Circular CSSF 26/906 — Central administration, internal governance and risk management

Circular CSSF 26/906 Central administration, internal governance and risk management

In case of discrepancies between the French and the English texts, the French text shall prevail. CIRCULAR CSSF 26/906 2/50 Circular CSSF 26/906 Central administration, internal governance and risk management To all payment institutions and electronic money institutions Luxembourg, 20 January 2026 Ladies and Gentlemen, Articles 11(2) and 24-7(2) of the amended Law of 10 November 20009 on payment services ("LPS") require payment institutions and electronic money institutions, taking into account the need to ensure the sound and prudent management of the institution, to dispose of robust internal governance arrangements which shall include a clear organisational structure with well-defined, transparent and consistent lines of responsibility, effective processes to identify, manage, monitor and report the risks to which they are or might be exposed to, adequate internal control mechanisms, including sound administrative and accounting procedures as well as control and security arrangements for information processing systems. According to Articles 48-1a and 8(1)(e) of the LPS, the granting and maintaining of the registration of account information service providers requires that the account information service providers dispose of internal governance arrangements and internal control mechanisms including administrative, risk management and accounting procedures, which demonstrate that these internal governance arrangements and internal control mechanisms are proportionate, appropriate, sound and adequate. As a consequence, this circular applies to account information service providers for the purposes of which they shall be treated as payment institutions while applying the principle of proportionality. In the past, the Commission de Surveillance du Secteur Financier ("CSSF") has set out the modalities of application of these articles in various circulars. The CSSF has decided to consolidate all the key modalities of application regarding central administration, internal governance and risk management in one single circular. This circular takes into account the European Banking Authority's guidelines on the information to be provided for the authorisation of payment institutions and electronic money institutions and for the registration of account information service providers under Article 5(5) of Directive (EU) 2015/2366 (EBA/GL/2017/09)1. Circulars IML 95/120, IML 96/126, IML 98/143 and CSSF 04/155 will be repealed for payment and electronic money institutions, and circulars CSSF 11/510 and CSSF 11/520 will be amended. This circular represents a first step towards a consolidated regulatory compilation on internal governance in its broadest sense. It does not cover all the areas of concern such as the information and communication technology (ICT) risk management, the notification of major incidents, remuneration or outsourcing, which are each covered by separate circulars. When, in response to regulatory developments at the European, international, or national level, the CSSF is prompted to specify the requirements set out in this circular, it will update this circular. 1 These guidelines are adopted in Luxembourg via Circular CSSF 18/677

CIRCULAR CSSF 26/906 3/50 TABLE OF CONTENTS Part I. Definitions and scope ............................................................................................... 5 Chapter 1. Definitions ...................................................................................................... 5 Chapter 2. Scope and proportionality................................................................................. 6 Part II. Central administration, internal governance and risk management arrangements ............ 7 Chapter 1. Central administration...................................................................................... 7 Chapter 2. Internal governance arrangements .................................................................... 8 Chapter 3. General characteristics of robust central administration and internal governance arrangements .................................................................................................................. 9 Chapter 4. Supervisory body and management body ......................................................... 10 Sub-chapter 4.1. Supervisory body................................................................................ 10 Section 4.1.1.Responsibilities of the supervisory body................................................... 10 Section 4.1.2.Composition and qualification of the supervisory body ............................... 13 Section 4.1.3.Organisation and functioning of the supervisory body ................................ 15 Section 4.1.4.Specialised committees.......................................................................... 15 Sub-chapter 4.2.Management body ............................................................................... 16 Section 4.2.1.Responsibilities of the management body................................................. 16 Section 4.2.2.Composition and qualification of the management body............................. 19 Section 4.2.3.Organisation and functioning of the management body.............................. 21 Chapter 5. Administrative, accounting and IT organisation ................................................. 22 Sub-chapter 5.1.Organisation chart and human resources ................................................ 22 Sub-chapter 5.2.Procedures and internal documentation .................................................. 23 Sub-chapter 5.3.Administrative and technical infrastructure ............................................. 24 Section 5.3.1.Financial and accounting function............................................................ 24 Section 5.3.2.IT function ........................................................................................... 26 Section 5.3.3.Communication and internal and external alert arrangements..................... 26 Chapter 6. Internal control ............................................................................................. 27 Sub-chapter 6.1.Operational controls............................................................................. 28 Section 6.1.1.Day-to-day controls carried out by the operating staff ............................... 28 Section 6.1.2.Ongoing critical controls......................................................................... 28 Section 6.1.3.Controls are carried out by the members of the management body on the activities or functions which fall under their direct responsibility ..................................... 29 Sub-chapter 6.2.Internal control functions...................................................................... 30 Section 6.2.1.General responsibilities of the internal control functions............................. 30 Section 6.2.2.Characteristics of the internal control functions......................................... 30 Section 6.2.3.Execution of the internal control functions’ work ....................................... 32 Section 6.2.4.Organisation of the internal control functions............................................ 33 Section 6.2.5.The compliance function ........................................................................ 34 Sub-section 6.2.5.1.The compliance charter .............................................................. 34 Sub-section 6.2.5.2.Scope and specific responsibilities of the compliance function ......... 35 Sub-section 6.2.5.3.Organisation of the compliance function....................................... 37 Section 6.2.6.Risk control.......................................................................................... 38 Sub-section 6.2.6.1.Risk management framework...................................................... 38 Sub-section 6.2.6.2.Independent risk control function ................................................ 39 Sub-section 6.2.6.3.IT Risk management function ..................................................... 39 Section 6.2.7.Internal audit function ........................................................................... 39 Sub-section 6.2.7.1.Internal audit charter................................................................. 39

CIRCULAR CSSF 26/906 4/50 Sub-section 6.2.7.2.Specific responsibilities and scope of the internal audit function ...... 40 Sub-section 6.2.7.3.Execution of the internal audit work............................................. 41 Sub-section 6.2.7.4.Organisation of the internal audit function.................................... 42 Chapter 7. Specific requirements..................................................................................... 43 Sub-chapter 7.1.Organisational structure and legal entities ("Know-your-structure") ........... 43 Sub-chapter 7.2.Management of conflicts of interest........................................................ 44 Section 7.2.1.General requirements ............................................................................ 44 Section 7.2.2.Specific requirements relating to conflicts of interest involving related parties................................................................................................. 44 Sub-chapter 7.3.New Product Approval Process............................................................... 45 Chapter 8. Safeguarding requirements of funds ................................................................ 46 Sub-chapter 8.1.General requirements........................................................................... 46 Sub-chapter 8.2.Safeguarding of funds through the use of so-called "segregation accounts" (cf. Articles 14(1)(a) and 24-10(1)( a) of the LPS) ................................................................ 47 Sub-chapter 8.3.... Safeguarding of funds through insurance or another type of guarantee (cf. Articles 14(1)(b) and 24-10(1)(b) of the LPS)................................................................. 49 Chapter 9. Legal reporting.............................................................................................. 49 Part III. Entry into force................................................................................................... 50

CIRCULAR CSSF 26/906 5/50 Part I. Definitions and scope Chapter 1. Definitions

1. For the purposes of this circular:

1. "institution": a payment institution or an electronic money institution in accordance with paragraph 2 of chapter 2 of part I "Scope and proportionality" of this circular;
2. "payment institution": the persons referred to in Article 1(18) of the LPS;
3. "electronic money institution": the persons referred to in Article 1(17) of the LPS;
4. "internal control functions": the compliance function, the internal audit function and the risk management function;
5. "LPS": the amended Law of 10 November 2009 on payment services, on the activity of electronic money institution and settlement finality in payment and securities settlement systems;
6. "supervisory body": the body or, alternatively, the persons who, from the point of view of corporate law, control the management exercised by the management body. The term "supervisory body" generally refers to the Board of Directors. However, this term is not to be taken in its legal sense since institutions may have a legal form that does not provide for a "Board of Directors" within the meaning of corporate law. For example, if a Supervisory Board exists, it shall assume the responsibilities that this circular assigns to the "Board of Directors";
7. "management body": the persons referred to in Articles 8(1)(i) and 24-4(i) of the LPS. These persons are generally referred to as "executive manager(s)", "authorised manager(s)" or "authorised management";
8. "related parties": (a) the legal entities (structures) which are part of the group to which the institution belongs; (b) the shareholders; (c) the members of the supervisory or management body of the institution or entities mentioned in point (a), their spouses or partners registered in accordance with the applicable national law and their children and parents; (d) the commercial entities, in which a member of the supervisory or management body or his or her close family members as referred to in point (c), has a qualifying holding of 10% or more of capital or of voting rights in that entity, in which those persons can exercise significant influence, or in which those persons hold senior management positions or are members of the management or supervisory body;
9. "account information service providers": the persons referred to in Article 1(37d) of the LPS;
10. "payment service users": the persons referred to in Article 1(46) of the LPS, as well electronic money holders;
11. "branch": the operating offices referred to in Article 1(39) of the LPS;
12. "staff" or "staff members": all employees of the institution, including employees of branches, of representative offices or of other offices linked to the institution. Persons made available to an institution under a contract with a third-party employer are also considered to be staff members;

CIRCULAR CSSF 26/906 6/50 13) "procedures": in the broadest sense, all measures, instructions, and rules governing the internal organisation and functioning of an institution. Chapter 2. Scope and proportionality 2. This circular shall apply to payment institutions and electronic money institutions whose home Member State is Luxembourg, including their branches, as well as to Luxembourg branches of payment institutions and electronic money institutions whose home Member State is outside the European Economic Area, and account information service providers. In respect of the areas for which the CSSF retains an oversight responsibility as host authority

• i.e. notably anti-money laundering and counter terrorist financing measures, redress procedures – Luxembourg branches of payment institutions and electronic money institutions originating from a Member State of the European Economic Area shall implement central administration and internal governance arrangements as well as a risk management which are comparable to those specified in this circular.

3. Institutions shall take into account their size and internal organisation as well as the nature, scale and complexity of their activities and the risks of the services they provide when designing and implementing their internal governance arrangements. In practice, the application of the principle of proportionality means that certain institutions need to set up enhanced central administration, internal governance and risk management arrangements. This may involve, for example, setting up specialised committees, or appointing additional members to the supervisory body or the management body. Conversely, for institutions whose size and nature, the scale and complexity of their activities are less significant (e.g. account information service providers), the principle of proportionality can be applied downward without prejudice to compliance with legal provisions and in respect with the requirements of this circular. The downward application of the principle of proportionality is, in particular, limited by the principle of segregation of duties under which the duties and responsibilities shall be assigned so as to avoid conflicts of interest involving the same person. At the level of the management body, while tasks are allocated in accordance with the principle of segregation of duties, the responsibility remains collective. For the purposes of applying the principle of proportionality, and in order to ensure proper implementation of regulatory requirements, institutions shall notably take into account the following aspects/criteria: • the risks and complexity associated with the type of products offered and services provided an in particular the provision of services other than payment or electronic money services including the provision of foreign exchange services, the granting of credits related to payment services, the combination of multiple authorisations from the financial sector, etc.; • the volume of payment and electronic money operations (> EUR 10 billion); • the size of the institution in terms of turnover and balance sheet total (> EUR 0.5 billion); • the type and number of payment service users; • the number of staff members of the institution (i.e. > 50 persons);

CIRCULAR CSSF 26/906 7/50 • the distribution network (supported by more than one branch and/or a network of agents, distributors or representative offices); • the size of the group (shareholding structure to which the institution belongs); • the number and complexity of outsourcing arrangements including those related to IT systems and technologies (and in particular the level of dependence and concentration of the outsourcing arrangements); and • the structure of the IT systems architecture (including systems continuity). 4. Regardless of the adopted organisation, the arrangements in this respect shall enable the institution to operate in full compliance with the provisions of part II of this circular. Institutions shall document their proportionality assessment in writing and have their conclusions approved by the supervisory body at least on an annual basis. Part II. Central administration, internal governance and risk management arrangements Chapter 1. Central administration 5. Articles 11(1) and 24-7(1) of the LPS require institutions to have their central administration and registered office in Luxembourg. This requirement means that an institution may not limit itself to having a legal registered office in Luxembourg ("siège juridique", "Zulassungssitz"). It shall also have its decision-making centre and administrative centre in Luxembourg ("head office", "effektiver Sitz"). 6. The concept of central administration includes two elements: • the "administration", which includes, in a broad sense, the supervisory and management body, the executive and internal control functions; • the "centre", which means the place towards which various elements of the whole undertaking come and from which they radiate. 7. The decision-making centre includes the supervisory body and those persons (at least two) members of the management body, responsible for managing the institution and who shall be empowered to effectively determine the direction of its activity. It also includes the persons responsible for internal control functions, for commercial functions as well as for the various administrative, IT and operational functions existing within the institution. The administrative centre includes the administrative, accounting and IT organisation which ensures, at all times, proper administration of securities and assets, adequate execution of operations, accurate and complete recording of operations and the production of accurate, complete, relevant and understandable management information available without delay. The central administration enables the institution to reach each and every location where it is established and in particular the branches which are part of the institution in order to provide them with any management information necessary or relevant to the sound and prudent management of the institution. The concept of management information shall be understood in the broadest possible sense, including financial information and legal reporting, where relevant.

