CSSF Circular 21/768: Updates to Statutory Auditor Rules for Investment Firms and EU Branches in Luxembourg

CIRCULAR CSSF 21/768 1/21 Circular CSSF 21/768 UPDATE OF CIRCULAR CSSF 03/113 (AS AMENDED BY CIRCULAR CSSF 10/486) ON THE PRACTICAL RULES CONCERNING THE ROLE OF RÉVISEURS D’ENTREPRISES (STATUTORY AUDITORS) IN INVESTMENT FIRMS AND COMMUNICATION RELATING TO CIRCULAR CSSF 07/325 (AS AMENDED BY CIRCULAR CSSF 21/765) ON THE PROVISIONS RELATING TO CREDIT INSTITUTIONS AND INVESTMENT FIRMS OF EU ORIGIN ESTABLISHED IN LUXEMBOURG BY WAY OF BRANCHES OR EXERCISING ACTIVITIES IN LUXEMBOURG BY WAY OF FREE PROVISION OF SERVICES FOLLOWING THE AMENDMENTS MADE TO CSSF REGULATION NO 12-02

CIRCULAR CSSF 21/768 2/21 Circular CSSF 21/768 Re: Update of Circular CSSF 03/113 (as amended by Circular CSSF 10/486) on the practical rules concerning the role of réviseurs d’entreprises agréés (approved statutory auditors) in investment firms and communication relating to Circular CSSF 07/325 (as amended by Circular CSSF 21/765) on the provisions relating to credit institutions and investment firms of EU origin established in Luxembourg by way of branches or exercising activities in Luxembourg by way of free provision of services following the amendments made to CSSF Regulation No 12-02 Ladies and Gentlemen,

1. The purpose of this circular is to update the content of Part 8 on the professional obligations as regards the prevention of money laundering and terrorist financing of the long form audit report, as defined in Circular CSSF 03/113 on the practical rules concerning the role of réviseurs d’entreprises agréés (approved statutory auditors) of investment firms, in order to take into consideration the amendments to Articles 49(2) and 49(3) of CSSF Regulation No 12-02 on the fight against money laundering and terrorist financing, as amended. It should be stressed that this update of Circular CSSF 03/113 only concerns AML/CFT elements and that the remaining part of Circular CSSF 03/113 will be fundamentally revised.
2. As from the financial year ending on 31 December 2020, this circular shall define Part 8 of the long form audit report as follows (cf. Annex 1 for details on the amendments to Circular CSSF 03/113): “The long form report shall describe the procedures set up by the investment firm in the context of the prevention of money laundering and terrorist financing as required for compliance with or as defined in: Chapter 5 of Part II of the Law on the financial sector, the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended, Grand￾ducal Regulation of 1 February 2010 providing details on certain provisions of the amended Law of 12 November 2004 on the fight against money laundering and terrorist financing (hereinafter the “Grand-ducal Regulation”), Regulation (EU) 2015/847 of the European Parliament and of the Council of 20 May 2015 on information accompanying transfers of funds, international acts on the fight against terrorist financing brought to the attention of the professionals through CSSF circulars, CSSF regulations on the fight against money laundering and terrorist financing and CSSF circulars in these matters. The long form report shall provide, in particular: • the description of the AML/CFT policy implemented by the professional in order to prevent money laundering and terrorist financing, the verification of its compliance with the provisions of Chapter 5 of Part II of the Law of 5 April 1993 on the financial sector, as amended, the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended, the Grand-ducal Regulation, Regulation (EU) 2015/847, CSSF regulations and CSSF circulars relating to AML/CFT and the control of their sound application; • the evaluation of the professional's assessment of money laundering and terrorist financing risks to which it is exposed. The réviseur d'entreprises agréé shall verify if the implemented procedures, infrastructures and Luxembourg, 12 March 2021 To all investment firms In case of discrepancies between the French and the English texts, the French text shall prevail.

