in PDF format including the electronic signature of the partner in charge of the mandate with the audit firm or, where applicable, via mail with his/her handwritten signature. As soon as it comes to their attention, the support PFS must inform the CSSF of any identified delay and indicate the reasons for and the probable duration of the delay. In case of withdrawal/deregistration of the support PFS from the official list(s) held by the CSSF during the year, the separate report covering the period from the last year-end to the date of withdrawal/deregistration will be required, in principle, within the same time frame of seven months. 6.2. Practical modalities The procedures and explanations relating to the practical modalities regarding the preparation and transmission of all documents referred to under Section 6.1 will be made available to the support PFS and their REA on the website of the CSSF. A user guide detailing the account creation and authentication procedures on the eDesk platform is also made available on the eDesk homepage.

7. Entry into force The instructions of this circular must be complied with in their entirety for the financial years closing on 31 December 20253 (first year of application) or after 31 December 20253. All financial years closing as from the above-mentioned date will thus fall within the scope of this circular. This circular repeals Circulars CSSF 12/544 and CSSF 19/727.

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 15/25 Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 16/25 Annex 1: Structure of the descriptive report

1. Significant events The support PFS shall indicate, where applicable, the significant events which took place during the year under review and which may impact its situation. These events represent, for example, decisions on strategies, important reorganisation, launch or discontinuation of activities, merger/acquisition operations or collaboration/partnership. Significant events which may trigger risks for financial professional clients of the support PFS shall be included in the risk management system under point 2.5.2. The support PFS shall specify where no significant events took place during the year under review.
2. Organisation and administration The support PFS shall provide under this item an overview of its operational, decisional and governance structure. 2.1. Management in charge of the day-to-day management The support PFS shall describe the responsibilities of the management in charge of the day-to-day management and the scope of powers necessary for the good performance of its mission that the board of directors (or management board) has conferred on it. It shall specify, among others, if applicable:

• possible limits imposed on the local decisions of the support PFS by the board of directors (or management board) involving a group;
• the decisions of the board of directors (or management board) locally imposed on support PFS and which may infringe the Luxembourg laws and regulations. 2.2. Central administration The support PFS shall briefly describe the organisation of its central administration. 2.3. Administrative organisation The support PFS shall briefly describe its administrative organisation. In case the support PFS outsources the administrative services, it shall also briefly describe the outsourced services and specify the supervision in place at the PFS to monitor the outsourced services.

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 17/25 2.4. Accounting function The support PFS shall briefly describe the operation of the accounting function. In case the support PFS outsources the accounting function, it shall also briefly describe the outsourced services and specify the supervision in place at the PFS to monitor the outsourced services. 2.5. Internal control The support PFS shall describe the way in which its internal control system is organised. 2.5.1. Internal procedures The support PFS shall indicate under this item if there is a procedure manual covering all the activities carried out within the company and which may directly or indirectly impact on the financial sector professional clients. The support PFS shall also mention if, pursuant to its obligations:

• there is indeed a training programme in place for its employees, notably in relation to the compliance with the confidentiality of the financial sector professional clients' data and the prevention of money laundering and terrorist financing;
• the contracts used indeed include a confidentiality clause, as well as a reference to criminal proceedings incurred in case of violation of the professional secrecy10 . 2.5.2. Risk management system The support PFS shall provide the roles and responsibilities of the various stakeholders (actors) to this system11. The support PFS shall notably indicate:
• the member of the authorised management responsible for risk management;
• if the risk management function is internally entrusted to one or more person(s). These persons must have the necessary independence, from a hierarchical point of view, in order to adequately take on the responsibility;
• if the risk management function is entrusted to an external expert in risk management and the latter's name. 10 As laid down in Article 41(1) of the LFS. 11 Risk management system implemented in accordance with the requirements of Section 5 of Circular IML 98/143 on internal control and of Circular CSSF 20/750 on the requirements regarding information and communication technology (ICT) and security risk management.