CIRCULAR CSSF 26/906 8/50 Without prejudice to the provisions of Circular CSSF 22/806 on outsourcing arrangements, and in application of the principle of proportionality (see paragraph 3 of this circular), institutions shall at all times maintain an adequate and sufficient structure enabling them to ensure control over all the activities of the institution at all times. Chapter 2. Internal governance arrangements 8. Internal governance is a crucial component of the corporate governance framework, focusing on the internal structure and organisation of an institution. Corporate governance is a broader concept which may be described as the set of relationships between an institution, its supervisory body, its management body, its shareholders and the other stakeholders. 9. Internal governance shall ensure sound and prudent management of the activities, including its inherent risks. The internal governance arrangements shall notably include: • a clear and consistent organisational and operational structure with decision-making powers, reporting and functional lines and share of responsibility which are well-defined, transparent, consistent, complete and free from conflicts of interest; • a clear organisational structure with reference to the institution's provision of payment and electronic money services, including in particular the use of agents, distributors, representative offices or branches, as well as the institution’s policies in respect of the selection and control over agents, distributors, representation offices and branches; • adequate internal control mechanisms which comply with the provisions of chapter 6 of this part. These mechanisms shall include sound operational, administrative, accounting and IT procedures and remuneration policies and practices allowing and promoting sound and effective risk management, in line with the institution’s risk strategy, as well as control and security mechanisms for management information systems. The concept of management information system shall include IT systems; • a formal escalation, settlement and, where appropriate, sanction procedure for the problems, shortcomings and irregularities identified through internal control mechanisms, including internal control functions or through internal alert mechanisms; • a clear risk-taking process including a risk appetite that is formally and precisely defined in all the areas of activity, covering all types of risk to which the institution is exposed, including money laundering and terrorist financing risks, operational and security risks related to the payment or electronic money services it provides as well as a rigorous decision-making process, quality analyses and limits; • appropriate processes to identify, measure, report, manage, mitigate and control all risks to which the institution is or may be exposed, including money laundering and terrorist financing risks, and operational and security risks related to the payment or electronic money services they provide; • internal communication arrangements that enable the staff to draw the attention of members of the management to all their important and legitimate concerns relating to the internal governance of the institution;

CIRCULAR CSSF 26/906 9/50 • business continuity management arrangements aimed at limiting the risks of severe business disruption and ensuring the maintenance of the key operations as defined by the supervisory body, based upon proposals from the management body. These arrangements shall include a business continuity plan which describes the actions to be taken in order to continue to operate in case of an incident, a disaster or any other event likely to disrupt operations, as well as effective incident management procedures, including the detection and classification of major operational and security incidents; • crisis management arrangements that ensure appropriate responsiveness in the event of a crisis. 10. All institutions shall promote an internal risk and compliance culture in order to ensure that the institution’s staff takes an active part in the internal control as well as in the identification, reporting and monitoring of the risks incurred by the institution and develop a positive approach to the internal control. This strong and ubiquitous overall risk and compliance culture shall also be reflected in the strategies, policies and procedures of the institution, in the training offered and in the messages conveyed to the staff as regards the risk-taking and the risk management within the institution. Such culture shall be characterised by the example that both the supervisory and the management bodies set ("tone from the top") and requires all members of the staff to be accountable for their acts and behaviours, an open and critical dialogue and the absence of incentives for inappropriate risk-taking. Such risk and compliance culture notably involves the regular communication within the institution of information related to the institution’s risk appetite, the institution’s professional conduct, its corporate values in view of ensuring the ongoing deployment of a robust and effective internal control framework. Chapter 3. General characteristics of robust central administration and internal governance arrangements 11. Central administration and internal governance arrangements shall be developed and implemented so that they: • operate with "integrity". This part includes both the management of conflicts of interest and the security, in particular, as regards information systems; • are reliable and operate on an ongoing basis ("robustness"). Pursuant to the principle of continuity, all institutions shall also establish arrangements aimed at restoring the operation of the internal governance arrangements in case of discontinuity; • are effective ("effectiveness"). Effectiveness is given, in particular, when risks are effectively managed and monitored; • meet the needs of the institution as a whole and of all its organisational and operational units ("adequacy") • are consistent as a whole and in their parts ("consistency");

CIRCULAR CSSF 26/906 10/50 • are comprehensive ("comprehensiveness"). In respect of risks, comprehensiveness shall mean that all risks shall be included within the scope of the internal governance arrangements. This scope shall enable the institution to have a thorough overview of all its risks, in terms of economic substance, considering all interactions between the institution and its distribution network through agents, distributors, representative offices or branches. In respect of the internal control, the principle of comprehensiveness implies that the internal control shall apply to all areas of operations of the institution; • are transparent ("transparency"). Transparency shall include a clear and visible assignment and communication of the roles and responsibilities to the different staff members, the management body and the operational and organisational units of the institution; • comply with the legal and regulatory requirements, including the requirements of this circular, the regulatory requirements applicable as regards the prevention of money laundering and terrorist financing ("compliance"). 12. In order to ensure and maintain the robustness of the central administration and internal governance arrangements, these shall be subject to objective, critical and regular review at least once a year by the institution (please also refer to paragraph 71 of this circular). This review shall consider all internal and external changes which may have a significant adverse effect on the soundness of these arrangements as a whole, on the risk profile and in particular on the institution’s ability to manage and bear its risks. Chapter 4. Supervisory body and management body Sub-chapter 4.1. Supervisory body Section 4.1.1. Responsibilities of the supervisory body 13. The supervisory body shall have the overall responsibility for the institution. It shall define, monitor and bear the responsibility for the implementation of robust central administration, governance and internal control and risk management arrangements, which shall include a clearly structured internal organisation and independent internal control functions with appropriate authority, stature and adequate resources with respect to their responsibilities. The implemented framework shall ensure the sound and prudent management of the institution, preserve its continuity and protect its reputation. To this end, after having heard the management body and the heads of the internal control functions, the supervisory body shall approve and lay down, in writing, the following key elements of the central administration, internal governance and risk management arrangements: • the business strategy (business model and business plan) of the institution, considering the institution’s long-term financial interests, solvency, liquidity preservation and risk appetite. The development and maintenance of a sustainable business model requires that account be taken of all material risks; • the program of activities;

CIRCULAR CSSF 26/906 11/50 • the institution's risk strategy, including risk appetite and the institution's overall risk￾taking and risk-management framework, as well as, where applicable, credit risk and related limits with reference to the requirements of Article 10(3) of the LPS; • the guiding principles regarding the safeguarding requirements of funds as referenced in Articles 14 and 24-10 of the LPS; • the guiding principles which govern the creation and maintenance of entities/legal structures by the institution such the branches, the network of agents, distributors and representation offices; • the guiding principles regarding information systems, technology and information security; • the guiding principles relating to internal control mechanisms, including the internal control functions, to ensure that they are effective and efficient; • the guiding principles relating to the remuneration policy; • the guiding principles relating to professional conduct, corporate values and the management of conflicts of interest; • the guiding principles relating to escalation and sanctions the purpose of which is to ensure that any behaviour which does not comply with the applicable rules is properly investigated and sanctioned; • the guiding principles relating to the central administration in Luxembourg, including: o the human and material resources which are required for the implementation of the organisational and operational structure as well as the institution’s strategies; o an operational, administrative, accounting and IT organisation that complies with applicable laws and standards; o the guiding principles relating to outsourcing, including those of an IT nature, whether or not based on a cloud computing infrastructure; as well as o the guiding principles governing the change in activity (in terms of market coverage and customers, new products and services) and the approval and maintenance of non-standard or potentially non-transparent activities; • the guiding principles relating to business continuity and crisis management; • the guiding principles governing the appointment and succession to the supervisory and management bodies and to the internal control functions of the institution, as well as the procedures governing the composition of the supervisory body, including the aspects of diversity, responsibilities, organisation, operation, and individual and collective assessment of its members. • the strategy and guiding principles for customer communications and digital marketing (e.g. Internet, social media, mobile applications, etc.). 14. The supervisory body shall entrust the management body with the implementation of the strategies and guiding principles through internal written policies and procedures (except for the guiding principles governing the appointment and succession within the supervisory body and the procedures determining its operation).

CIRCULAR CSSF 26/906 12/50 15. The supervisory body monitors the implementation by the management body of the strategies and guiding principles and is informed thereof, and, where appropriate, takes knowledge of the procedures and policies that the management body adopts pursuant to these strategies and principles. 16. The supervisory body shall critically assess, adapt, where necessary, and re-approve, on a regular basis and at least once a year, the internal governance arrangements, including the key strategies and guiding principles and their implementation within the institution, the internal control mechanisms and the framework for risk-taking and risk management. These assessments and re-approvals aim to ensure that the internal governance arrangements continue to comply with the requirements of this circular and the objectives of effective, sound and prudent management of the institution. The assessment and re-approval by the supervisory body shall relate, in particular, to the following: • the manner in which the management body meets its responsibilities and the performance of its members. In this context, the supervisory body shall critically and constructively review and assess the actions, proposals, decisions and information provided by the management body and shall, in particular, ensure that the management body promptly and efficiently implements the corrective measures required to address the problems, shortcomings and irregularities identified by the internal control functions, the réviseur d’entreprises agréé (approved statutory auditor) and/or the competent authority; • the correlation between the incurred risks, the institution’s ability to manage these risks in line with the previously approved strategies and guiding principles established by the supervisory body and the applicable regulations; • the strategies and guiding principles in order to improve them and to adapt them to internal and external, current and anticipated changes, as well as to the lessons learnt from the past; • the adequacy of the organisational and operational structure, which the supervisory body shall fully understand. The supervisory body shall ensure that the organisational and operational structure enables the institution to adhere to its strategies and guiding principles, while maintaining a sound and prudent management of the institution. The supervisory body must fully know and understand the organisational structure of the institution, in particular of the underlying legal entities (structures), their raison d'être, the intra-group links and interactions as well as the risks related thereto. It shall verify that the organisational and operational structure complies with the strategies and guiding principles, that it enables a sound and prudent business management which is transparent and free from undue complexity, and that it remains justified in relation to the assigned objectives. This requirement shall apply, in particular, to non-standard or potentially non-transparent activities; • the effectiveness and efficiency of the internal control mechanisms put in place by the management body. The assessments in question may be prepared by specialised committees. These assessments shall, in particular, be based on the information received from the management body, the audit reports issued by the réviseur d’entreprises agréé (reports on annual accounts, long form reports

CIRCULAR CSSF 26/906 13/50 and, where appropriate, management letters), financial reports and the reports of the internal control functions which the supervisory body is called upon to approve on this occasion. 17. The supervisory body shall be in charge of promoting an internal risk and compliance culture which raises the awareness of the institution’s staff as regards the requirements of a sound and prudent risk management and which fosters a positive attitude towards internal control and compliance. It shall also be in charge of stimulating the development of internal governance arrangements which allow reaching these objectives. 18. In respect of the internal control functions, the supervisory body shall ensure that the work of these functions is performed in compliance with the recognised standards and under the approved policies. 19. The supervisory body shall ensure that sufficient time is devoted to risk and compliance topics. 20. Where the supervisory body becomes aware that the central administration or internal governance arrangements no longer ensure a sound and prudent management of the institution or compliance with the safeguarding requirements of funds set out in Articles 14 and 24-10 of the LPS, or that the incurred risks are or will no longer be adequately borne by the institution’s ability to manage these risks, by own funds or regulatory or internal liquidity reserves, it shall require the management body to provide it with corrective measures, without delay, and inform the CSSF thereof forthwith. The obligation to notify the CSSF also concerns all information which casts doubt on the qualification or good repute of a member of the supervisory and/or management body or a head of an internal control function. Section 4.1.2. Composition and qualification of the supervisory body 21. The members of the supervisory body shall be sufficient in number in accordance with the applicable legal provisions and, as a whole, shall be of adequate composition so that the supervisory body can fulfil all of its responsibilities and which guarantees the sound and prudent management of the institution. The adequacy of the composition of the supervisory body refers, in particular, to professional qualifications (adequate knowledge, skills and experience), as well as to the personal qualities of the members of the supervisory body. Moreover, each member shall, at all times, demonstrate his/her professional repute. The guiding principles governing the appointment and succession of the members of the supervisory body shall explain and provide for the competences deemed necessary to ensure an appropriate composition and qualification of the supervisory body. The CSSF recommends that these guiding principles promote all aspects of diversity. Aspects of diversity may refer to the characteristics of members of the supervisory body, including their age, gender, geographical origin and educational and professional backgrounds. The promotion of diversity is based on the principle of non-discrimination and on measures guaranteeing equal opportunities. 22. The supervisory body shall collectively have appropriate knowledge, skills and experience with regard to the nature, scale and complexity of the activities and the organisation of the institution. Collectively, the supervisory body shall have an appropriate understanding of all the activities (and inherent risks) as well as of the economic and regulatory environment in which the institution operates.