CIRCULAR CSSF 21/768 3/21 controls, as well as the scope of the AML/CFT measures taken are appropriate considering the money laundering and terrorist financing risks to which the professional is exposed, in particular through its activities, the nature of its customers and the provided products and services; • a declaration whether an audit of compliance with the professional's AML/CFT policy is performed on a regular basis by the internal audit function and by the compliance officer in charge of the control of compliance with the professional obligations as defined in Article 1(1) of CSSF Regulation 12-02 of 14 December 2012; • the verification of the training and awareness-raising measures for employees as regards money laundering and terrorist financing, and, in particular, with respect to the identification of money laundering and terrorist financing transactions; • historical statistics concerning suspicious transactions that have been detected, which inform on the number of suspicious transaction reports filed with the FIU by the professional, as well as the total amount of funds involved; • the control of the application by the professional, in its respective role, of the provisions of Regulation (EU) 2015/847 and the percentage of fund transfers for which data on the payer or payee were missing or incomplete and the measures taken in this context by the professional. The réviseur d'entreprises agréé shall verify notably if the investment firm complies with its obligations on customer and beneficial owner identification. The réviseur d'entreprises agréé shall state how the sample of reviewed files was selected, as well as the coverage ratio of the population (number of files reviewed/total number of customers; volume of selected customer assets/total volume of customer assets). Where the réviseur d'entreprises agréé identifies cases of non-compliance with the legal or regulatory provisions or deficiencies, the réviseur d'entreprises agréé shall give detailed indications enabling the CSSF to appraise the situation (number of pending incomplete files as a percentage of the total number of reviewed files, details of the identified deficiencies, etc.). (also refer to Chapter V. “Reporting to the CSSF by virtue of Article 54(3) of the Law on the financial sector” below).” Note: It should be noted that the réviseurs d'entreprises agréés shall also inform the CSSF of all denunciations made under Article 5 of the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended, and which concern a professional of the financial sector under the supervision of the CSSF. Similarly, the réviseur d’entreprises agréé shall inform the CSSF in case s/he deems that the professional should have made a denunciation but has not. Where applicable, the above-mentioned long form report shall encompass the professional's branches and majority-owned subsidiaries abroad. It shall cover, in particular, the branches' and majority-owned subsidiaries' compliance with the applicable provisions as regards the prevention of money laundering and terrorist financing and it shall include, in that respect:

CIRCULAR CSSF 21/768 4/21 • an analysis of money laundering and terrorist financing risks incurred by the branches and majority-owned subsidiaries. This point shall be covered in point 10 “Branches”, either in Part IV “Consolidated long form audit report” or in this section, respectively; • a description and assessment of the money laundering and terrorist financing risk management in the branches and majority-owned subsidiaries. This point shall be covered in point 10 “Branches”, either in Part IV “Consolidated long form audit report” or in this section, respectively; • the verification of the implementation of and compliance with the professional's AML/CFT policy in the branches or majority-owned subsidiaries. This point shall be covered in point 10 “Branches”, either in Part IV “Consolidated long form audit report” or in this section, respectively.” 3. Finally, the CSSF would also like to raise the attention of all investment firms and Luxembourg branches of investment firms established in another Member State to the paragraph below that has been added in point 29 of Circular CSSF 07/325 in accordance with the amendments to CSSF Regulation No 12-02 and the publication of Circular CSSF 21/765 (cf. Annex 2 of Circular CSSF 21/765 for details on the amendments made to Circular CSSF 07/325): “For the purpose of drawing up its report, the réviseur d’entreprises agréé (approved statutory auditor) shall apply mutatis mutandis the provisions applicable to the establishment of the annual long form audit report to comply with the professional obligations as regards the fight against money laundering and terrorist financing and the conduct of business rules when providing investment services. The report of the réviseur d'entreprises agréé includes a description of the procedures and controls in place within the branch as well as an assessment by the réviseur d'entreprises agréé. The descriptive parts of the reports shall be made available to the réviseur d'entreprises agréé by the branches.” Yours faithfully, Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General Annex 1: Circular CSSF 03/113, as amended by Circulars CSSF 10/486 and CSSF 21/768

