Circular CSSF 26/904 — Update of Circular CSSF 24/853 on the Long Form Report and Self-Assessment Questionnaire for Investment Firms

Circular CSSF 26/904 Update of Circular CSSF 24/853 on the Long Form Report (as amended by Circular CSSF 25/870) - Practical rules concerning the self-assessment questionnaire to be submitted by investment firms Mission and related reports of the réviseurs d’entreprises agréés (approved statutory auditors)

CIRCULAR CSSF 26/904 2/2 Circular CSSF 26/904 Update of Circular CSSF 24/853 on the Long Form Report (as amended by Circular CSSF 25/870) - Practical rules concerning the self-assessment questionnaire to be submitted by investment firms Mission and related reports of the réviseurs d’entreprises agréés (approved statutory auditors) To investment firms and Luxembourg branches of non-EU investment firms Luxembourg, 8 January 2026 Ladies and Gentlemen, The purpose of this circular is to amend Circular CSSF 24/853 on the long form report with the aim to further align the content of the self-assessment questionnaire (SAQ) with supervisory points of focus. Consequently, the following new modules have been included in the SAQ: a. ICT organisation1 b. ICT risk control environment2 c. UCI administration3 d. marketing, distribution or sale of contracts for differences (CFDs) to retail clients4. In addition, some modules have been updated to better align with supervisory objectives while also giving due consideration to the principle of proportionality. The list of modules in the SAQ and their descriptions have been removed from Circular CSSF 24/853 and is now available on the CSSF website (https://www.cssf.lu/en/prudential-reporting-for￾investment-firms/). Please refer to Annex 1 for the details of the amendments to Circular CSSF 24/853 (as amended by Circulars CSSF 25/870 and 26/904). Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General Annex 1: Circular CSSF 24/853, as amended by Circulars CSSF 25/870 and 26/904 1 The questions of Section 8 (IT function) of the module “1.b. Governance - internal governance arrangements” have been either removed or transferred to the new module “ICT organisation” of the SAQ. 2 This module applies only to class 2 (non SNI IFR investment firms) and class 3 investment firms (SNI IFR investment firms) which are not considered as microenterprise under DORA. 3 This module applies only to investment firms that effectively provide UCI administration activities (registrar function, NAV calculation and accounting function, as well as client communication services). 4 This module applies only to investment firms which marketed, distributed or sold CFD to retail clients.

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 1/15 Circular CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 LONG FORM REPORT – Practical rules concerning the self-assessment questionnaire to be submitted by investment firms Mission and related reports of the réviseurs d’entreprises agréés (approved statutory auditors)

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 2/15 Circular CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 LONG FORM REPORT – Practical rules concerning the self￾assessment questionnaire to be submitted by investment firms Mission and related reports of the réviseurs d’entreprises agréés (approved statutory auditors) To investment firms and Luxembourg branches of non-EU investment firms Luxembourg, 30 January 2024 Ladies and Gentlemen, The purpose of this circular is to introduce the key aspects of the revised long form report (the revised LFR) that applies to all investment firms as from the financial year ending on 31 December 2024. The revision of the long form report is the result of a thorough reconsideration of its objective, scope and content in order to realign it with the supervisory and prudential points of focus of the CSSF. Accordingly, the revised LFR has been designed with a view to allowing the CSSF to obtain relevant information as regards investment firms’ compliance with key regulatory provisions. In this view, the revised LFR allows the CSSF to gather sufficient information all the while further facilitating the implementation of a risk-based approach to supervision. In the review process, due consideration has been given to the principle of proportionality, as investment firms will only be required to provide information that is both relevant against the background of their business model and incremental compared to information already provided by them to the CSSF via other reporting obligations and channels, thus reducing redundancies between existing reports. With respect to its form and in line with the CSSF’s digital strategy (CSSF 4.0), the revised LFR turns digital to allow a more efficient reporting processing and ease data analysis. Its completion and submission will be required through the dedicated channel via the online portal of the CSSF.