CIRCULAR CSSF 26/906 14/50 23. Each member of the supervisory body shall have a full understanding of the internal governance arrangements and of his/her responsibilities within the institution. The members shall control the activities which fall within their areas of expertise and shall have an appropriate understanding of the other significant activities of the institution and keep themselves informed about the institution's activities, the evolution of its activities, and the risks to which the institution is exposed, respectively. Notwithstanding the respective areas of expertise of the members of the supervisory body, each member of the supervisory body must have an appropriate understanding of all the areas for which the supervisory body is collectively and directly responsible. 24. The members of the supervisory body shall ensure that their personal qualities enable them to perform their mandate effectively, with the required commitment, availability, objectivity, critical thinking and independence of mind. In this respect, the supervisory body cannot have among its members a majority of persons who take on an executive role within the institution (members of the management body or other staff members of the institution, with the exception of staff representatives elected in accordance with the applicable regulations). The supervisory body’s decision-making shall not be dominated by any one individual member. 25. The members of the supervisory body shall ensure that their mandate is and remains compatible with any other positions, mandates and possible interest they may have, in particular in terms of conflicts of interest and availability. They shall inform the supervisory body on their own initiative of any jobs, mandates or possible interests that they have outside the institution. 26. The terms of reference of the mandates must be laid down so that the supervisory body may fulfil its responsibilities effectively and on an ongoing basis. The renewal of the existing members' mandates must, in particular, be based on their past performance. Continuity in the functioning of the supervisory body must be ensured. 27. The guiding principles governing the appointment and succession of the members of the supervisory body provide for the measures required in order for these members to be and remain qualified throughout their mandate and to ensure the continuity in the functioning of the supervisory body. These measures include a specific initiation to understand the structure, the business model, the risk profile and the governance arrangements, and then training programs which enable members of the supervisory body, on the one hand, to understand the operations of the institution, their role and, on the other hand, to update and develop their skills. The measures shall also include different or staggered terms of office, as well as contractual provisions to ensure a proper transition of knowledge and duties from one member of the supervisory body to his or her successor, as well as compliance at all times with the minimum number of members of the supervisory body in accordance with applicable legal requirements. The measures shall also ensure an appropriate response capability in the event of a crisis. 28. Institutions shall inform the CSSF in advance and without delay of any change in the composition of the members of the supervisory body and shall provide the required information and documents for each nomination, as published on the CSSF website, and explanatory reasons for departures.

CIRCULAR CSSF 26/906 15/50 Section 4.1.3. Organisation and functioning of the supervisory body 29. The supervisory body meets regularly to effectively fulfil its responsibilities. The organisation and functioning of the supervisory body shall be documented in writing. The objectives and responsibilities of its members shall also be documented by way of written mandates. The CSSF recommends that meetings be held at least on a quarterly basis. In accordance with the institution's articles of association and applicable regulatory requirements, meetings of the supervisory body may be held in person, by videoconference or by any other means of electronic communication enabling all its members to actively follow the discussions and participate in real time without constraint. Save in exceptional circumstances, it is recommended that most meetings be held at the registered office of the institution in Luxembourg in the presence (onsite) of a majority of members in order to foster a culture of informed and adversarial discussion as part of effective decision-making. 30. The work of the supervisory body shall be documented in writing. This documentation shall include the agenda and minutes of the meetings as well as the decisions and measures taken by the supervisory body. The minutes are an important tool which shall, on the one hand, help the supervisory body and its members to monitor the decisions and, on the other hand, also enable the body and its members to be accountable to the shareholders and the competent authorities. Thus, routine items may be included succinctly in the minutes of a meeting, in the form of a simple decision, while important items on the agenda involving risks for the institution or conflictingly discussed shall be reported in more detail, allowing readers to follow the discussions and to identify the positions taken. 31. The supervisory body shall assess regularly the procedures governing its functioning mode and its work in order to improve them, to ensure their effectiveness and to verify whether the applicable procedures are complied with in practice. It shall ensure that all its members have a clear picture of their obligations, responsibilities and allocation of tasks within the supervisory body and, where applicable, specialised committees that depend on it. 32. The supervisory body elects a chairperson from among its members. It is the responsibility of the chairperson to ensure that it functions properly, to promote a culture of informed and adversarial discussion within the body, and, if relevant, to propose the appointment of one or more independent members. The chairperson of the supervisory body must not take on an executive role within the institution, unless justified by the institution and accepted by the CSSF. The presence of one or more independent members within the supervisory body is recommended and considered as a good practice. These independent members may, indeed, play an essential role within the supervisory body and strengthen the efficiency of counter-powers within the institution in improving, where relevant, the oversight of the decision-making process by the supervisory body. Section 4.1.4. Specialised committees 33. In application of the principle of proportionality (see paragraph 3 of this circular), the CSSF may recommend that certain institutions set up specialised committees of the supervisory body in accordance with their needs and considering the organisation, nature, scale and complexity of the institution's activities. Their missions shall be to provide the supervisory body with critical assessments in respect of the organisation and functioning of the institution in their specific areas of competence.

CIRCULAR CSSF 26/906 16/50 34. Without prejudice to the specific legal and regulatory requirements in this respect, the permanent members of the specialised committees shall be, as applicable, members of the supervisory body who do not perform any executive function within the institution. Each committee shall be composed of at least three members. Where there are several specialised committees within an institution and in so far as the number of non-executive members of the supervisory body permits, the institution shall ensure that the members of the respective committees are different. Moreover, the institution shall try to ensure an occasional rotation of the chairpersons and members of the specialised committees. 35. The specialised committees shall be chaired by one of their members. These committee chairpersons shall have in-depth knowledge in the area of activities of the committee they chair and shall ensure a critical and constructive debate within the committee. 36. The specialised committees shall meet on a regular basis to carry out the tasks assigned to them or to prepare meetings of the supervisory body. According to their needs, they may be assisted by external experts, independent of the institution, and may involve, in their work, the réviseur d’entreprises agréé, the members of the management body, the other specialised committees, the heads of the internal control functions and the other persons working for the institution, provided that these persons are not members and do not take part in the recommendations of the committee. 37. The supervisory body shall lay down, in writing, the missions, composition and working procedures of the specialised committees. Under these procedures, the specialised committees shall receive regular reports from the internal control functions on the development in the institution’s risk profile, the breaches of the regulatory framework, the internal governance and the risk management as well as the concerns raised through the internal alert arrangements and the remedial actions. They shall be empowered to request any document and information they deem necessary to fulfil their mission. The committees shall document the agendas of their meetings as well as the findings and recommendations. Furthermore, the procedures shall provide for the conditions under which the external experts provide their assistance and the terms under which other persons are involved in the work of the specialised committees. 38. The supervisory body shall ensure that the different committees interact effectively, communicate with each other, with the internal control functions and the réviseur d’entreprises agréé, and report to the supervisory body on a regular basis. The supervisory body cannot delegate its powers and responsibilities pursuant to this circular to the specialised committees. Sub-chapter 4.2. Management body Section 4.2.1. Responsibilities of the management body 39. The management body shall be in charge of the effective, sound and prudent day-to-day management of the activities and inherent risks. The members of the management body share joint responsibilities for this management, which is carried out in compliance with the strategies and guiding principles approved by the supervisory body and with applicable regulations, taking into consideration and safeguarding the institution's long-term financial interests, solvency and liquidity. This day-to-day management covers all the institution's functions, activities and risks. 40. The management body shall implement, through written internal policies and procedures, all the strategies and guiding principles laid down by the supervisory body in relation to central

CIRCULAR CSSF 26/906 17/50 administration, internal governance and risk management, in compliance with the legal and regulatory provisions and after having heard the internal control functions. The policies shall include detailed measures to be implemented. The procedures shall be the work instructions which govern this implementation. The term "procedures" is to be taken in the broad sense, including all the measures, instructions, internal limits and rules governing the organisation and internal functioning. 41. The management body shall ensure that the institution has the necessary internal control mechanisms, technical infrastructures and human resources to ensure a sound and prudent management of the activities (and inherent risks) within the context of robust internal governance arrangements pursuant to this circular. 42. Under the guiding principles of professional conduct, corporate values and management of conflicts of interest laid down by the supervisory body (cf. section 4.1.1. of this circular), the management body shall define an internal code of conduct applicable to all staff members. It shall ensure its proper application on the basis of regular controls carried out by the compliance and internal audit functions. 43. The purpose of this code of conduct must be the prevention of operational, security and reputational risks which the institution may face due to administrative or criminal sanctions, restrictive measures imposed on it or legal disputes, the damage to its corporate image or the loss of trust of its payment service users. The code of conduct must remind the staff and the members of the management body and of the supervisory body of the compliance with the applicable regulations, the internal rules, the principles that underlie honesty and integrity in their behaviour, by providing examples of acceptable and unacceptable or prohibited professional behaviour and practices, including in the field of anti-money laundering and combating the financing of terrorism, as well as the sanctions that would arise from non￾compliance. 44. The management body shall ensure that all communications and marketing, particularly in digital form (Internet, social media, mobile applications, etc.), are consistent with the institution's strategy and guarantee clear, comprehensible, unambiguous communication on the payment and/or electronic money services provided by the institution and adapted in language and form to the institution's targeted customers. It regularly reviews communications and marketing, including information published on the institution's website, to ensure the use of language and terminology that is appropriate, unambiguous and comprehensible to the institution's targeted customers, with reference to the provisions of this paragraph, paragraph 45 of this circular and with reference to the provisions of Title III "Transparency of conditions and information requirements for payment services" of the LPS. 45. The management body shall ensure that the use of terminology related to services reserved for credit institutions, such as banking services, deposits, bank or neo-bank, bank accounts, etc., or for other (financial) institutions which carry out activities not covered by payment institution or electronic money institution licenses, is prohibited in all its forms.

CIRCULAR CSSF 26/906 18/50 46. The management body shall promptly and effectively implement the corrective measures to address the weaknesses (problems, shortcomings, irregularities or concerns) identified by the internal control functions and the réviseur d’entreprises agréé by considering the recommendations issued in this respect. This approach shall be laid down in a written procedure which the supervisory body shall approve upon proposal of the management body and the internal control functions. According to this procedure, the internal control functions shall prioritise the various weaknesses they identified and set, upon approval of the management body, the appropriate deadlines by which these weaknesses shall be remedied. The management body shall designate the business units or persons in charge of the implementation of the corrective measures by allocating the resources (budget, human resources and technical infrastructure) required for that purpose. The internal control functions shall be in charge of following up on the implementation of the corrective measures. Any significant delay in the implementation of the corrective measures linked to at least weaknesses prioritised by the internal control functions as significant shall be notified by the management body to the supervisory body which must acknowledge time extensions for the implementation of these corrective measures. 47. The institution shall establish a similar procedure, approved by the supervisory body, which shall apply where the CSSF or any competent authority requests the institution to take (corrective) measures. In this case, any delay in the implementation of these measures is to be notified by the management body to the supervisory body and the CSSF. 48. The management body shall verify the implementation of and compliance with internal policies and procedures. Any breach of internal policies and procedures shall result in prompt and adapted corrective measures. 49. The management body shall verify the soundness of the central administration and internal governance arrangements on a regular basis. It shall adapt the internal policies and procedures in light of the internal and external, current and anticipated changes and the lessons learnt from the past. 50. The management body shall inform the internal control functions in advance of any major change in the activities or organisation of the institution in order to enable them to identify and assess the risks which may arise therefrom. The management body shall ensure that in the event of major business or organisational changes, the corporate governance arrangements, including the internal control arrangements, remain complete, reliable, effective and transparent, in accordance with paragraphs 9 and 11 of this circular. 51. Where the management body becomes aware that the central administration and internal governance arrangements no longer ensure a sound and prudent management of the institution or compliance with the safeguarding requirements of funds as set out in Articles 14 and 24-10 of the LPS or that the incurred risks are or will no longer be adequately borne by the institution’s ability to manage these risks, by own funds or regulatory or internal liquidity reserves, it shall inform the supervisory body and the CSSF by providing them, without delay, with any necessary information to assess the situation and present corrective measures to the supervisory body. The obligation to notify the CSSF also applies to any information that calls into question the qualifications or good repute of a member of the supervisory and/or management body, or of a person in charge of an internal control function.

CIRCULAR CSSF 26/906 19/50 52. The management body shall also designate, among its members, the person(s) in charge of the internal control functions and, in accordance with Regulation CSSF No 12-02, the person responsible for the professional obligations as regards the fight against money laundering and terrorist financing. Institutions shall inform the CSSF in advance of any change in the composition of the members of the management body, in accordance with the applicable legal provisions, and shall provide the required documents for appointments, as published on the CSSF website, and/or the reasons explaining their departure, where applicable. 53. In accordance with paragraph 11 of this circular, the central administration and internal governance arrangements shall be designed and implemented in such a way as to ensure their functioning on an ongoing basis. The management body represents an essential permanent function of the institution's internal governance arrangements, and it is therefore the responsibility of the institution and its supervisory and management bodies to ensure and maintain an internal governance system that complies with legal requirements and the requirements of this circular, and in particular to ensure that, in the event of the departure of a member of its management body, the 4-eyes principle is maintained. 54. It is the responsibility of the management body, together with the supervisory body and the internal control functions, to promote an internal risk management and compliance culture that makes the institution's staff aware of the imperatives of sound and prudent risk management and fosters a positive attitude towards internal control and compliance, and to stimulate the development of an internal governance arrangement that makes it possible to achieve these objectives. Section 4.2.2. Composition and qualification of the management body 55. The members of the management body shall, both individually and collectively, have the necessary professional qualifications (knowledge, skills and experience appropriate to the nature, scale and complexity of the institution’s activities and organisation), the good repute and personal qualities to manage the institution and effectively determine the business direction. The personal qualities shall be those which enable them to efficiently perform their mandate as member of the management body with the required commitment, availability, objectivity, critical thinking and independence of mind. The guiding principles governing appointment and succession to the management body explain and define the competences deemed necessary to ensure the appropriate composition and qualification of the management body. 56. The CSSF recommends that the guiding principles governing the appointment and succession to the management body promote aspects of diversity. Aspects of diversity refer to the characteristics of members of the management body, including their age, gender, geographical origin and educational and professional backgrounds. The promotion of diversity is based on the principle of non-discrimination and on measures guaranteeing equal opportunities.