CIRCULAR CSSF 21/768 5/21 Annex 1 - Circular CSSF 03/113, as amended by Circulars CSSF 10/486 and CSSF 21/768 Re: Practical rules concerning the role of the réviseurs d’entreprises agréés (approved statutory auditors) in investment firms Ladies and Gentlemen, The purpose of this circular is to lay down the rules regarding the scope of the audit mandate and regarding the content of the audit report on annual accounting documents to be prepared pursuant to Article 54(1) of the Law of 5 April 1993 on the financial sector, as amended (“Law on the financial sector”). This circular defines more generally the role and obligations of the réviseurs d’entreprises agréés (approved statutory auditors) in relation to the statutory audit of the annual accounts and more specifically the subjects to be analysed in the long form audit report, considering that the latter is an important source of information for the company’s management body, in its managing role, as well as for the Commission de Surveillance du Secteur Financier (“CSSF”) in its supervisory mission. Furthermore, this circular takes account of the expansion of the statutory duty of the réviseurs d’entreprises agréés laid down in the Law of 29 April 1999 transposing Directive 95/26/EC (called the “post-BCCI Directive”), which requires réviseurs d’entreprises agréés to report to the supervisory authority the situations that require particular intervention and follow-up and lays the foundations for a new relationship between the réviseurs d’entreprises agréés and the CSSF. The provisions of this circular are applicable to investment firms and to branches of non-EU investment firms. Insofar as the branches concerned are in principle exempt from publishing annual accounts on their own activities, the term “annual accounts”, as regards branches, is to be understood as the final annual accounting information drawn up according to the Luxembourg statutory format for annual accounts. This circular is in line with the globalisation of financial activities and the growth of investment firms at international level, as well as with the increasing importance of investment firms compared to other intervening parties of the financial sector. Luxembourg, 21 October 2003 To all investment firms and branches of non-EU investment firms

CIRCULAR CSSF 21/768 6/21 Contents I. Mandate II. Report on annual accounts/consolidated accounts III. Annual long form audit report A. General principles B. Format of the long form report C. Comments relating to the long form report IV. Consolidated long form audit report V. Reporting to the CSSF by virtue of Article 54(3) of the Law on the financial sector VI. Final provisions

CIRCULAR CSSF 21/768 7/21 I. Mandate Investment firms shall give a written and detailed mandate to their réviseur d'entreprises agréé, containing at least the following provisions:

1. The audit of annual accounts shall be carried out according to the recommendations issued by the Luxembourg Institut des Réviseurs d’Entreprises (“IRE”). The IRE notably provides for the application of the International Standards on Auditing (“ISAs”) published by the IFAC (International Federation of Accountants), adapted to or supplementing, if necessary, legislation or national practice. The audit shall cover all the areas specified under point 2. hereunder, through the application, where applicable, of the principles of the ISAE (International Standard on Assurance Engagements) of the IFAC.
2. The audit shall cover all the business areas of the investment firm, be they recorded on the balance sheet or as off-balance sheet items. The mandate given to the réviseur d'entreprises agréé cannot exclude a type of activity, a category of transaction or a specific transaction from the scope of the audit. Furthermore, the audit shall cover all the risks inherent in the activities of the investment firm, as well as all financial, organisational and internal control-related aspects.
3. The mandate for the annual audit shall expressly contain the following duties: “• verify compliance with Chapter 5 of Part II of the Law on the financial sector, the Law of 12 November 2004 on the fight against money laundering and terrorist financing, Grand-ducal Regulation of 1 February 2010 providing details on certain provisions of the amended Law of 12 November 2004 on the fight against money laundering and terrorist financing, Regulation (EUC) 17812015/8472006 of the European Parliament and of the Council of 15 November 200620 May 2015 on information accompanying transfers of funds, international acts on the fight against terrorist financing brought to the attention of the institutions through CSSF circulars, CSSF regulations on the fight against money laundering and terrorist financing, CSSF circulars in these matters, as well as the proper application of internal procedures as regards the prevention of money laundering and terrorist financing”1; • verify compliance with Articles 36 and 36-1 of the Law on the financial sector concerning the prudential rules of the financial sector and notably the principles laid down in Circular IML 91/78 as regards the segregation of assets, as well as the proper application of internal procedures in force in this field; • verify compliance with Article 37 of the Law on the financial sector and the principles laid down in Circular CSSF 2000/15 on the rules of conduct in the financial sector, as well as the proper application of internal procedures for the implementation of the rules of conduct; • verify compliance with all the other circulars governing investment firms as referred to in this circular; “• appraise the investment firm's analysis of the money laundering or terrorist financing risk it faces and verify if the procedures, infrastructures and controls as regards the fight against money laundering and terrorist financing set up by 1 Circular CSSF 10/486