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 18/25 2.5.3. Audit committee In the event the support PFS has its own audit committee12 (a possible audit committee at group level is not concerned here), it shall describe the composition, functioning modalities, frequency and agenda of this committee's meetings. 2.5.4. Internal audit The support PFS shall describe the internal audit function (in-house, support of the parent company, use of an external expert or of a professional third party, in which case the coordination with the person responsible for the follow-up shall be described). 2.6. Information systems for internal use 2.6.1. Summary table The support PFS shall provide the expected information in the summary table made available by the CSSF for the accounting and client relationship management functions. 2.6.2. Network architecture and external connections The support PFS shall provide a description and/or a scheme of its network architecture comprising the main security elements (DMZ, firewalls, IDS, routers, proxy, etc.). In case it is impossible or useless to differentiate the network architecture required for the internal functioning of the PFS from that required for the activities carried out in the financial sector, please refer to point 3.3.3. The support PFS shall list the connections useful for the internal functioning to or from the exterior (including with its group, where applicable), by specifying the control that it exercises over these accesses (separate Active Directory, opening/closing of the communication lines, logs, etc.) and the redundancy measures of these connections. 3. Activities carried out in the financial sector 3.1. Description of the activities carried out The support PFS shall precisely describe the type and volume of its activities. A distinction shall be made, on the one hand, between the activities carried out in the financial sector, insurance sector and other activities and, on the other hand, between the activities requiring an authorisation as support PFS and those which do not. 12 In accordance with point 6 of Circular IML 98/143 and Article 74 of the Law of 18 December 2009 concerning the audit profession.

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 19/25 The support PFS shall also specify, where appropriate, the mode of service provision. For example:

• for an administrative agent: "Business Process Outsourcing" services delivered on the support PFS' premises and on its own mutualised IT system;
• for an IT systems and communication networks operator: making available and managing an "Infrastructure as a Service" located on its premises in a dedicated or shared mode, or managing the network on the client’s premises;
• for a client communication agent: printing and sending letters to clients of the financial professional client on its own systems and premises. A change in the activities' nature, the cessation of an activity or the start of new activities or exceptional or significant events during the year under review should be reported under point

1. "Significant events". The support PFS shall also provide a nominative list of its financial sector clients from Luxembourg or abroad for which it provides services requiring a PFS authorisation and specifying for each one of them:

• the activity sector concerned (finance/insurance);
• the country of residence (Luxembourg/abroad);
• the nature of the provision (main activities carried out);
• the location of the provision;
• and if it is offered through off-site or on-site communication. 3.2. Partnerships/cascade outsourcing The support PFS shall indicate the existence of any partnership or cascade outsourcing (with external companies or within the group) for carrying out activities in the financial sector and specify the nature (expertise, availability of profiles, provision requiring authorisation). It shall also specify: a. the staff (in number of FTE) allocated to the provision of services in the financial sector (dedicated staff); b. the staff (in number of FTE) of any subcontractors permanently used by the support PFS for the service provision in the financial sector. 3.3. Information systems for external use13 3.3.1. Summary table The support PFS shall provide the expected information in the summary table made available by the CSSF for the IT systems for external use. 13 Referred to in the self-assessment questionnaire as “IT systems related to client activities”.

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 20/25 The following shall be considered as information systems for external use:

1. systems that partially or exclusively support the activities carried out for the financial sector professional clients of the support PFS, irrespective of their belonging to the client or PFS or of their location;
2. and for which the support PFS is responsible as regards the sound functioning in relation to the client. These two conditions are cumulative in order to determine if a system is qualified as system for external use. The term "system" may be limited here to a software if the provision only concerns a software. For example, an administrative agent which provides asset accounting services to professionals of the financial sector on its own accounting system and on its own premises - system which it already used and continues to use for its own activity - may, at first sight, consider this accounting system as an internal system. However, this system shall indeed be considered as an external system since it also supports the activity carried out in the financial sector, the administrative agent is responsible of its sound functioning and it has the power to decide on the system supporting the provision. Similarly, an administrative agent which provides asset accounting services to professionals of the financial sector on its own accounting system, but which outsources the management of its system to a third party, shall consider this system as falling under this section. Indeed, irrespective of the use of outsourcing, the administrative agent remains responsible towards its clients as regards the functioning of the system and may retain a decision-making power relating to the choice of the system supporting the provision. 3.3.2. Functional scheme of the flows The main links (interfaces) which exist between the functions and, consequently, the reported systems pursuant to point 3.3.1 shall be described in a functional scheme of flows by the support PFS. Where all functions are included within one single software functioning on a single hardware (for example, a banking software package), it is not necessary to detail the internal flows but only the flows entering and coming out of the system. 3.3.3. Network architecture and external connections The support PFS shall provide a description and/or a scheme of the network architecture comprising the main security elements (DMZ, firewalls, IDS, routers, proxy, etc.). It shall list the useful connections according to the activities carried out in the financial sector towards or from outside (including with its group, where applicable), by specifying the control it exercises on these accesses. It shall briefly describe the security mechanisms implemented on physical (firewall, router, etc.) as well as on logical (intruder detector, anti-virus, client authentication, communication confidentiality, integrity and non-renouncing the transactions, etc.) and organisational (monitoring log history, configuration of the security equipment, generating keys or authentication certificates of client, monitoring systems, etc.) level.

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 21/25 3.3.4. Business Continuity Plan and Disaster Recovery Plan (BCP/DRP) The support PFS shall describe the business continuity plan that it set up in case of disaster on its own premises or in case the access to its premises is impossible (group solution, specialised undertaking, regular tests, security measures, etc.). It shall also describe the broad outline of the emergency plan in place which shall allow normal functioning in case of breakdown of its IT system, including as regards external connections (use of several communication lines providers, line redundancy). Where the above information has already been provided in the self-assessment questionnaire, the PFS shall only specify the corresponding sections. 4. Relations with affiliated undertakings The support PFS shall commit itself to ensuring that the intra-group transactions are carried out at arm's length. The following shall notably be described and commented upon:

• the type of intra-group transactions executed;
• the guarantees issued to the benefit of/received by the affiliated undertakings;
• the prices charged for services provided and received;
• etc. All the transactions not executed under market conditions shall be reported and detailed.

5. Branches abroad The support PFS shall provide for each branch:

• an organisation chart;
• a description of the activities;
• a description of the internal control procedures;
• if applicable, the serious deficiencies that the internal audit identified at the branch;
• a description of the administrative and accounting organisation;
• an indication on the existence of procedures regarding compliance with the rules of conduct and prevention of money laundering and terrorist financing;
• explanations on the accounting integration of the branch.

6. Subsidiaries abroad The support PFS shall provide an annual report or, otherwise the annual accounts of the subsidiaries or majority holdings on a yearly basis.

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 22/25 Annex 2: Summary of expected documents Note: the table below is presented in the same format and uses the same prefixes as the table introduced by Circular CSSF 19/72714. In order to facilitate the preparation of the expected documents, the amendments to the descriptions of Circular CSSF 19/727 have been marked in red. Moreover, some of the expected documents mentioned in Circular CSSF 19/727 (for example: Prefix RD-6) have been deleted. Documents expected in the context of the descriptive report Prefix Descriptive report. As a reminder:

• It must be signed by the members in charge of the authorised management;
• It must be sent in two versions (final and track changes). RD-0 A copy of the report on annual accounts and of the annual accounts of the direct majority shareholder (as well as of its management report, where applicable). RD-1 The internal organisation chart indicating hierarchical and functional lines and the number of employees per department. The internal organisation chart must also indicate:
• the name of the directors and, where applicable, the identification of the chairman of the Board of Directors;
• the name of the authorised managers and their hierarchical position within the entity;
• all departments and divisions, including the functions that are outsourced to entities of the group or to third parties, as well as the control functions, such as the internal or external audit (and, where applicable, the audit committee), and the support functions (internal IT, accounting, etc.);
• for each outsourced function, the name of the person responsible for the function (for example, the name of the company that carries out the internal audit) and the name of the authorised manager(s) in charge of the supervision of the function;
• the outsourced functions, identified through the use of different colour codes;
• for each function that is not outsourced, the number of employees as well as the name of the authorised manager(s) in charge of the supervision of the function;
• the hierarchical and functional lines, identified through the use of different colour codes;
• the date of the last revision of the document. RD-2 The recent organisation chart of the group showing the position of your company within the group and the capital links. RD-3 The written report of the management on the state of the internal control. RD-4 The summary report on the controls carried out by the internal audit during the previous financial year. RD-5 In addition to the summary report on the controls carried out by the internal audit during the previous financial year (RD-5), the table including the recommendations by the internal audit in the format imposed by the CSSF, excluding the lowest risk￾level recommendations. RD-5.1 14 Repealed by this circular

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 23/25 Documents expected in the context of the descriptive report Prefix The multi-annual programme of the internal audit approved by the authorised management and/or the Board of Directors (alternatively, your confirmation that the programme has not been modified since the previous financial year). RD-7 The internal audit charter (alternatively, your confirmation that the latter has not been modified since the previous financial year). RD-8 A table relating to the persons designated as responsible for certain functions pursuant to the CSSF circulars. This table must include the “Person in charge of the control of compliance with the professional obligations” (responsable du contrôle) and the “Person responsible for compliance” (responsable du respect) pursuant to CSSF Regulation No 20-05. RD-9 The summary table of information systems for internal use, in the format imposed by the CSSF. RD-11 A description and/or scheme of the network architecture of your company (for internal and external connections). RD-12 The list of connections useful to the internal functioning to or from the exterior. RD-13 The nominative list of Luxembourg or foreign financial sector clients for which you provide services requiring a PFS authorisation. RD-14 The copy of a client agreement on the service provisions requiring a PFS authorisation, for each different PFS authorisation that you hold. RD-15 The summary table of information systems for external use, in the format imposed by the CSSF. RD-16 The list of connections useful to the functioning of the activities carried out in the financial sector to or from the exterior. RD-17 The functional scheme of the flows (alternatively, your confirmation that the latter has not been modified since the previous financial year). RD-18 The annual report or, otherwise, the annual accounts of your subsidiaries or majority holdings. RD-19

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 24/25 Documents expected in the context of the financial year-end Prefix The report of the réviseur d'entreprises agréé (approved statutory auditor, “REA”) and the audited annual accounts. CL -1 The minutes and attendance list of the ordinary general meeting of shareholders approving the audited annual accounts. CL -2 The management report of the Board of Directors for the financial year concerned (where applicable). CL -3 Your company's final figures at the accounting closing date (as a reminder: to be sent via the usual E-File or SOFiE transmission channels). CL-8 The self-assessment questionnaire in the original file format made available by the CSSF. CL-9 The self-assessment questionnaire in PDF format including the electronic signature of at least two persons responsible for the support PFS or, where applicable, via mail with the handwritten signature of at least two persons responsible for the support PFS. CL-10 The management letter in the original file format made available by the CSSF, with the comments of the support PFS on the observations made by the REA in the columns provided for to that effect. CL-11 The management letter in PDF format including the electronic signature of the partner in charge of the mandate with the audit firm or, where applicable, via mail with his/her handwritten signature. CL-12 The separate report in the original file format made available by the CSSF, including any comments of the support PFS on the observations made by the REA in the columns provided for to that effect. CL-13 The separate report in PDF format including the electronic signature of the partner in charge of the mandate with the audit firm or, where applicable, via mail with his/her handwritten signature. CL-14