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 3/15 Table of Contents

1. Scope of application.................................................................................................... 4
2. Overview of the revised LFR......................................................................................... 4
3. The self-assessment questionnaire (SAQ) ...................................................................... 5
4. The mission of the REA................................................................................................ 6 4.1. The AUP report(s) .................................................................................................... 6 4.2. The MiFID report...................................................................................................... 7 4.3. The AML/CFT report ................................................................................................. 7
5. Submission procedures.............................................................................................. 11 5.1. SAQ ..................................................................................................................... 11 5.2. Reports prepared by the REA................................................................................... 11 5.3. Practical rules........................................................................................................ 11
6. Final provisions ........................................................................................................ 12

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 4/15

1. Scope of application
2. This Circular applies in full to all non-SNI IFR investment firms1 incorporated under Luxembourg law, including their branches (the In-Scope Class 2 IF) 2 and certain3 SNI IFR investment firms4 incorporated under Luxembourg law, including their branches (the In￾Scope Class 3 IF), hereafter collectively the Full-Scope IF.
3. It also applies to Class 3 IF that by reference to their risk attributes represent a comparably lesser risk. These Class 3 IF are not subject to all the requirements of this Circular and are therefore designated as Partial Scope IF. In accordance with the principle of proportionality, the CSSF may adapt the requirements with respect to a specific Partial Scope IF on a case-by-case basis if the CSSF concludes that the IF’s risk profile5 has changed.
4. Overview of the revised LFR
5. The revised LFR comprises four parts that shall be produced on a yearly basis in principle:

1. a Self-Assessment Questionnaire (the SAQ) to be filled in on a yearly basis by the investment firms. The requirement to complete an SAQ is based on the powers of the CSSF to obtain information from investment firms in the context of its legal supervisory mandate and in particular Article 53(1), second subparagraph, points (1) and (2) of the Law of 5 April 1993 on the financial sector, as amended (the LFS) and Article 45(2), points (1) and (2) of the Law of 30 May 2018 on markets in financial instruments, as amended (the MiFID Law);
2. an Agreed-Upon Procedures report to be prepared by the réviseurs d’entreprises agréés (approved statutory auditors, the REA) of the investment firms in accordance with the International Standard on Related Services (ISRS) 4400 (Revised), in application of the legal provisions which authorise the CSSF to request an REA to carry out an audit in relation to one or more specific aspects of the activities and operations of institutions (Article 54(2) of the LFS and Article 45(2), point (9) of the MiFID Law) (the AUP report6). Each year, the annual AUP report shall cover a sub-set of relevant MiFID aspects, whereas the AUP three-year-cycle will ensure the coverage of all relevant MiFID areas over a period of three (3) years; 1 As defined in point (9a-2) of Article 1 of the Law of 5 April 1993 on the financial sector, as amended (the LFS). 2 As of the date of issuance of this circular, there is no CRR investment firm as defined in point (9a) of Article 1 of the LFS being incorporated in Luxembourg nor are there Luxembourg branches of third-country investment firms. 3 The In-Scope Class 3 IF concerned have been selected by the CSSF using a risk-based approach, considering certain representative risk attributes (e.g. business model, size). They were informed bilaterally that they were required to submit the revised LFR for the financial year ending 31 December 2023. 4 Small and non-interconnected investment firms as set out in Article 12(1) of Regulation (EU) 2019/2033. 5 For this reassessment the CSSF considers all information available and assesses in particular whether the nature, size and complexity including the risks of the entity as a whole or of a specific risk attribute have changed. 6 This report must also cover the branches that the investment firm incorporated under Luxembourg law has abroad.

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 5/15 3) a separate report on the protection of financial instruments and funds belonging to clients as required by Article 7 of the Grand-ducal Regulation of 30 May 20187 (the MiFID GDR) to be prepared on a yearly basis by the REA (the MiFID report8); and 4) a separate report on the procedures set up by the investment firm concerning anti￾money laundering and countering the financing of terrorism based on Articles 49(2) and 49(3) of CSSF Regulation No 12-02 of 14 December 2012 (the RCSSF 12-02) 9 to be prepared on a yearly basis by the REA (the AML/CFT report). Partial Scope IF subject to the revised LFR for the first time for the financial year ending 31 December 2024 are exempted from the submission of the AUP report for the AUP three￾year-cycle starting at the financial year ending 31 December 2024. Please refer to Annex II. 2. The revised LFR shall apply to investment firms on an individual basis only10. No consolidated revised LFR is required where an investment firm is subject to supervision on a consolidated basis by the CSSF. 3. The four parts of the revised LFR form a single document. The SAQ to be completed by the investment firms represents a key element for defining the contents of the mission of the REA. The REA’s mission is not to validate the SAQ. However, considering the interlinkages between the SAQ and the AUP and MIFID reports of the REA, the REA shall take contact with the CSSF11 should material errors having an impact on the extent of their work required under section 4 of this Circular be identified in the SAQ. 3. The self-assessment questionnaire (SAQ)