CIRCULAR CSSF 21/768 8/21 the investment firm, as well as the extent of the measures taken by it, are appropriate considering the money laundering and terrorist financing risks to which the investment firm is or might be exposed notably through its activities, the nature of its customers and the products and services offered.”2 4. The mandate for the annual audit of the investment firm shall cover all its branches abroad. As far as compliance with Luxembourg standards concerning “money laundering and terrorist financing”3 and rules of conduct is concerned, the mandate shall also cover all the subsidiaries of the investment firm established abroad. Investment firms are requested to submit to the CSSF a copy of the mandate given to their réviseur d'entreprises agréé for the audit of annual accounts, and, where applicable, of consolidated accounts. Investment firms shall also notify the CSSF of any change to this mandate or of any renewal under other terms as those initially communicated to the CSSF. 5. The audit of annual accounts as defined above shall be documented, on the one hand, in a report on annual accounts (cf. Chapter II. hereunder) and, on the other hand, in an annual long form audit report (cf. Chapter III. hereunder). 6. Where the investment firm is subject to supervision on a consolidated basis by the CSSF, a consolidated annual long form audit report, based on the consolidated financial situation, shall also be established. In general, investment firms shall immediately inform the CSSF if their réviseur d'entreprises agréé terminates his/her mandate before expiry of the term or if s/he decides not to renew his/her mandate. Investment firms shall also notify the CSSF of their duly justified intention to terminate the mandate of their réviseur d'entreprises agréé or not to renew it. The CSSF will analyse, for each request to change the réviseur d'entreprises agréé, the reasons for the envisaged change and will assess whether, when selecting a new réviseur d'entreprises agréé, the investment firm has carefully assessed the adequacy of the competence and resources of the new réviseur d'entreprises agréé considering the type and volume of the investment firm’s activities. II. Report on annual accounts/consolidated accounts The report on (consolidated) annual accounts shall contain the réviseur d’entreprises agréé’s report (or short form report, attestation du réviseur d’entreprises agréé, Bestätigungsvermerk); it is subject to statutory publication together with the (consolidated) annual accounts and the (consolidated) management report it covers, pursuant to Article 55(2) of the Law on the financial sector and Article 252(1) (Article 341) of the Law of 10 August 1915 on commercial companies, as amended (“Law on commercial companies”). 2 Circular CSSF 10/486 3 Circular CSSF 10/486