CIRCULAR CSSF 26/906 20/50 57. The management body shall consist of at least two individuals at all times, and its members shall be empowered to effectively determine the direction of the business. The 4-eyes principle must be applied at all times by the management body. The composition of the management body shall reflect the principle that it works as a collegial body. Each member of the management body shall be able to demonstrate his or her ability and experience to contribute effectively to this collegial body in various aspects of the activities to be carried out. Each member of the management body shall have significant importance or influence in the day-to-day management of the institution. The hierarchical relationship between members of the management body (if any) shall not prevent each member from opposing him- or herself to any decision taken within the management body. 58. The qualifications of members of the management body are assessed on the basis of the legal requirements of good repute and professional experience. As such, professionals wishing to become a member of an institution's management body shall be able to demonstrate the adequacy of his/her skills with the legal requirements through previous similar professional experience at a high level of responsibility and autonomy. A member of the management body is expected to have sufficient experience and knowledge to enable him or her to manage day-to-day operations in compliance with the applicable legal and regulatory framework and the principles of sound and prudent management. This experience is assessed not only by the level of responsibility previously assumed and the length of time these responsibilities were held, but also by the qualifications acquired by the professional. 59. The management body shall collectively possess the knowledge, skills and experience appropriate to the nature, scale and complexity of the institution's activities and organisation. The members of the management body shall be individually fully aware of the internal governance arrangements and their responsibilities within the institution. In particular, they shall be familiar with the activities and functions for which they are directly responsible, have an appropriate understanding and knowledge of the institution's other activities and areas of responsibility, and keep abreast of the institution's activities and developments, as well as the risks to which it is exposed. Notwithstanding the respective areas of expertise of the members of the management body, each member of the management body shall have an appropriate understanding of all the areas for which the management body is collectively and directly responsible. 60. The management body shall have an appropriate understanding of the organisational and operational structure of the institution, in particular with regard to its distribution network, its purpose and the risks associated with it. It shall ensure that the necessary management information is available in due time to all levels of decision-making and control within the institution and within its distribution network. 61. The terms of the members of the management body's contracts shall be fixed in such a way as to enable the management body to exercise its responsibilities effectively and on a continuous basis. 62. The guiding principles governing the appointment and succession of the members of the management body shall include the measures required in order for these members to be and remain qualified throughout their mandate and to ensure the functioning and the continuity in the functioning of the management body. These measures shall include a specific initiation to understand the structure, the business model, the risk profile and the governance arrangements,

CIRCULAR CSSF 26/906 21/50 and then training programs which enable members of the management body, on the one hand, to understand their role, the operations of the institution, and, on the other hand, to update and develop their skills, including their knowledge of the regulatory framework applicable to the institution. The measures shall ensure a smooth transition of knowledge and duties from one member of the management body to his or her successor, as well as compliance at all times with the minimum number of management body members stipulated in this circular. The measures shall also ensure an appropriate responsiveness in the event of a crisis. 63. The members of the management body shall ensure that their mandate is and remains compatible with any other possible mandates and interests they may have, in particular in terms of conflicts of interest, commitment and availability. They shall inform the other members of the management body and the supervisory body on their own initiative of any possible mandates or interests that they have outside the institution. Section 4.2.3. Organisation and functioning of the management body 64. The management body shall constructively and critically assess all the proposals, explanations and information submitted to it for decision. The management body shall document its decisions by way of minutes of meetings, which shall, on the one hand, help it monitor the decisions and, on the other hand, enable it to account for its management towards the supervisory body and the competent authorities. Thus, routine items may be included succinctly in the minutes of a meeting, in the form of a simple decision, while important items on the agenda involving risks for the institution or conflictingly discussed shall be reported in more detail, allowing readers to follow the discussions and to identify the positions taken. 65. Members of the management body shall be employed by the institution or – in the absence of such employment - appropriate contractual arrangements shall be drawn up between the institution and the member in question defining, in particular, the commitment and conditions of service of the executive manager as a member of the management body. 66. The management body shall perform its duties as a permanent function within the institution. Without prejudice to the provisions set out in Circular CSSF 21/769 "Governance and security requirements for supervised entities to perform tasks or activities through telework", as amended, its members shall in principle be permanently on-site. 67. The CSSF must be able to contact directly in Luxembourg the members of the management body. These persons shall be able to provide, without delay, all information on any transactions or operations undertaken by the institution in the context of its activities, which the CSSF deems essential for its supervision, in particular information on the purpose and aim of these transactions and/or operations. 68. In its day-to-day management, the management body shall take into account the advice and opinions of the internal control functions. When decisions taken by the management body have or could have a material impact on the institution's risk profile, the management body shall first obtain the opinion of the compliance function and, where applicable, of the risk control function.

CIRCULAR CSSF 26/906 22/50 69. The members of the management body share the day-to-day tasks of close monitoring of the various activities. The institution shall organise this allocation in such a way as to avoid conflicts of interest. As such, the same member of the management body may not be assigned responsibility for both, risk taking functions and independent control of these same functions. When, due to the small size of the institution, it is unavoidable to group several tasks and responsibilities under the same person, this grouping shall be organised in such a way so as not to adversely affect the objective pursued by the separation of tasks. 70. The management body informs the supervisory body in full, in writing, on a regular basis and at least once a year, of the implementation, adequacy, effectiveness and compliance of the internal governance arrangements, including the state of internal control. On this occasion, it gives an opinion on the achievement of the internal control objectives, describes the resources deployed and presents a summary of the main findings and shortcomings identified, in particular by the internal control functions, the corrective measures decided upon and the effective follow-up of these measures. 71. Once a year, the management body shall confirm compliance with this circular to the CSSF by way of a single written sentence followed by the signatures of all the members of the management body. Where, due to non-compliance, the management body is not able to confirm full compliance with this circular, the aforementioned statement takes the form of a reservation which clearly and succinctly outlines the non-compliant items by providing explanations on their existence as well as the measures decided and / or already taken to remediate the non-compliant items. The information to be provided pursuant to the first paragraph must be submitted to the CSSF as soon as possible, and at the latest by the last day of the third month following the institution's financial year-end. Chapter 5. Administrative, accounting and IT organisation Sub-chapter 5.1. Organisation chart and human resources 72. In accordance with Articles 11(2) and 24-7(2) of the LPS, the institution shall demonstrate sound administrative and accounting organisation, as well as adequate internal control procedures. 73. The institution shall maintain sufficient on-site human resources with appropriate individual and collective professional competences to act and take decisions within the framework of the strategies adopted by the supervisory body and the policies set by the management body and in accordance with delegated powers, and to execute the decisions taken in compliance with existing procedures and regulations. 74. The organisation chart and the tasks description shall be laid down in writing and made available to all relevant staff in an easily accessible manner. 75. The organisation chart shows the structure of the various departments and the hierarchical and functional links between them and with the supervisory and management bodies. 76. The tasks description to be filled in by the operating staff shall explain the function, powers and responsibility of each officer.

CIRCULAR CSSF 26/906 23/50 77. The organisation chart and the tasks description shall be established based on the principle of segregation of duties. Pursuant to this principle, the duties and responsibilities shall be assigned so as to avoid making them incompatible for the same person. The goal pursued shall be to avoid through reciprocal controls environment a person from making mistakes and committing irregularities which would not be identified. The goal pursued is to prevent, by means of an environment of reciprocal controls, that a person can commit errors and irregularities that would remain undetected. 78. When, due to the small size of the institution, it is unavoidable to group several tasks and responsibilities with the same person, this grouping shall be organised in such a way as not to adversely affect the objective pursued by the separation of tasks. 79. The institution has an ongoing training program to ensure that staff and members of the management and supervisory bodies remain qualified and understand the internal governance arrangements as well as their own roles and responsibilities in this regard. 80. Institutions are recommended to establish a rule whereby each staff member takes at least two consecutive calendar weeks of personal leave annually. It shall be assured that each staff member is actually absent during that leave and that his/her substitute actually takes charge of the work of the absent person. Sub-chapter 5.2. Procedures and internal documentation 81. The institutions shall document all central administration, internal governance including internal control, arrangements in writing. This documentation shall cover the strategies, guiding principles, policies and procedures relating to central administration, internal governance and risk management. It shall include a clear, comprehensive, detailed and accessible manual of procedures, those procedures shall be known to all concerned staff and updated on an ongoing basis. 82. The description of the procedures to ensure the proper execution of activities shall cover the following points: • the successive and logical stages of transaction processing, from their initiation to the archiving of their documentation ("workflow"), including applicable thresholds, document flows, where applicable, and the designation of functions in charge of carrying out each stage, and • the controls to be carried out, as well as the means to ensure that they have been correctly carried out and in compliance with applicable procedures, including applicable thresholds, and the designation of functions in charge of validations and controls for each stage. 83. The institutions shall document, in writing, all their transactions, i.e. any process which includes a commitment of the institution as well as the decisions relating thereto. The documentation shall be updated and archived by the institution in accordance with applicable legal provisions. It shall be organised in such a way that it can be easily accessed by any authorised third party. 84. Since the purpose is to ensure that operations are carried out correctly, procedures shall be clear and complete in their content and be known by all staff members. Furthermore, procedures must be updated without delay in the event of any internal or external change affecting their content.

CIRCULAR CSSF 26/906 24/50 85. The files, working papers and control reports of the internal control functions, experts and service providers referred to in sub-chapter 6.2 related to the internal control functions as well as the long form reports drawn up by the réviseur d’entreprises agréé shall be kept in the Luxembourg institution during at least five years, without prejudice to other applicable laws, in order to enable the institution to retrace the controls carried out, the identified problems, shortcomings or irregularities as well as the recommendations and conclusions. The CSSF as well as the réviseur d’entreprises agréé must always be able to access these documents. 86. All transaction orders initiated by the institution and all correspondence with the payment service users or their proxies shall be issued by the institution in Luxembourg. All correspondence is addressed to and sent from the institution. In the case where the institution has a branch abroad, the latter is the contact point for its own customers. Sub-chapter 5.3. Administrative and technical infrastructure 87. The institution shall have support and control functions, and the material and technical resources necessary, sufficient and appropriate for the performance of its activities and the management of the risks arising therefrom. Material and, in particular, technical resources shall be adequate to the nature, scale and complexity of the institution’s activities, which include enabling the institution to minimise potential errors arising from the execution of manual tasks. Section 5.3.1. Financial and accounting function 88. The institution shall have a finance and accounting function whose mission is to assume the financial and accounting management of the institution. Without prejudice to the requirements set out in Circular CSSF 22/806 concerning the outsourcing of certain operational tasks of the financial and accounting function, this financial and accounting function shall ensure that the intervention of other services is carried out in strict compliance with the chart of accounts and related instructions, and under the control of the accounting and financial function. 89. The finance and accounting function will operate in accordance with written rules and procedures that are regularly reviewed and re-evaluated and that enable: • the identification and recording of all payment and electronic money transactions undertaken by the institution; • the explanation of the changes in the accounting balances from one closing date to the next by keeping the movements which had an impact on the accounting items; • the preparation of the accounts by applying the accounting and valuation rules laid down in the relevant accounting laws and regulations; • the production and transmission of periodic and punctual requested information to the CSSF or any other competent authority; • the record-keeping of all accounting documents in accordance with the applicable legal provisions; • the verification of the reliability and relevance of market prices and fair values used while preparing the accounts and the reporting to the CSSF;

CIRCULAR CSSF 26/906 25/50 • the production and transmission without delay of periodic and punctual information to the CSSF, including primarily legal and regulatory reporting, and to ensure its reliability, particularly with regard to solvency and the protection of payment service users' funds; in this context, institutions are required to have at their disposal at the end of each day, without condition and/or restriction of access of any kind whatsoever, the balances of all accounts and all accounting movements for the day in order to provide any competent authority with the required information without delay; • the drawing-up of, where appropriate, accounts according to the accounting scheme applicable in the home country of the shareholder in order to prepare consolidated accounts; • the completion of reconciliation of accounts and accounting entries; • the production of reliable financial information that is rapidly available to the management body ("management information") and the supervisory body, enabling them to closely monitor changes in the institution's financial situation, including the solvency of the institution and its compliance with budget data. This information shall be used as a management control tool and will be even more effective if it is based on analytical accounting; • the guarantee that the financial reporting is reliable. 90. Without prejudice to the controls deployed at the level of the financial and accounting function or the outsourcing of certain tasks of the financial and accounting function, the information to be communicated periodically and punctually at the request of the CSSF and any competent authority shall be systematically and formally reviewed and validated by a member of the management body. 91. In applying the proportionality principle, the CSSF may recommend that certain institutions appoint a responsible person dedicated to the finance and accounting function and to management information control. This person reports directly to the management body. The person responsible dedicated to the finance and accounting function and to management information control shall possess appropriate knowledge and competence and a high degree of professional experience within the financial and accounting areas, including in respect of the applicable accounting framework. It is recommended that this person be selected, appointed or dismissed according to a written procedure, with prior approval by the supervisory body. 92. The tasks carried out within the financial and accounting department cannot be combined with other incompatible tasks, be they business-related or administrative. 93. When opening counterparty accounts/third-party accounts, each institution defines precise rules for recording the accounts in its accounting system. It also specifies the conditions under which authorisation is given for these accounts to operate and under which they may be closed. 94. The institution must avoid having, in its accounting system, a multitude of accounts with uncontrollable items that could lead to the execution of unauthorised or fraudulent transactions; particular attention shall be paid to dormant accounts. In this respect, the institution shall put in place appropriate verification and monitoring procedures.