1. The aim of the SAQ is to receive relevant and precise information in digital form with respect to governance and MiFID topics.
2. The SAQ is composed of a “General information” section and 6 several thematic sections. For more detailed information, please refer to Annex I. The individual modules of the SAQ and their level of application as well as the applicable exemptions are directly recorded in the CSSF’s digital solution and are also described on the CSSF website.
4. To give due consideration to the varying business models of investment firms, the purpose of the “General information” section is to activate, based on the answers provided by the investment firm, only those thematic sections that are actually relevant against the background of an investment firm’s given business model.
5. The information communicated by the investment firm via the SAQ shall be accurate and as concise as possible and be in line with the prudential reporting figures as at the end of the financial year, where applicable. 7 Grand-ducal Regulation of 30 May 2018 on the protection of financial instruments and funds belonging to clients, product governance obligations and the rules applicable to the provision or reception of fees, commissions or any monetary or non-monetary benefits, as amended. 8 This report must also cover the branches that the investment firm incorporated under Luxembourg law has abroad. 9 CSSF Regulation No 12-02 of 14 December 2012 on the fight against money laundering and terrorist financing, as amended. 10 Except for Section 6 of the SAQ “Recommendations or observations raised”. 11 In accordance with Article 54 (3) point 2.a of the LFS.

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 6/15 5. The investment firm is required to upload specific supporting documents as attached documents in the SAQ (e.g. organisation chart, IT flowchart, outsourcing register, summary report of the internal audit function). 4. The mission of the REA

1. Investment firms shall mandate in writing their REA to prepare, on annual basis, the reports listed below. The REA shall be the REA appointed by the investment firm for the statutory audit of its annual accounts. 4.1. The AUP report(s)
2. The agreed-upon procedures (the AUP) shall be performed in accordance with ISRS 4400 (Revised) applicable to “Agreed-Upon Procedures Engagements”.
3. The REA’s findings shall be clearly documented in the AUP report(s) to be filled in using a CSSF digital solution.
4. The AUP report is composed of individual thematic sections. Depending on the individual business model of an investment firm, certain thematic sections or procedures of the AUP may not be (fully) applicable. In this case, the REA shall explicitly mention it.
5. The REA shall perform the AUP by using predefined sample sizes, as further specified in the relevant AUP thematic sections.
6. As regards the sample selections (e.g., clients, orders) by the AUP thematic section, the following guiding principles shall apply: a. the Full-Scope IF shall provide the REA with all relevant and complete information pertaining notably to its client database (e.g., client name, client reference, country of residence, date of account opening, MiFID categorisation, client risk profile), its transaction database (e.g., client reference, order reference, ISIN code of the financial instruments, type of financial instruments, nature of the order) and the nature of services effectively provided (discretionary asset management, advisory, execution only) to allow the REA to select a representative sample; b. the REA shall determine samples that are sufficiently diversified and representative in order to accurately reflect the composition of the Full-Scope IF’s client structure and the nature of the transactions performed. In this context, the REA shall notably provide an indication of the relative importance of the sample (for example, the number of the reviewed client files compared to the total number of client files of a specific nature) compared to the total population; c. the REA shall describe, if applicable, additional key elements taken into consideration for the composition of the sample.
7. The REA shall provide a detailed and meaningful description of the findings, if any, by type of clients, transactions and/or financial instruments.