CIRCULAR CSSF 21/768 9/21 In the report on (consolidated) annual accounts, the réviseur d'entreprises agréé shall certify the accounts according to ISA 7004 as adopted by the IRE. The report on (consolidated) annual accounts shall be accompanied by the (consolidated) annual accounts and the (consolidated) management report. Pursuant to Article 205 (Article 319) of the Law on commercial companies, the (consolidated) annual accounts shall contain the (consolidated) balance sheet, the (consolidated) profit and loss account as well as the annex; these documents shall be considered as a whole. The (consolidated) management report is defined under Article 251 (Article 339) of the aforementioned law. Where a réviseur d’entreprises agréé notifies the investment firm that s/he will give a qualified certificate or refuse to certify the accounts, the investment firm concerned shall immediately inform the CSSF thereon (cf. also Chapter V. Reporting to the CSSF by virtue of Article 54(3) of the Law on the financial sector). III. Annual long form audit report III. A. General principles The long form report (compte rendu analytique, Prüfungsbericht) aims at describing and analysing the observations concerning financial and organisational aspects that the réviseur d'entreprises agréé made during the course of his/her audit. The long form audit report is not intended for the public. It is issued for the exclusive use of the managing and administrative bodies of the investment firm concerned, as well as of the CSSF. “The long form audit report shall be concise, clear and critical, setting out, for each point listed in the format below, the main observations made, allowing a precise and justified appraisal of the organisation, the internal control system, the financial situation and the risks incurred by the audited investment firm, including those with respect to money laundering and terrorist financing.”5 The réviseur d'entreprises agréé shall communicate in detail the weaknesses and points needing improvement that s/he observed during the course of his/her audit. This communication may be made in the context of the long form report or through a management letter addressed to the management of the investment firm. The observations of the réviseur d'entreprises agréé shall be accompanied by comments of the management of the investment firm. Where a management letter has been issued, it shall be annexed to the long form report. The réviseur d'entreprises agréé shall explicitly state if s/he does not issue a management letter. Pursuant to Article 54(1) of the Law on the financial sector, investment firms shall also spontaneously communicate to the CSSF, on their own initiative, all other 4 International Standard on Auditing no 700: The auditor’s report on financial statements 5 Circular CSSF 10/486

CIRCULAR CSSF 21/768 10/21 documents issued by the réviseur d’entreprises agréé in the context of his/her annual audit. The annual long form audit report shall be submitted to the CSSF, at the latest, one month following the ordinary general meeting of the investment firm. The investment firms, subject to consolidated supervision by the CSSF, shall submit the consolidated long form audit report and the long form audit reports of their subsidiaries, included in the consolidated supervision, at the latest three months following their ordinary general meeting. III. B. Format of the long form report The long form report shall be drawn up according to the format below. This format corresponds to the minimum information that shall be detailed by the réviseur d'entreprises agréé in his/her report. It may be adapted to the nature and complexity of the activities, as well as to the structure of the audited firm. Where applicable, the réviseur d'entreprises agréé shall supplement the format by items s/he deems appropriate. Where a specific item of the format does not apply to the audited investment firm, the réviseur d’entreprises agréé shall explicitly state it under the item concerned.

1. Mandate
2. Significant events
3. Organisation and administration 3.1 Description of the shareholding 3.2 Executive and management bodies 3.3 Organisation chart of the company 3.4 Administrative and accounting organisation 3.5 IT system 3.6 Internal control
4. Activities and analysis of inherent risks
5. Periodic reports to be submitted to the CSSF
6. Prudential ratios
7. Analysis of annual accounts
8. Professional obligations as regards “the prevention of money laundering and terrorist financing”6
9. Professional obligations as regards the rules of conduct
10. Branches
11. Relations with affiliated undertakings
12. Follow-up on issues raised in previous reports
13. General conclusion 6 Circular CSSF 10/486

CIRCULAR CSSF 21/768 11/21 III. C. Comments relating to the long form report

1. Mandate The réviseur d’entreprises agréé shall provide a summary description of his/her annual audit mandate. The réviseur d’entreprises agréé shall also indicate all other services that s/he, his/her firm or group have provided to the audited investment firm.
2. Significant events The long form report shall state, where appropriate, the significant events which took place during the year under review. These events are, for example: strategic decisions taken by the Board of Directors and the executive committee, the beginning or the end of important reorganisations, the launch or discontinuation of an activity, the conclusion of extraordinary transactions or negotiations with other institutions or groups as regards mergers/acquisitions or cooperation. Where no significant events have taken place during the year under review, the réviseur d’entreprises agréé shall specifically mention this fact.
3. Organisation and administration The long form report shall provide an overview of the operational and decision-making structure of the investment firm; it shall notably allow assessing compliance with the provisions laid down in Circulars IML 95/120 on the central administration and IML 96/126 on the administrative and accounting organisation. 3.1 Description of the shareholding The réviseur d'entreprises agréé shall provide a description of the direct shareholders of the investment firm, as well as of the group to which it belongs; this structure shall be presented in the form of an organisation chart. 3.2 Executive and management bodies The powers of the executive bodies shall be described by specifying in particular whether the members of the management, approved by the CSSF pursuant to Article 19(2) of the Law on the financial sector (“four eyes”), have equal powers and whether they are given their powers directly by the Board of Directors. 3.3 Organisation chart of the company The organisation chart of the investment firm shall differentiate between the management and the different departments and committees, indicating the corresponding number of staff, and show the corresponding reporting and functional lines by indicating also the general and particular delegations of power. The organisation chart shall be submitted in the form of a chart including, if necessary, supporting comments. 3.4 Administrative and accounting organisation The réviseur d'entreprises agréé shall provide a summary description of the administrative and accounting organisation, as well as an assessment of its adequacy in view of the investment firm’s type and volume of activities.