CIRCULAR CSSF 26/906 26/50 95. The opening and closing of internal accounts in the accounting records must be validated by the financial and accounting department. In case of opening accounts, this validation must take place before these accounts become operational. The institution shall set out rules concerning the use of such accounts and the powers relating to their opening. The financial and accounting department shall ensure that the internal accounts are periodically subject to a procedure which justifies their need. It is necessary to ensure that internal accounts and payable-through accounts are not kept open where they would no longer be in line with the use defined by the set rules. 96. Entries that have a retroactive effect can only be used for regularisation purposes. Entries that have a retroactive effect as well as entries regarding reversals are to be authorised and supervised by both the departments which are at the origin of these entries and the financial and accounting department. 97. The entire accounting organisation and procedures shall be described in accounting procedures manual. While defining and implementing these procedures, the institutions shall ensure compliance with the principle of integrity in order to avoid, in particular, that the accounting system is used for fraudulent purposes. Section 5.3.2. IT function 98. The institutions shall organise their IT function so as to have control over it and to ensure its robustness, effectiveness, consistency and integrity. For those purposes, they shall comply with the requirements of the Regulation (EU) 2022/2554 on digital operational resilience for the financial sector and the CSSF Circulars regarding ICT and security risk management. They shall also update on an ongoing basis the information and documents required under Circular CSSF 18/677 regarding the EBA Guidelines on the information to be provided for the authorisation of payment institutions and electronic money institutions and for the registration of account information service providers under Article 5(5) of Directive (EU) 2015/2366 (EBA/GL/2017/09). 99. Institutions which rely on service providers as regards the IT function shall comply with the conditions laid down in Circular CSSF 22/806 on outsourcing. Section 5.3.3. Communication and internal and external alert arrangements 100.The internal communication arrangements shall ensure that the strategies, policies and procedures of the institution as well as the decisions and measures taken by the management body, directly or by way of delegation, are communicated in a clear and comprehensive manner to all staff members of the institution, considering their information needs and their responsibilities within the institution. The internal communication arrangements shall enable staff to have an easy and constant access to this information.

CIRCULAR CSSF 26/906 27/50 101.The management information system shall ensure that all management information is, in normal circumstances and in crisis situations, transmitted, in a clear and comprehensive manner, and without delay, to all members of the management body, to the supervisory body and staff of the institution, considering their information needs, their responsibilities within the institution and the objective to ensure a sound and prudent business management. 102.The Law of 16 May 2023 transposing Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law aims at protecting a whistleblower against retaliation from an employer or any natural or legal person able to exercise restraint in respect of the activity of the whistleblower. This obligation applies to all private legal entities. The CSSF has also made a tool and a procedure to report incidents directly to it available on its website (https://whistleblowing.apps.cssf.lu/index.html?language=en). The applicable legal framework is supplemented by Article 8-3 of the Law of 12 November 2004 on combating money laundering and terrorist financing, as introduced by the Law of 25 March 2020, providing a specific reporting framework for AML/CFT and by Article 58-10 of the Law of 10 November 2009 on payment services, as amended, which allows the CSSF to put in place effective mechanisms promoting the reporting of violations of Regulation (EU) 2015/847. Chapter 6. Internal control 103.Internal control is a system of rules and procedures designed to ensure that the objectives set by the institution are reached, that resources are efficiently used, that risks are controlled and assets and liabilities protected, that payment service users' funds are safeguarded, that financial and management information is accurate, comprehensive, relevant, understandable and available without delay, the laws and regulations as well as internal policies and procedures are complied with, and that requests and requirements of the CSSF are met. Internal control mechanisms also provide for mechanisms aimed at preventing execution errors and frauds, and to enable their early detection. Internal control mechanisms shall also be applied by branches that institutions have abroad, without prejudice to local legal or regulatory provisions existing in this matter. The internal control arrangements shall include effective processes and procedures preventing fraud and ensure compliance with the obligations regarding the fight against money laundering and terrorist financing as well as compliance with the obligations aiming to prevent, investigate, detect and where necessary report payment frauds. The institutions shall assess their exposure to the risk of being misused for money laundering or terrorist financing purposes, adapt their control arrangements to the level of identified risk (risk-based approach) and take efficient mitigating measures to reduce this risk, as well as the associated operational and reputational risks. These arrangements guarantee adequate information and training of staff in relation to these risks. 104.The internal control arrangements of an institution must be adapted to its organisation and to the nature, scale and complexity of its activities and related risks and comply with the principles of a "three lines of defence" model. • The first line of defence consists of the business units which take or are exposed to risks, which are responsible for their management and which monitor compliance with the policies, procedures and limits imposed on them, on a permanent basis.

CIRCULAR CSSF 26/906 28/50 • The second line consists of support functions, such as the financial and accounting function, and especially the compliance and the risk control functions (as long as such risk control function is foreseen as referred in paragraph 163 of this circular) which control risks on an independent basis and support the business units in complying with the applicable policies and procedures. • The third line consists of the internal audit function which makes an independent, objective and critical assessment of the first two lines of defence and of the internal governance arrangements as a whole. The three lines of defence are complementary, each line of defence assuming its control responsibilities regardless of the other lines. 105. The implementation of sound internal control arrangements shall go hand in hand with a relevant segregation of functions, duties and responsibilities, the implementation of a management of information access and the physical separation of certain functions and departments in order to secure data and transactions. 106.The controls implemented (i.e. operational controls, risk control, etc.) must be sufficiently and precisely documented to demonstrate their execution and effectiveness. Sub-chapter 6.1. Operational controls A robust and solid internal control environment includes notably the following types of controls that fall under the first line of defence: Section 6.1.1. Day-to-day controls carried out by the operating staff 107.The internal control procedures shall provide that the operating staff control, on a day-to-day basis, the operational tasks and/or processes they carry out as part of the institution's activities or the services it provides, in order to detect errors and omissions in the handling of these operational tasks and current processes as quickly as possible. Where these operational tasks are outsourced, the institution must ensure that they are carried out correctly and in compliance with Circular CSSF 22/806 on outsourcing. Section 6.1.2. Ongoing critical controls 108.This category of controls shall include inter alia: • hierarchical control; • validation (for example dual signature, codes of access to specific features) associated with the monitoring of compliance with the authorisation procedure and procedure for delegating powers adopted by the management body; • reciprocal controls; • regular statement of the existence and the value of the assets, liabilities and funds of payment service users, in particular by means of verification of the inventories; • reconciliation and confirmation of accounts;

CIRCULAR CSSF 26/906 29/50 • checking the accuracy and exhaustiveness of data provided by the people in charge of commercial and operational functions, for the purpose of the administrative follow-up of operations; • verification of the normal nature of the transactions entered into, in particular as regards their price, scope, any guarantees to be received or provided, profits generated and losses incurred, and the extent of any costs. The proper functioning of ongoing critical controls is guaranteed only if the principle of segregation of duties is complied with. Section 6.1.3. Controls are carried out by the members of the management body on the activities or functions which fall under their direct responsibility 109. The members of the management body shall personally oversee the activities and functions, which fall under their direct responsibility, on a regular basis. These controls shall be conducted based on the data received from the business, support and control functions and the various operational, IT and administrative units of the institution. 110.The areas requiring particular attention by these persons are inter alia: • the risks associated with the activities and functions for which they are directly responsible; • the compliance with the laws and standards applicable to the institution, with a particular attention to requirements for protecting funds received from payment service users; • the compliance with the policies and procedures established by the management body and the supervisory body; • the compliance with established budgets and the review of actual achievements and gaps; • the compliance with limits (in particular based on exception reports); • the characteristics of the transactions, in particular their price, their individual profitability; • the evolution of the overall profitability of an activity. 111. The members of the management body shall regularly inform the other members of the management body about the exercise of their control duties at meetings of the management body. 112. The internal control arrangements shall provide for appropriate written documentation of the various levels of control as described here above, enabling the effective implementation of internal policies and procedures to be accounted for. Such documentation shall comprise both manual and hierarchical controls performed by the different controls levels and automated controls and/or controls integrated in the payment systems or other tools used by the institution.

CIRCULAR CSSF 26/906 30/50 Sub-chapter 6.2. Internal control functions 113.The policies implemented with respect to compliance and internal audit shall establish two distinct internal control functions, on the one hand, the compliance function which is part of the second line of defence and on the other hand, the internal audit function which is part of the third line of defence. When an institution sets up an independent, permanent risk control function, it also falls under the second line of defence. The institution’s policies shall describe the fields of intervention directly related to each internal control function, clearly defining the responsibilities for the common fields of intervention in order to avoid redundancies and conflicts of powers, and define the objectives as well as the independence, authority, objectivity and permanence of the internal control functions. Sections 6.2.1, 6.2.2, 6.2.3 and 6.2.4 of this circular, relating to the generic responsibilities, characteristics, performance of work and organisation of internal control functions, shall apply to the compliance function and the internal audit function. Where an independent and permanent risk control function is set up or needs to be set up in accordance with the principle of proportionality set out in paragraphs 3 and 162 of this circular, the sections 6.2.1, 6.2.2, 6.2.3 and 6.2.4 of this circular shall also apply to this function. Section 6.2.1. General responsibilities of the internal control functions 114.The main purpose of the internal control functions shall be to verify compliance with all the internal policies and procedures which fall within the area for which they are responsible, to regularly assess their adequacy with respect to the organisational and operational structure, the strategies, the activities and the risks of the institution as well as with respect to the applicable legal and regulatory requirements, and to report directly to the management body as well as to the supervisory body and, where appropriate, to the specialised committees. They shall provide the management body and the supervisory body, and, where appropriate, the specialised committees with the opinions and advice they deem useful or which are requested by these bodies or committees. Notwithstanding the relevant specific responsibilities assigned to the compliance function, all the internal control functions shall contribute to the efficient fight against money laundering and terrorist financing. 115.Where they consider that the effective, sound or prudent business management is compromised, the heads of the internal control functions shall promptly inform, on their own initiative, the management body and the supervisory body or, where appropriate, the specialised committees. Section 6.2.2. Characteristics of the internal control functions 116.The internal control functions shall be permanent and independent functions each with sufficient authority. The heads of these functions shall have direct access right to the supervisory body or its chairperson or, where appropriate, to the specialised committees which are part of it, to the réviseur d’entreprises agréé of the institution as well as to the CSSF. 117.The independence of the internal control functions is incompatible with a situation where:

CIRCULAR CSSF 26/906 31/50 • the staff of the internal control functions are in charge of tasks they are called upon to control; • the remuneration of the staff of the internal control functions is linked to the performance of the activities they control or is determined according to other criteria which compromise the objectivity of the work carried out by the internal control functions; • the internal control functions are, from an organisational point of view, included in the business units they control or report hierarchically to them; • the heads of the internal control functions are subordinated to the persons in charge of, or responsible for, the activities which the internal control functions are called upon to control. In the case of an institution with a management body composed of only two members, the application of the proportionality principle will require the separation of supervision from second- and third-line internal control functions. 118.The authority which the internal control functions must have, requires that these functions be able to exercise their responsibilities, on their own initiative, express themselves freely and access all external and internal data and information (in all the institution’s business units they control) they deem necessary to fulfil their missions. 119.The internal control functions or service providers acting on behalf of these functions are to carry out their work with objectivity. In order to ensure objectivity, the heads of the internal control functions shall be independent minded; they must not make their own judgement conditional upon that of other persons including, in particular, those controlled and shall ensure to avoid conflicts of interest. 120.The guiding principles governing the appointment and succession of the members of the internal control functions provide for the measures required in order for these members to be and remain qualified. These measures include a specific initiation to understand the structure, the business model, the risk profile and the governance arrangements, and then training programs which enable members of the heads of internal control functions, on the one hand, to understand the operations of the institution, their role and, on the other hand, to keep up to date and develop their competences. The measures shall ensure the permanence at all times of the heads of the compliance function, of the internal audit function and where required of the risk control function. The measures shall also ensure an appropriate response capability in the event of a crisis. 121.The members of the internal control functions must, individually and collectively, possess high professional knowledge, skills and experience in the field of payments, electronic money and similar activities, especially in their field of responsibility with respect to applicable standards. In accordance with the principle of proportionality, the required skill level shall increase given the internal organisation of the institution and the nature, scale and complexity of its activities and risks. The individual skills must include the ability to make critical judgements and to be heard by the members of the management body of the institution. 122.The internal control functions keep their knowledge updated and provide ongoing, up-to-date training for all their staff. 123.In addition to their high professional experience, the heads of the internal control functions, who take on such a position for the first time, shall have the necessary theoretical knowledge.