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 7/15 4.2. The MiFID report 8. The MiFID report shall cover the adequacy of the arrangements under Article 37-1(7) and (8) of the LFS, Article 13(4) of the Law of 5 August 2005 on financial collateral arrangements, as amended, and Section 2 of Chapter 1 of the MiFID GDR. 9. The purpose of the MiFID report is to assess the reliability of the answers provided by an investment firm in the SAQ in relation to the protection of financial instruments and funds belonging to clients. 10. The authorised management of the investment firm is responsible for providing the REA with the required information in the SAQ for the drafting of the descriptive parts of the MiFID report. 11. The structure of the MiFID report shall follow the structure of the relevant section of the SAQ on the protection of financial instruments and funds belonging to clients. 12. The REA shall include in the MiFID report the descriptive elements provided by the investment firm’s authorised management in the SAQ. 13. In this context, the REA shall (including on the reconciliation process of financial instruments and funds belonging to clients): a. verify and ensure that these elements are correct and adequate; b. assess the appropriateness of the description provided by the investment firm; and c. perform appropriate control procedures to corroborate assertions set forth by the investment firm in the SAQ. Where applicable, the REA shall supplement the descriptive elements by items s/he deems appropriate. Where a specific item does not apply to the investment firm, the REA shall explicitly state it under the item concerned. 14. The REA shall describe the work performed and the findings, if any, and, where applicable, provide additional information on the aspects of the SAQ. 15. The MiFID report must be uploaded through a CSSF digital solution. 4.3. The AML/CFT report 16. The AML/CFT report shall describe the procedures set up by the investment firm concerning the prevention of money laundering and terrorist financing as required for compliance with or as defined in:

• Chapter 5 of Part II of the LFS;
• the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended (the AML/CFT Law);
• the Grand-ducal Regulation of 1 February 2010 providing details on certain provisions of the amended Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended (the Grand-ducal Regulation 2010);
• Regulation (EU) 2015/847 of the European Parliament and of the Council of 20 May 2015 on information accompanying transfers of funds, as amended (the Regulation (EU)

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 8/15 2015/84712);Regulation (EU) 2023/1113 of the European Parliament and of the Council of 31 May 2023 on information accompanying transfers of funds and certain crypto-assets and amending Directive (EU) 2015/849 (Regulation (EU) 2023/1113)

• international acts on the fight against terrorist financing brought to the attention of the investment firms through CSSF circulars;
• CSSF regulations on the fight against money laundering and terrorist financing;
• CSSF circulars relating to AML/CFT.

17. The AML/CFT report shall provide, in particular:

• the description of the AML/CFT policy set up by the investment firm in order to prevent money laundering and terrorist financing, the verification of its compliance with the provisions of Part II, Chapter 5 of the LFS, the AML/CFT Law, the Grand-ducal Regulation 2010, the Regulation (EU) 2023/11132015/847, the CSSF regulations and the CSSF circulars relating to AML/CFT and the control of their sound application;
• the assessment of the investment firm’s analysis of money laundering and terrorist financing risks to which it is exposed. The REA must verify if the implemented procedures, infrastructures and controls, as well as the scope of the AML/CFT measures are appropriate considering the money laundering or terrorist financing (ML/TF) risks to which the investment firm is exposed, particularly through its activities, the nature of its customers and the provided products and services;
• a declaration on whether an audit of compliance with the investment firm's AML/CFT policy has been performed by the internal audit function and the compliance officer in charge of the control of compliance with the professional obligations13;
• a short description of the training and awareness-raising measures for employees as regards money laundering and terrorist financing, and, in particular, with respect to the identification of money laundering and terrorist financing transactions;
• statistics concerning the detected suspicious transactions which indicate the number of suspicious transaction cases reported to the FIU by the investment firm, as well as the total amount of funds involved during the financial year;
• the control of the application of the provisions of Regulation (EU) 2015/8472023/1113 by the investment firm, in its respective role, and the percentage of the transfers of funds for which data on the payer or payee were missing or incomplete and the measures taken in this context by the investment firm. The AML/CFT report shall also provide:
• a description of roles and responsibilities with regard to AML/CFT within the investment firm, including the roles and responsibilities of and the interactions between the management and the different departments and services, indicating the corresponding number of staff involved on AML/CFT matters. The AML/CFT report shall also include a description of the committees and the corresponding hierarchical and functional structures by indicating the general and particular delegations of power with respect to AML/CFT. It shall also provide a description by the investment firm and an assessment 12 which has been replaced by the Regulation (EU) 2023/1113 which applies as of 30 December 2024. Please refer to draft bill 8387 which will operationalise said regulation. 13 As defined in Article 1(1) of RCSSF 12-02.