CIRCULAR CSSF 21/768 12/21 The réviseur d’entreprises agréé shall notably indicate if human and technical resources available to the firm are sufficient to ensure proper performance of its activities. In this context, the réviseur d’entreprises agréé shall assess whether the investment firm complies with the principle of segregation of duties considering the size of the audited firm. The réviseur d'entreprises agréé shall make a statement on the adequacy of the procedures set up within the investment firm and on compliance with these procedures. If the institution has branches and/or subsidiaries, the long form report shall also describe and assess the integration of branches or subsidiaries in the organisational, functional and decision-making structure of the investment firm. 3.5 IT system As far as the IT system is concerned, the réviseur d'entreprises agréé shall briefly describe the software used. The réviseur d'entreprises agréé shall make a statement concerning the adequacy of the IT system in relation to the volume and type of activities of the investment firm. The réviseur d’entreprises agréé shall verify if appropriate measures have been taken to safeguard confidentiality of the processed data. Moreover, s/he shall outline the contingency plan allowing the firm to operate properly in case of a breakdown of its IT system. The long form report shall describe, where appropriate, the Internet website of the firm and specify its nature (informative, consultative or transactional website). Where the institution outsources the processing of its IT system, the long form report shall assess whether the transfer of the activities concerned are in conformity with the provisions referred to under points 4.5.2.1 and 4.5.2.2 of Circular IML 96/126. 3.6 Internal control “The long form report shall describe the organisation of the internal control system and of the internal audit function and assess its adequacy in view of the investment firm's type and volume of activities and the real and potential money laundering and terrorist financing risks to which it is exposed.”7 The réviseur d’entreprises agréé shall notably express his opinion on the implementation of the recommendations of the internal auditor. As regards investment firms that hold branches abroad, the réviseur d’entreprises agréé shall verify their integration into the audit plan. 4. Activities and analysis of inherent risks The long form report shall describe in detail the type and volume of activities carried out by the investment firm. It shall specifically mention if there has been a change in the structure of the activities, discontinuation of an activity or launch of a new activity during the financial year under review. The long form audit report shall specify whether the investment firm has set up an adequate risk control system and whether this system covers at least the risks associated with the investment firm’s activities, such as notably:

• credit risk/counterparty risk 7 Circular CSSF 10/486

CIRCULAR CSSF 21/768 13/21

• market risk
• legal risk
• operational risk
• risk incurred on derivative instruments
• profitability risk
• reputational risk. “The long form report shall describe and assess how the institution controls and manages its legal and reputational risk, including with respect to money laundering and terrorist financing”.8 Thus, the long form report shall state if the organisation of the investment firm allows an adequate follow-up of contracts and delegated powers, notably for managers within the scope of their relations with the customers, but also within the scope of processed transactions on behalf of members of the personnel and the management of the firms concerned. The réviseur d'entreprises agréé shall also issue an opinion on the appropriateness of hold mail procedures, the existence and control of compliance with written mandates in case of discretionary private portfolio management and the control of management performances. In case of relations with business providers, the selection and acceptance procedure for these business providers shall be described and assessed. The long form report shall also describe and assess the customer information system, including notably the mailing of account statements. In general, the réviseur d'entreprises agréé shall verify compliance with the principle of segregation of assets; in this context, the long form report shall mention whether the investment firm deposits its customers’ assets on omnibus accounts. The réviseur d'entreprises agréé shall also indicate the geographic origin of the investment firm’s depositary banks. Furthermore, the réviseur d'entreprises agréé shall verify compliance of the investment firm with the principle of monthly reconciliation of customer accounts opened with the depositary banks and its own accounting. Finally, the long form report shall state whether there are any conflicts of interest likely to harm the customers’ interests.