CIRCULAR CSSF 26/906 32/50 124.In order to guarantee the execution of the tasks assigned to them, the internal control functions shall have the necessary and sufficient human resources, infrastructure and budget, in line with the principle of proportionality. The budget must be sufficiently flexible to reflect an adaptation of the missions of the internal control functions in response to changes in the institution’s organisation, its activities and risks or upon the occurrence of specific events. Institutions that use the services of service providers for their internal control functions shall refer to Circular CSSF 22/806 on outsourcing. 125.The scope of intervention of the internal control functions shall cover the whole institution within the limits of their respective competences. It shall include activities carried out through networks of agents, distributors or representative offices, as well as unusual and potentially non￾transparent activities. 126.Each institution shall take the necessary measures to ensure that the members of the internal control functions perform their functions with integrity and discretion. Section 6.2.3. Execution of the internal control functions’ work 127. The internal control functions shall document the work carried out in accordance with the assigned responsibilities, in particular in order to allow retracing the interventions as well as the conclusions reached. 128.The internal control functions shall report, in writing, on a regular basis and, if necessary, on an ad hoc basis, to the management body and the supervisory body or, where appropriate, to the specialised committees. These reports shall concern the follow-up to the recommendations, problems, shortcomings and irregularities found in the past as well as the new identified problems, shortcomings and irregularities. Each report shall specify the risks related thereto as well as their severity (measuring the impact) and shall propose corrective measures, as well as in general the position of the persons concerned. 129.Each internal control function shall prepare, at least once a year, a summary report on its activities and its functioning covering all the activities assigned to it. As regards the activities, each summary report shall include a statement of the function’s activities carried out since the last report, the main recommendations to the management body, the (existing or emerging) problems, the major shortcomings and irregularities found since the last report and the measures taken in this respect, as well as a description of the controls carried out, the shortcomings and anomalies found, recommendations and proposals for corrective action, and a statement of the position of the persons controlled, with an appropriate deadline for corrective action, where applicable. An indication of the relative importance of anomalies and deficiencies according to their level of risk and priority shall be provided. 130.This summary report shall provide an update on the completion of the control plan as defined for the year. It shall also include, where appropriate, justification for any delays or postponement of the mission. 131.This summary report shall draw up an inventory of the key controls carried out by topic covered and includes a description of these controls (use of a walk-through test, sampling, review of procedures, etc.). 132.The summary report shall show both the exceptions identified for which remedial action has not yet been implemented, and those which have been deemed closed during the year.

CIRCULAR CSSF 26/906 33/50 133. The summary report shall include a section dedicated to the follow-up of exceptions identified in previous years but not yet closed at the date of submission of the previous report, including an update on how the exceptions were closed, as well as a statement of the management body's position and new deadlines, where applicable. 134.The summary report shall provide an opinion on the state of the control area as a whole. With regard to the functioning, the report shall comment in particular on the adequacy of internal human and technical resources and the nature and extent of recourse to external human and technical resources, as well as on any problems that may have arisen in this context. This report shall be submitted for approval to the supervisory body or, where appropriate, to the specialised committees responsible for ensuring the follow-up with the supervisory body; it shall also be submitted for information to the management body. The report shall be written in French, German or English. 135.In the event of serious problems, deficiencies or irregularities, the heads of the internal control functions shall immediately inform the management body, the chairperson of the supervisory body and the chairpersons of the specialist committees, as appropriate. In such cases, the heads of the internal control functions may ask to be heard by the supervisory body in a private meeting. 136. The internal control functions shall verify the effective follow-up of the recommendations relating to the problems, shortcomings and irregularities identified in accordance with the procedure referred to in paragraph 46 of this circular. They shall report on this subject to the management body on a regular basis. In the event of any delay in the implementation of corrective measures, the management body informs the supervisory body, which must authorise extensions to the deadlines for implementing corrective measures. Section 6.2.4. Organisation of the internal control functions 137. Each internal control function shall be under the responsibility of a separate head of the function who shall be selected, appointed and dismissed by the management body in accordance with a written internal procedure. It is recommended that appointments and dismissals of heads of internal control functions be approved in advance by the supervisory body. 138.The institutions shall inform the CSSF in advance, in writing and without delay, of any changes to the Head of Internal Audit and the Chief Compliance Officer. Each appointment shall include the information and documents required, as published on the CSSF website, and departures shall include the explanatory reasons. When the institution sets up an independent and permanent risk control function, it shall inform the CSSF in writing of the name of the person in charge of this function and inform the CSSF of any change concerning the person in charge of this function. 139.The heads of internal control functions are accountable to the management body and, ultimately, to the supervisory body for the execution of their duties. In this capacity, they must be able to contact the supervisory body or its chairperson directly and on their own initiative, and, where appropriate, the relevant specialised committee. 140.The heads of the internal control functions are referred to as "Chief Compliance Officer" for the compliance function and "Chief Internal Auditor" for the internal audit function. If an independent risk management function has been set up, the head of this function is referred to as the Chief Risk Officer.

CIRCULAR CSSF 26/906 34/50 141.Any outsourcing of operational tasks of an internal control function is only permitted in accordance with the applicable Circular CSSF 22/806 on outsourcing arrangements. 142.Any engagement to service providers must comply with the requirements of Circular CSSF 22/806 on outsourcing arrangements. These service providers shall carry out their work in compliance with the regulatory and internal provisions applicable to the internal control function and the area of control in question. They must be placed under the responsibility of the head of the internal control function. This person shall supervise the work of these external service providers. 143.In the case of branches, the internal control functions at the head office shall carry out regular on-site inspections of the branch. Where an institution has a branch of a certain size, in accordance with the principle of proportionality, internal control functions must also be set up at branch level. 144.The internal control functions within the branches shall depend, from a hierarchical and functional point of view, of the control functions of the legal entities to which they belong and report. The heads of the institution's control functions shall give their approval for any recruitment or dismissal of heads of branch control functions. Reports drawn up in accordance with the provisions of this circular shall be submitted not only to the local branch manager, but also, in summary, to the institution's internal control functions. Section 6.2.5. The compliance function Sub-section 6.2.5.1. The compliance charter 145.The modalities of functioning of the compliance function shall be laid down in a compliance charter drawn up by the compliance function and approved by the management body and, ultimately, by the supervisory body. 146. The compliance charter must at least: • define the position of the compliance function in the organisation chart of the institution while specifying its key characteristics (independence, objectivity, integrity, competences, authority and adequacy of the resources); • recognise the compliance function’s right of initiative to open investigations about all activities of the institution, including those of its branches, representative office, agents or distributors in Luxembourg and abroad, and the right to access all documents, materials and minutes of the consultative and decision-making bodies of the institution, to meet all persons working in the institution, to the extent required to fulfil its mission; • define the objectives, responsibilities, competences and reporting lines of the compliance function; • describe relations with the internal audit and, where applicable, risk control functions, as well as any delegation and/or coordination requirements within the institution; • define the conditions and circumstances applicable when external experts are used;

CIRCULAR CSSF 26/906 35/50 • establish the right for the Chief Compliance Officer to, directly and on his/her own initiative, contact the chairperson of the supervisory body or, where appropriate, the members of the specialised committee as well as the CSSF. The contents of the compliance charter shall be brought to the attention of all staff members, including those who work in branches in Luxembourg and abroad. 147. The compliance charter must be dynamic and promptly updated to reflect changes in current standards affecting the institution. All modifications must be approved by the management body and the supervisory body. Sub-section 6.2.5.2. Scope and specific responsibilities of the compliance function 148.The aim of the compliance function is to anticipate, identify, assess, report and monitor the compliance risks of an institution as well as to assist the management body in providing the institution with measures to comply with the applicable laws, regulations and standards. The compliance risks may include a variety of risks such as the reputational risk, legal risk, risk of dispute, risk of sanctions, as well as some other operational risk aspects, in connection with all the institution’s activities. These tasks shall be performed on an ongoing basis and without delay. 149. For the purposes of reaching the objectives set, the responsibilities of the compliance function must cover at least the following aspects: • the compliance function shall identify, on an ongoing basis, the standards to which the institution is subject in the exercise of its activities in the various markets and shall keep records of the main rules. These records must be accessible to the relevant staff of the institution. In this context, "standards" refers to all the rules to which the institution is subject in carrying out its activities in its various markets; • the compliance function shall identify the compliance risks to which the institution is exposed in the exercise of its activities and assess their significance and the possible consequences. The compliance risk classification so determined must enable the compliance function to develop a control plan according to the risk, thereby allowing an effective use of the compliance function’s resources; • the compliance function shall ensure the identification and assessment of the compliance risk before the institution expands into new activities, products, business relationships, or markets, as well as when developing transactions and the network of a group at international level ("New Product Approval Process" as defined in sub-chapter 7.3. of this circular); • the compliance function shall ensure that, for the implementation of the compliance policy, the institution has rules that can be used as guidelines by the staff from different disciplines in the exercise of their day-to-day tasks. These rules must be appropriately reflected in the instructions, procedures and internal controls of areas directly under the compliance function and shall take into account the institution’s code of conduct and corporate values.

CIRCULAR CSSF 26/906 36/50 For institutions with branches, the compliance policy at the branch level must take into account the standards applicable at the local level; • the areas falling directly under the remit of the compliance function are typically the fight against money laundering and terrorist financing, fraud, the protection of the customers’ interests and data and the prevention and management of conflicts of interest. This list is not exhaustive and each institution shall decide whether its compliance function shall also cover compliance with rules other than those listed above; • the Chief Compliance Officer is particularly responsible for ensuring that the fight against money laundering and the financing of terrorism is reflected in effective measures and controls that are appropriate to the risks. The compliance function's summary report, a copy of which shall be sent to the CSSF, will cover all areas under the responsibility of the compliance function, reporting concisely but without omission on the activities and events related to the area concerned, i.e. the main recommendations issued, the major deficiencies, irregularities and problems (existing or emerging) observed, the corrective and preventive measures put in place, and a list of deficiencies, irregularities and problems for which appropriate corrective measures have not yet been taken. The report shall describe the progress of the compliance monitoring plan and the anti-money laundering and counter terrorist financing plan, in particular the planned controls to be carried out by the compliance function and shall explain which elements of the plan could not be completed within the planned timeframe. The report must allow assessing the seriousness of the events covered and the adequacy of the compliance monitoring plan, to allow an overall judgment on the adequacy and effective functioning of the preventive framework put in place by the institution; • in general, the compliance function shall be organised so that it covers all the areas which may result in compliance risks. The areas other than those listed above may not be directly covered by the compliance function. The compliance risk is then to be covered by the other internal control functions in accordance with a compliance policy clearly defining the duties and responsibilities of the different stakeholders in this area and subject to compliance with the segregation of duties. In this case, the Chief Compliance Officer shall assume the role of coordination, centralisation of information and verification that the other areas, which do not directly fall within his/her scope of intervention, are well covered. 150.The compliance function shall verify compliance with the policy and procedures, on a regular basis, and shall be in charge of the adaptation proposals, where necessary. To this end, the compliance function shall assess and control the compliance risk, on a regular basis, in the context of a structured monitoring program. In respect of the compliance risk controls and the verification of the procedures and instructions, the provisions of this circular shall not prevent the compliance function from taking into account the internal audit work. 151.The compliance function shall centralise all information on the compliance problems (inter alia internal and external frauds, breaches of standards, non-compliance with procedures and limits or conflicts of interest) identified by the institution. In so far as it did not obtain this information as part of its involvement, it shall examine relevant documents, whether internal (for instance control reports and internal audit reports, reports or statements of the management body or, where appropriate, the supervisory body) or external (for instance reports of the réviseur d’entreprises agréé, correspondence from the supervisory authority).

CIRCULAR CSSF 26/906 37/50 152.The compliance function shall assist and advise the management body on issues of compliance and applicable laws, regulations and standards, notably by drawing its attention to changes in standards which may subsequently have an impact on the compliance area. 153.The compliance function shall raise awareness of the staff about the significance of compliance and related aspects and assist them in their day-to-day operations related to compliance. To this end, it shall also develop an ongoing training program and ensure its implementation. 154.The Chief Compliance Officer shall be the key contact person of the competent authorities in relation to the fight against money laundering and terrorist financing for any question in this respect. He or she shall also be in charge of the transmission of any information or report to these authorities. Sub-section 6.2.5.3. Organisation of the compliance function 155.Institutions shall set up a permanent and independent compliance function, taking into account the general considerations on the organisation of internal control functions and the characteristics of internal control functions set out in the previous sections. 156.The Chief Compliance Officer shall be employed on a full-time basis in Luxembourg by the institution and shall be 100% dedicated to the compliance function. It is not permissible for a single person to combine the responsibilities of Chief Compliance Officer and the responsibilities of risk control, or to combine the responsibility of Chief Compliance Officer with other duties incompatible with his or her responsibilities. By way of exception, and with reference to the principle of proportionality, an institution planning to maintain a Chief Compliance Officer on a part-time basis or partially dedicated to the compliance function (ex. performance of risk control tasks by the Chief Compliance officer) must submit a written request to the CSSF, which must include: • a description of the organisation of the compliance function; • the analysis and its conclusions justifying that the compliance function in Luxembourg has the necessary and sufficient human resources, infrastructure and budgets to carry out its tasks and responsibilities in accordance with the principles of this circular and so that the risks of non-compliance with compliance risks, and in particular the risks associated with money laundering and the financing of terrorism, are mitigated appropriately and within the limits of the risk appetite approved by the supervisory body; • the decision of the management and supervisory bodies approving the analysis and its conclusions. 157.Without prejudice to the requirements set out in the circular 22/806 on outsourcing arrangements, in particular in relation to the outsourcing of certain operational tasks of the compliance function or the occasional use of third-party expertise or technical resources, the outsourcing of the compliance function is not permissible.