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 9/15 by the REA of the three-lines-of-defence model, as defined in Article 39(7) of RCSSF 12- 02;

• the list of persons involved in AML/CFT matters, as referred to in RCSSF 12-02 and Circular CSSF 20/758 on central administration, internal governance and risk management, as amended (compliance officer, person responsible for compliance, Chief Compliance Officer, etc.). It shall also state all the changes with regard to these persons which occurred during the financial year. Since these persons may delegate to members of staff certain operational tasks in relation to these functions, the AML/CFT report shall provide, where appropriate, a description of the delegation mechanism;
• a description of the network of national agencies, national and foreign subsidiaries, the branches abroad, the foreign representative offices and the tied agents, as well as the main related ML/FT risks. The AML/CFT report shall also indicate if the investment firm uses the services of external managers as regards the clients' assets and shall, where appropriate, provide a description of the manner in which the relationships with external managers are managed and documented from an AML/CFT perspective;
• a description of the investment firm’s commercial policy as well as the strategy regarding the management of the related ML/FT risks. It shall also include a description of how the investment firm monitors and ensures compliance with its internal objectives with regard to ML/FT risk management. The REA shall assess if the investment firm has sufficient financial resources and the appropriate infrastructure to control ML/FT risks to which it is exposed.

18. When determining the sample, the CSSF expects the REA to apply a risk-based approach, taking into account the different business activities performed. The REA shall state the reference date of the sample data and provide relevant information on the methodology adopted for determining the sample (for example, the number of files reviewed compared to the total number of clients). Where the REA identifies cases of non-compliance with the legal or regulatory provisions or deficiencies, the REA shall give detailed indications enabling the CSSF to assess the situation (number of pending incomplete files as a percentage of the total number of reviewed files, details of the deficiencies identified, etc.).
19. Where applicable, the AML/CFT report must encompass the investment firm's branches, majority-owned subsidiaries abroad and tied agents. It must cover, in particular, the branches', majority-owned subsidiaries' and tied agents’ compliance with the applicable provisions as regards the prevention of money laundering and terrorist financing and it must include, in that respect: • an analysis of money laundering and terrorist financing risks incurred by the branches, majority-owned subsidiaries and tied agents; • a description and assessment of the money laundering and terrorist financing risk management in the branches, majority-owned subsidiaries and tied agents; • the verification of the implementation of, and compliance with, the investment firm's AML/CFT policy in the branches, majority-owned subsidiaries and tied agents.

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 10/15 20. The AML/CFT report must be sufficiently exhaustive and transparent, providing detailed descriptions and assessments, in order to allow a precise and informed judgement on the risks incurred by the investment firm with respect to money laundering and terrorist financing. With regard to the language used for the assessments, the AML/CFT report shall not include imprecise negative formulations (e.g. “We did not encounter serious weaknesses”) or global and approximative assessments (e.g. “We noted that most of the points comply with the laws and regulations”). The AML/CFT report shall rather provide a positive assessment for each area and subject by providing an overview of the adopted methodology (e.g. use of the sample technique, method for selecting the sample, etc.) and, where applicable, provide a description of the identified findings in order to allow the CSSF to better understand and judge the extent of the noticed irregularities and weaknesses. 21. The REA shall also perform the follow-up to the findings observed during the previous audits and described in detail in the previous AML/CFT report. 22. The REA shall provide a description of any potential issues in relation to AML/CFT the investment firm may have with foreign competent authorities. 23. The authorised management of the investment firm is responsible for providing the REA with the required information for the drafting of the descriptive parts of the AML/CFT report. The REA may include in its report descriptive elements directly provided by the investment firm’s authorised management, but s/he shall verify and ensure that these elements are correct and adequate. If needed, s/he may have to perform some amendments. 24. In addition to the descriptive parts, the REA shall perform independently a detailed assessment of the ML/FT risks to which the investment firm is exposed as well as of the organisational aspects. This assessment shall be duly documented. 25. It should be noted that the REA must also inform the CSSF of all the suspicious transactions reported pursuant to Article 5 of the AML/CFT Law, and which concern the investment firm. Similarly, the REA must inform the CSSF in case they deem that the investment firm should have reported a suspicious transaction but has not, explaining their reasoning and having regard to the investment firm’s rationale. When discussing the cases with the investment firm, the REA needs to be mindful of applicable professional obligations. 26. The AML/CFT report must be uploaded through a CSSF digital solution.

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 11/15 5. Submission procedures 5.1. SAQ

1. The SAQ must be approved and electronically signed by the authorised management before submitting it to the CSSF14 .
2. The SAQ must be transmitted on an annual basis15 to the CSSF in an electronic form via a CSSF digital solution within three months after the end of the financial year, in accordance with the procedure described in Section 5.3.
3. By derogation, Partial Scope IF submitting the revised LFR for the first time shall provide their self-assessment questionnaire for the financial year ending 31 December 2024 within four months after the end of the financial year. 5.2. Reports prepared by the REA 4.3. The AUP report(s), the MiFID report and the AML/CFT report must include the digital signature of the partner in charge of the mandate with the audit firm s/he represents. 5.4. The REA submits the AUP report(s) to the investment firm, which can provide comments on the findings identified by the REA. These comments do not form part of the AUP report(s). The AUP report(s) must be submitted subsequently by the investment firm to the CSSF. 6.5. The REA submits the MiFID report and the AML/CFT report to the investment firm, which submits them subsequently to the CSSF. 7.6. These three reports must be transmitted by the investment firm to the CSSF in electronic form via a CSSF digital solution within seven months after the end of the financial year, in accordance with the procedure described in Section 5.3. 5.3. Practical rules 8.7. Procedures and explanations on the practical modalities regarding the preparation and transmission of (i) the SAQ, (ii) the AUP report(s), (iii) the MiFID report and (iv) the AML/CFT report will be available to investment firms and their REA, on the website of the CSSF. 9.8. A user guide “Authentication and user account management” is available to investment firms via the eDesk portal of the CSSF. 14 The CSSF will only have access to the answers of the investment firm once the SAQ is approved and uploaded (i.e. the CSSF has no access to preliminary answers provided in the draft SAQ by the investment firm). 15 It has to be noted that the CSSF digital solution includes a roll-forward functionality that will allow investment firm to update the SAQ of year N+1 based on the answers provided in the SAQ of year N.

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 12/15 6. Final provisions

1. This circular shall apply with immediate effect. Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General Annex I Overview of the SAQ sections and the level of application of each section Annex II Overview of the scope of application of Circular CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 13/15 Annex I: Overview of the SAQ sections and the level of application of each section Section Description Level of application Internal governance 1.a. Governance - Management body and key function holders Overview of the composition of the management body and key function holders and of the allocation of role and responsibilities within the investment firm. on an individual basis, excluding branches, if any. 1.b. Governance - Internal governance arrangements Overview of the organisation and functioning of the management body, of the internal control functions, of the financial and accounting function and IT function as well as internal governance arrangements pertaining to the code of conduct, the management of conflicts of interest, the remuneration policy of the investment firm. on an individual basis, excluding branches, if any. MiFID 2.a. MiFID internal control framework Overview of internal control framework regarding MiFID implemented by the investment firm, taking into account the MiFID investment activities effectively carried out and MiFID service effectively provided by the investment firm. on an individual basis, excluding branches, if any. 2.b. MiFID Protection of financial instruments and funds belonging to clients Overview of the arrangements put in place by the investment firm to ensure the safeguarding of client financial instruments and funds. on an individual basis, including branches, if any. 2.c. MiFID - Portfolio managers, tied agents, business providers, representation offices and free provision of services. Overview of the portfolio managers, tied agents, business providers, representation offices as well as of the free provision of services by the investment firm within the territory of another member country of the EEA. on an individual basis, excluding branches, if any.

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 14/15 Section Description Level of application Other topics 3. Table listing the claims Overview of the claims registered by the investment firm during the financial year in accordance with CSSF Regulation No 16-07 relating to out-of-court complaint resolution and Circular CSSF 17/671. on an individual basis, including branches, if any. 4. Foreign branches Overview of the foreign branches, including a description of how corporate, commercial and risk group policies are applied in the foreign branches, as well as an overview of the controls in place. Foreign branches located in another Member State or in a third country. 5. Related parties Overview of the internal control framework in place in connection with related parties. on an individual basis, including branches, if any. 6. Recommendations or observations raised Overview of the recommendations and/or observations raised by the REA or internal control functions, if any. on an individual basis, including branches, if any and subsidiaries (in case of prudential consolidation) if any.

CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 15/15 Annex II: Overview of the scope of application of Circular CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 Questionnaire / Report required Full Scope IF Partial Scope IF SAQ Required Required AUP report Required Exempted MiFID report Required Required AML/CFT report Required Required