CIRCULAR CSSF 26/906 38/50 Section 6.2.6. Risk control Sub-section 6.2.6.1. Risk management framework 158.Institutions shall put in place a consistent and exhaustive institution-wide risk management framework, which covers all the activities and operational units of the institution, including the internal control functions, and which fully recognises the economic substance of all their exposures, allowing the management body to retain control over all the risks to which the institution is or may be exposed. This risk management framework must enable the institution to identify, analyse and address the main risks identified in relation to its objectives. 159.The risk management framework must include a set of policies and procedures, limits, controls and alerts ensuring the identification, measurement, management or mitigation and report of these risks by the operational units, the institution as a whole, including branches, subsidiaries, agents, distributors and representative offices. 160.In order to enable the management body to keep certain key aspects of the institution's sectoral risks under strict control, the risk management system must cover, specifically for the institution, risks relating to capital adequacy, the institution's liquidity, the management of the institution's payment flows and the proper functioning of the system for protecting payment service users' funds. 161. Where institutions grant credit linked to payment services under the conditions defined in Articles 10(3) and 24-6(1) of the LPS, the risk management framework also involves the implementation of a robust arrangement enabling: • the management, detection and reporting to the management and supervisory bodies of any excess of credit activity with reference to the risk appetite and internal limits defined and approved by these bodies (see paragraphs 13 and 40 of this circular); • the management and support of the risks associated with this credit activity on an ongoing basis, with a view to ensuring a permanent adequacy of capital and liquidity both in normal times and in times of crisis, in line with internal and legal requirements; • the detection and management of credit activities that have exceeded their contractual and legal deadlines; • the provision to the management and supervisory bodies, and the competent authority, at all times of information on the amount of this credit activity, on credits that are past their due date, and on internal equity and liquidity, enabling the institution to meet legal requirements and cover the risks associated with this credit activity. Where institutions grant credit linked to payment services under the conditions defined in in Articles 10(3) and 24-6(1) of the LPS, this activity is supported by risk acceptance policies that define the permissible risks and the criteria and conditions that apply, as well as policies that define the measures to be taken when a payment service user fails to comply with or notifies the institution that he is no longer able to repay his/her credit/meet his/her obligations, including a procedure for regularising defaults, monitoring the regularisation of defaults and escalation. In addition, institutions shall have a system for managing and provisioning the aforementioned defaults.

CIRCULAR CSSF 26/906 39/50 Sub-section 6.2.6.2. Independent risk control function 162.Depending on the organisation of the institution, the CSSF may request certain institutions, in reference to the principle of proportionality (see paragraph 3 of this circular) to set up an independent, permanent risk control function. Sub-section 6.2.6.3. IT Risk management function 163.Institutions shall implement a risk management framework in respect of information and communication technology (ICT) and security risk management in accordance with the requirements of the Regulation (EU) 2022/2554 on digital operational resilience for the financial sector and the CSSF circulars regarding ICT and security risk management requirements. Section 6.2.7. Internal audit function Sub-section 6.2.7.1. Internal audit charter 164.The operational arrangements of the internal audit function in terms of objectives, responsibilities and powers must be laid down in an internal audit charter drawn up by the internal audit function and ultimately approved by the supervisory body. 165. The internal audit charter must at least: • define the position of the internal audit function in the organisation chart of the institution while specifying the key characteristics (independence, objectivity, integrity, competence, authority and adequacy of resources); • confer to the internal audit function the right of initiative and authorise it to review all the activities and functions of the institution including those of its branches, representative offices, agents and distributors in Luxembourg and abroad as well as the outsourced activities and functions, to access all documents, materials, minutes of the consultative and decision-making bodies of the institution, to meet all persons working in the institution, to the extent required to fulfil its mission; • lay down the reporting and functional lines for the conclusions that may be drawn from the audit missions; • define the relationships with the compliance and risk control functions; • define the conditions and circumstances applicable to the use of external experts or service providers; • define the nature of the work and conditions under which the internal audit function may provide internal consulting services or perform other special missions; • define the responsibilities and reporting lines of the Chief Internal Auditor; • establish the right for the Chief Internal Auditor to contact, directly and on his/her own initiative, the chairperson of the supervisory body or, where appropriate, the members of the audit committee as well as the CSSF;

CIRCULAR CSSF 26/906 40/50 • specify the recognised professional standards governing the functioning and work of the internal audit; • specify the procedures to be observed in respect of coordination and cooperation with the réviseur d’entreprises agréé. 166.The content of the internal audit charter shall be brought to the attention of all staff members of the institution, including those who work in branches in Luxembourg and abroad. 167.The internal audit charter must be updated as soon as possible to take into account the changes that have occurred. Any amendments must be ultimately approved by the supervisory body. They shall be brought to the attention of all staff members. 168.In order not to jeopardise their independence of judgement, the persons from the internal audit function cannot be in charge of the preparation and establishment of elements of the central administration and internal governance arrangements. This principle shall not prevent them from taking part in the implementation of sound internal control mechanisms through opinions and recommendations which they provide in this respect. Moreover, in order to avoid conflicts of interest, a rotation of the control tasks assigned to the various internal auditors shall be ensured, where possible, and it shall be avoided that the auditors hired within the institution audit the activities or functions which they used to perform themselves recently. Sub-section 6.2.7.2. Specific responsibilities and scope of the internal audit function 169.The internal audit function shall examine and assess, among others (non-exhaustive list), the following, in accordance with the organisation and the nature, scale and complexity of the activities: • the monitoring of compliance with the laws and regulations as well as any prudential requirements imposed by the CSSF; • the effectiveness and efficiency of central administration, governance and internal control arrangements, including the risk control and compliance functions; • the safeguarding of the values and assets, protecting payment service users’ funds and respecting internal liquidity reserves; • the adequacy of own funds; • the accurate and complete registration of the transactions and the production of accurate, complete, relevant and understandable financial and prudential information available without delay to the supervisory body and, where appropriate, the specialised committees, to the management body and the CSSF; • the compliance with the policies and procedures. 170.Where there is, within the institution, a separate department in charge of the control or supervision of a specific activity or function, the existence of such a department shall not discharge the internal audit function from its responsibility to audit this specific area. However, the internal audit function may take into account, in its work, assessments issued by this department on the area in question.

CIRCULAR CSSF 26/906 41/50 Sub-section 6.2.7.3. Execution of the internal audit work 171.All internal audit missions shall be planned and executed in accordance with an internal audit plan. The plan shall be established by the Chief Internal Auditor for a period of several years (in general three years). Its purpose shall be to cover all activities and functions, considering both the risks posed by an activity or function and the effectiveness of the organisation and internal control in place for this activity or function (risk-based approach). The plan shall consider the opinions issued by the supervisory body or, where appropriate, the audit committee as well as the management body. The plan shall cover all matters of prudential interest (including the competent authority’s observations and requests) and shall also reflect the developments and innovations provided for as well as the risks which may arise therefrom. The scope of intervention of the internal audit function cannot be limited. 172.Given its critical nature, the safeguarding of funds held by the institution on behalf of payment service users, or through another payment service provider for the execution of payment transactions, shall be the subject to an appropriate annual review by the internal audit function. The review of such area includes, in particular, a review of access rights (to the relevant bank accounts, to critical systems), the reconciliation procedures put in place, compliance at all times with Articles 14 and/or 24-10 of the LPS, and the adequacy of manual and/or automated monitoring procedures over the levels of safeguarding, adapted to the method of safeguarding of funds used. 173.The internal audit plan shall be discussed with the management body and, where appropriate, with the audit committee and ultimately approved by the supervisory body. It shall be reviewed, on an annual basis, and adapted to developments and emergencies. Any modifications, including postponed or cancelled missions, must be reviewed by the management body and the audit committee, where appropriate, before being approved by the supervisory body. The approval implies that the management body provides the internal audit function with the means necessary to implement the internal audit plan. In its summary report to the supervisory body, the internal audit shall indicate and state the reasons for the main changes brought to the audit plan as initially approved by the supervisory body: cancelled missions, delayed missions as well as the missions whose scope has significantly changed. 174.The internal audit plan shall set out the objectives of each mission and the scope of the tasks to be executed, give an estimate of the necessary time and human and material resources and assign an audit frequency to each activity and risk. The internal audit plan shall also provide for the adequate and sufficiently frequent coverage, within a multi-year planning period, of important or complex activities with a potential significant risk, including a reputational risk. It shall focus on the risk of execution errors and the risk of fraud. The internal audit plan shall provide for adequate coverage of areas with a risk of money laundering or terrorist financing, so that the internal audit function may provide, in its summary report, an annual statement of the compliance with the policy regarding the fight against money laundering and terrorist financing. 175. Where the internal audit function of the parent undertaking of the Luxembourg institution carries out on-site inspections of its subsidiary on a regular basis, it is recommended for reasons of effectiveness that, in so far as possible, the Luxembourg institution coordinates its internal audit plan with that of the parent undertaking. In the case where the internal audit plan of a Luxembourg institution is drawn up in coordination with that of its parent institution or the group to which it belongs, the supervisory body retains full responsibility for compliance with regulatory requirements and the principles set out in this circular.

CIRCULAR CSSF 26/906 42/50 176.The internal audit function shall regularly inform the management body and, where appropriate, the audit committee on the implementation of the internal audit plan. 177.Each internal audit mission shall be planned, executed and documented in compliance with the professional standards adopted by the internal audit function in its internal audit charter. 178.Each mission shall be the subject to a written report of the internal audit function, in general, addressed to the audited persons, the management body as well as - possibly in summarised form - to the supervisory body (and, where appropriate, the audit committee). The reports shall be drafted in French, German or English and shall also be made available to the réviseur d’entreprises agréé and the CSSF. This written report shall not only include a description of the shortcomings and anomalies found, but also recommendations and proposals for corrective measures to be taken, including a timetable for their implementation, as well as, as a general rule, a statement of the audited party's position. The report shall also give an indication of the relative importance of the anomalies and deficiencies found, together with recommendations and corrective measures. 179. The internal audit function shall prepare a table of the internal audit missions and the written reports related thereto. It shall draw up a summary report at least once a year, which is submitted to the management body and the supervisory body. A copy of this report shall be submitted to the CSSF, in accordance with Circular CSSF 15/614, and made available to the réviseur d’entreprises agréé. Sub-section 6.2.7.4. Organisation of the internal audit function 180.The institutions shall create a permanent and independent internal audit function, considering the principle of proportionality and the criteria governing its application as well as the considerations regarding the organisation of the internal control functions laid down in this circular. 181.The internal audit function must be independent of the other internal control functions it audits. Consequently, the risk management or compliance functions may not form part of an institution's internal audit function. However, these functions may take into account the work of the internal audit function in verifying the correct application of current standards relating to the activities carried out by the institution. 182.In case operational tasks of the internal audit function are outsourced, institutions shall refer to Circular CSSF 22/806, the external providers shall carry out their work under the internal audit plan of the institution by following a work program, by producing detailed documentation on their work and by drafting reports for each mission. These reports shall be drafted in French, German or English and submitted to the management body, where appropriate, the audit committee, and the supervisory body. Where these external service providers exercise the profession of réviseur d’entreprises agréé, they must in all respects be independent of the institution's réviseur d’entreprises agréé and the institution’s approved statutory auditing firm.

CIRCULAR CSSF 26/906 43/50 Chapter 7. Specific requirements Sub-chapter 7.1. Organisational structure and legal entities (“Know-your-structure”) 183.The organisational structure shall, in terms of branches, network of agents, distributors and representative offices, be appropriate and justified as regards the strategies and guiding principles. It shall be clear and transparent for all the stakeholders. The legal, organisational and operational structure must enable and promote effective, sound and prudent business management. It must not impede the sound governance of the institution, in particular the ability of the management body, to effectively manage and oversee the activities (and the risks) of the institution. 184. The guiding principles that the supervisory body lays down with regard to organisational structure (in terms of branches and the network of agents, distributors and representative offices) provide in particular that: • the organisational structure is free from any undue complexity; • the production and distribution, in a timely manner, of all information necessary for a sound and prudent management of the institution and the legal entities which are part of it are ensured; • any significant flow of management information is documented and may be promptly provided to the supervisory body, the management body, the internal control functions or the competent authority upon their request. 185.The guiding principles regarding internal governance, which the supervisory body lays down, shall provide, notably that complex structures and non-standard or potentially non-transparent activities are subject to an in-depth analysis and an ongoing monitoring of risks, in particular, those associated with financial crime, money laundering and terrorist financing. Irrespective of the fact that the activities are carried out for own account or for the account of customers, the institution must understand the usefulness of these structures and manage the risks that accompany their implementation and their operational functioning. Non-standard or potentially non-transparent activities are notably those carried out through complex legal entities or structures, or in jurisdictions which lack transparency or do not meet international standards.

CIRCULAR CSSF 26/906 44/50 Sub-chapter 7.2. Management of conflicts of interest Section 7.2.1. General requirements 186.The conflicts of interest management policy shall address all conflicts of interest, arising from economic, personal, professional or political purposes, whether persistent or associated with a single event. Particular attention must be given to the conflicts of interest between the institution and its related parties and service providers. This policy shall be applicable to all staff as well as to the members of the management body and the members of the supervisory body. 187.The policy on the management of conflicts of interest shall provide that all current and possible conflicts of interest must be identified, assessed, managed and mitigated or avoided. Where conflicts of interest remain, the policy in this respect shall lay down the procedures to be followed in order to report, document and manage them so as to avoid that the institution, its counterparties and the payment service users suffer unjustified consequences thereof. The policy and procedures in question shall also include the procedure to be followed in case of non￾compliance with this policy. 188.The policy on the management of conflicts of interest shall provide for the identification of the main sources of conflicts of interest - potentially affected relationships and activities as well as all internal and external parties involved - which the institution or its staff and its representatives are or may face. It shall take into consideration not only present situations and events which may result in conflicts of interest, but also those in the recent past in so far as these events continue to have a potential impact on the institution or person concerned. The institution shall determine the materiality of the identified conflicts and shall decide how they must be managed. 189.In order to minimise the possible conflicts of interest, the institution shall set up an appropriate segregation of duties and activities, including through the management of information access and the use of "Chinese walls". 190.The conflicts of interest policy also determines the declaration and escalation procedures applicable within the institution. When they are or have been faced with a conflict of interest, staff members inform their hierarchical superior promptly and on their own initiative thereof. Members of the management body and the supervisory body who are subject to a conflict of interest inform the management body and the supervisory body, respectively, promptly and on their own initiative thereof. The procedures in this regard provide that these members must abstain from taking part in decision-making processes which cause them a conflict of interest, or which prevent them from taking decisions with full objectivity and independence. 191.The internal control functions shall be in charge of identifying and managing conflicts of interest. Section 7.2.2. Specific requirements relating to conflicts of interest involving related parties 192.Transactions with related parties are submitted to the Supervisory Body for approval when they have or could have, individually or in an aggregate manner, a significant and unfavourable influence on the institution's risk profile. 193. Any material changes relating to significant transactions carried out with related parties must be brought to the attention of the supervisory body without delay.

CIRCULAR CSSF 26/906 45/50 194.Transactions with related parties must be carried out objectively and in the best interest of the institution. The interest of the institution is not respected when, in particular, transactions with related parties meet at least one of the following criteria: • they are carried out on less advantageous terms for the institution than those which would apply to the same transaction carried out with a third party ("at arm's length”, transactions at market conditions); • they impair the solvency, liquidity situation or risk management abilities of the institution from a regulatory or internal point of view; • they exceed the risk management and control capacities of the institution or are not part of the standard activities of the institution; • they are contrary to the sound and prudent management principles of the institution. 195.Where the institution is group head, it shall consider, in a balanced way and in compliance with the applicable legal provisions, the interests of all legal entities and branches which are part of the group. It shall consider how these interests contribute to the common objectives and interests of the group over the long term. Sub-chapter 7.3. New Product Approval Process 196.The new product approval process shall cover the development of new activities in terms of products, services, markets, systems and processes or customers as well as their material changes and exceptional transactions. It shall guarantee that any new product remains consistent with the guiding principles established by the supervisory body, the risk strategy, the risk appetite of the institution and where applicable, the relevant limits. 197. The new product approval process shall define, in particular, the changes in the activities subject to the approval process, the considerations to be taken into account, the main issues to be addressed as well as the implementation of the approval process, including the responsibilities of all the parties concerned. The main issues to be addressed shall include regulatory compliance, safeguarding of payment service users’ funds, accounting, pricing models, the impact on risk profile, capital adequacy and profitability, the allocation of adequate resources, and the availability of adequate internal tools and sufficient technical knowledge to understand and monitor the associated risks. 198.Consequently, the institutions shall carefully analyse any proposed change in the activities and ensure that they have the ability to bear the risks related thereto, the technical infrastructure and sufficient and competent human resources to control these activities and the associated risks. The business unit requesting the change in its activities shall be in charge of issuing an analysis/mapping of the risks in this regard. Similarly, the management body and, where applicable, the risk control function, shall carry out a prior, objective and comprehensive analysis of the risks associated with any proposed change in the activities. The risk analysis shall take into account the various scenarios and shall indicate, in particular, the ability of the institution to bear, manage and control the risks inherent in the planned activities. The compliance risk inherent to new products shall also be subject to prior analysis by the compliance function. 199.No new activity may be undertaken before approval has been given by the management body, after having heard all parties concerned and in particular the internal control functions, and before the means mentioned in the previous paragraph are available.

CIRCULAR CSSF 26/906 46/50 200.The internal control functions may require that a change in activities shall be deemed to be material and thus be subject to the approval process. Chapter 8. Safeguarding requirements of funds Sub-chapter 8.1. General requirements 201.In accordance with the requirements of Articles 14 and 24-10 of the LPS and in line with the guiding principles on the safeguarding of funds approved by the supervisory body, the institution is required to put in place mechanisms ensuring at all times the safeguarding of all funds received from payment service users or through another payment service provider for the execution of payment transactions and/or in exchange for electronic money issued. This means that the institution must always be able to identify all the funds of payment service users in a clear and precise manner. The institution must pay particular attention to the aspects of continuity of fund protection arrangements and ensure an appropriate response capability in the event of revocation of contracts by the counterparties used in the context of fund safeguarding mechanisms. 202.Institutions shall establish adequate and efficient internal control mechanisms and a general monitoring framework that provides appropriate information to the management and supervisory bodies. These internal control mechanisms shall include, in particular, processes for controlling executed transactions, as well as processes for reconciling funds received from payment service users or through another payment service provider for the execution of payment and electronic money transactions, with information from the counterparties with whom the funds are protected (i.e. credit institutions, insurance companies, etc.). These processes shall be governed by clear procedures which define who is responsible for these processes, the various parties involved, and the formal escalation and validation procedures associated to these processes. Without prejudice to section 4.2.3. of this circular, institutions shall appoint a member of the management body to be responsible for the oversight and monitoring of the internal control processes ensuring compliance with the safeguarding of funds requirements. These internal control mechanisms must enable the identification, at any time and without delay, of funds which are not protected in one of the ways provided for in Articles 14 and 24-10 of the LPS. They are deployed taking into account the organisation of the institution and the nature, scale, volume and complexity of the activities and risks of the institution. 203.In view of the volume and/or complexity of the payment or electronic money transactions carried out by the institution, the internal control mechanisms referred to in paragraph 202 of this circular must be based on the implementation of daily controls and reconciliations. The implementation of weekly reconciliations may, where appropriate, be considered on the basis of a justified and documented risk analysis validated by the management and supervisory bodies. The management and supervisory bodies shall ensure that appropriate and sufficient resources are allocated to these controls and reconciliations, which are subject to review and/or validation in accordance with the 4-eyes principle. It is also recommended that institutions deploy IT-based control and reconciliation tools. The use of manual control processes is to be considered on an exceptional basis.

CIRCULAR CSSF 26/906 47/50 204.Without prejudice to the requirements set out in section 5.3.1. of this circular, access to accounting entries, as well as to extra-accounting systems and signature powers enabling the movement of payment service users' funds, is strictly limited according to the "need-to-know and least privilege" principles and systematically subject to the 4-eyes principle, under the formal responsibility of at least one member of the management body. 205.With reference to the principle of proportionality set out in paragraph 3 of this circular, certain institutions shall set up a counterparty risk management framework with reference to the opening of segregation accounts with credit institutions and/or with reference to the use of counterparties within the context of the establishment of comparable insurance and/or guarantee mechanisms. Regular analysis (due diligence) and monitoring of the quality of the credit institution(s), insurer(s) or other counterparty(ies) used by the institution to protect funds is considered good, sound and prudent management practice. Sub-chapter 8.2. Safeguarding of funds through the use of so￾called "segregation accounts" (cf. Articles 14(1)(a) and 24- 10(1)(a) of the LPS) 206.Segregation accounts are opened in the name of the institution solely for the benefit of payment service users. Contracts referring to these accounts clearly state the name and address of the credit institution with which the segregation accounts are opened, the nature of these accounts and the ownership of the funds deposited in them. Where the institution invests these funds in low-risk, liquid and secure assets, such provisions apply mutatis mutandis, i.e. the assets are deposited in a separate custodian account opened in the name of the institution for the sole benefit of payment service users. 207.The institution shall ensure that none of the contractual clauses, whether in the general or specific conditions, can call into question the requirements as defined in Articles 14 and 24-10 of the LPS. In this respect, and in the event that the credit institution does not provide a specific "segregation" contract, the institution must ensure that it obtains all necessary and sufficiently explicit written and signed confirmations from the latter in order to ensure that the level of protection of deposited funds complies with the LPS. The institution must assess and be able to demonstrate the compliance of all its segregation accounts and related contracts with the LPS. 208. Access to funds and/or assets placed in the context of safeguarding of funds shall be limited to those persons whose function requires it and shall be limited to what is strictly necessary to enable them to carry out their duties. Such access shall be strictly controlled, formalised and regularly reviewed by the institution and communicated to the management body. It is expected that any manual and/or significant operation enabling the movement of funds and/or assets placed in the context of safeguarding of funds can only be carried out according to the 4-eyes principle and under the strict prior validation of at least one member of the management body.

CIRCULAR CSSF 26/906 48/50 209.In the case of the use of agents, distributors or branches, the institution assumes full responsibility for the safeguarding of funds and must at all times monitor the procedures applied by these agents or distributors or branches, and in particular ensure that funds are properly safeguarded and within the prescribed timeframes. 210.In accordance with the requirements of Articles 14 and 24-10 of the LPS, funds received must not at any time be co-mingled with the funds of persons other than the payment service users on whose behalf the funds are held. This requirement applies in particular to funds held in connection with other activities, as well as to applicable fees and commissions linked to payment and electronic money services. Consequently, it is the responsibility of the institution to deploy appropriate organisational and operational processes to comply with these requirements. These processes are to be reviewed and adapted as new products are rolled out, with reference to the requirements of sub-chapter 7.3 of this circular. 211.It is recommended that institutions review potential conflicts of interest arising from an internal policy, from the institution or its group, of systematic concentration of segregation accounts with the same credit institutions, as well as in the context of investment of funds in low-risk and secure assets issued or distributed by the same financial group. 212. For the purposes of these safeguarding requirements, institutions which have taken the decision to safeguard funds by investing them in low-risk, liquid and secure assets shall notably consider at least the following criteria in determining which assets can be used: • debt securities issued or guaranteed by central administrations, central banks, international organisations, multilateral development banks or regional or local authorities of Member States; • parts of UCITS investing exclusively in these debt securities on condition that the credit risk assessment is continuous, that the rating of these assets is high and that the funds invested are not subject to undue market risk. 213.The institution that intends to safeguard the funds of payment service users and invest them in low-risk, liquid and safe assets shall establish the minimum quality criteria that the assets must meet with reference to paragraph 212 in accordance with the guiding principles for safeguarding funds approved by the supervisory body with reference to paragraph 13 of this circular. The institution shall also implement a risk management policy for the investment of funds in these low-risk, liquid and secure assets, and ensure adequate monitoring of the price volatility of these assets in order to guarantee at all times both the safeguarding of payment service users' funds and the necessary liquidity for the execution of payment and electronic money services. 214.It is recommended that institutions hold payment service users' funds in segregated account deposits and/or invested in low-risk, liquid and secure assets in the currency of the payment service users' funds, in order to minimise the exposure of segregated assets to foreign exchange risk. If this is not the case, the institution must put in place additional foreign exchange risk protection mechanisms to limit the exposure of segregated assets to this risk.

CIRCULAR CSSF 26/906 49/50 Sub-chapter 8.3. Safeguarding of funds through insurance or another type of guarantee (cf. Articles 14(1)(b) and 24- 10(1)(b) of the LPS) 215.The amount of the guarantee provided by the insurance or comparable guarantee shall be reviewed regularly, taking into account, where appropriate, any contractual negotiation deadlines. The institution’s management body must effectively ensure that the covered amount is sufficient at all times to protect all funds held on behalf of payment service users or through another payment service provider. 216.Particular attention must be paid to the definitions of the beneficiaries of the insurance or guarantee, to the events likely to trigger the payment of indemnities by the insurance company or the company offering the comparable guarantee, to the deadlines relating to these payments, and to the existence of an account with a credit institution dedicated to the payment of such indemnities in the event of execution of the insurance or guarantee. It is therefore reminded that the proceeds of the guarantee/insurance must be payable into a dedicated and separate account opened with a credit institution in the name of the institution for the benefit of payment service users. This account, under the institution’s strict control, shall be clearly defined and documented within the documentation related to the present insurance or comparable guarantee. 217. All contractual provisions and any conditions applicable to the guarantee or insurance contract must be examined by a legal expert. This assessment shall be considered by the management body who shall ensure any restrictive or nullifying clauses that could reduce the amount of protection or guarantee will be eliminated. The institution must assess, document and be able to demonstrate the compliance of all contractual arrangements with the LPS. Chapter 9. Legal reporting 218.In addition to the provisions of Circular CSSF 15/614 "Documents to be submitted to the CSSF after the closure of the financial year", the following reports and attestations are submitted annually to the CSSF with reference to this circular: (a) The annual assessment of the information and communication technology (ICT) and security risks in accordance with Article 105-1 (2) of the LPS and the requirements of the amended Circular CSSF 25/880 regarding relationship management of payment service users and PSP ICT assessment. (b) The annual attestation of compliance with the requirements of this circular issued and signed by all members of the management body with reference to paragraph 71 of this circular. This information must be submitted to the CSSF as soon as possible, and at the latest by the last day of the third month following the institution's financial year-end. (c) Summary reports from the compliance and internal audit functions, drawn up in accordance with paragraph 129 of this circular and signed by the Chief Compliance Officer and the Chief Internal Auditor respectively. This information must be submitted to the CSSF as soon as possible, and at the latest by the last day of the third month following the institution's financial year-end. The information in question must be drawn up in French, German or English.

CIRCULAR CSSF 26/906 50/50 Part III. Entry into force 219.This circular shall apply as of 30 June 2026. Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General