5. Periodic reports to be submitted to the CSSF The long form report shall assess the measures set up to ensure that data communicated to the CSSF in the context of periodic prudential reports are complete, correct and established according to the applicable rules. The réviseur d'entreprises agréé shall carry out sampling tests, the methodology of which s/he shall describe and the results of which s/he shall comment. Where applicable, information shall be provided on the integration of the branches’ data into the reporting. 8 Circular CSSF 10/486

CIRCULAR CSSF 21/768 14/21 6. Prudential ratios The long form report shall provide a description and assessment of the calculation of the capital ratio and compliance of large exposure limits according to Circular CSSF 2000/12. 7. Analysis of annual accounts The long form report shall analyse annual accounts, which shall include specific comments on important items and significant developments of the financial situation. The long form report shall also state items, of which the réviseur d'entreprises agréé becomes aware after the closure and which may influence the assessment of the economic and financial situation of the investment firm. As regards the activity of private portfolio management in particular, the réviseur d'entreprises agréé shall collect statistics on the rotation of the customers’ portfolios in order to detect the presence of any transactions concluded for churning purposes. When carrying on his/her duties, the réviseur d'entreprises agréé shall pay particular attention to the commissions received by the investment firms. Where applicable, the réviseur d’entreprises agréé shall describe the nature and volume of the retrocessions received or paid, respectively, by the investment firm, of which s/he is aware, notably in the framework of its relations with business providers. In case of irregularities or shortcomings, the réviseur d'entreprises agréé shall give precise indications allowing the CSSF to appraise the situation. “8. Professional obligations as regards the prevention of money laundering and terrorist financing The long form report shall describe the procedures set up by the investment firm in the context of the prevention of money laundering and terrorist financing as required for compliance with or as defined in: Chapter 5 of Part II of the Law on the financial sector, the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended, Grand-ducal Regulation of 1 February 2010 providing details on certain provisions of the amended Law of 12 November 2004 on the fight against money laundering and terrorist financing (hereinafter the “Grand-ducal Regulation”), Regulation (EUC) 17812015/8472006 of the European Parliament and of the Council of 15 November 200620 May 2015 on information accompanying transfers of funds, international acts on the fight against terrorist financing brought to the attention of the professionals through CSSF circulars, CSSF regulations on the fight against money laundering and terrorist financing and CSSF circulars in these matters. The long form report shall provide, in particular: • the description of the AML/CFT policy implemented by the professional in order to prevent money laundering and terrorist financing, the verification of its compliance with the provisions of Chapter 5 of Part II of the Law of 5 April 1993 on the financial sector, as amended, the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended, the Grand-ducal Regulation, Regulation (EU) 2015/847, CSSF regulations and CSSF circulars

CIRCULAR CSSF 21/768 15/21 relating to AML/CFT and the control of their sound applicationa description of the customer acceptance policy; • the evaluation of the professional's assessment of money laundering and terrorist financing risks to which it is exposed. The réviseur d'entreprises agréé shall verify if the implemented procedures, infrastructures and controls, as well as the scope of the AML/CFT measures taken are appropriate considering the money laundering and terrorist financing risks to which the professional is exposed, in particularly through its activities, the nature of its customers and the provided products and servicesan assessment of the appropriateness of the investment firm's internal procedures concerning the prevention of money laundering and terrorist financing, as well as their compliance with the provisions of Chapter 5 of Part II of the Law on the financial sector, the Law of 12 November 2004 on the fight against money laundering and terrorist financing, Grand-ducal Regulation of 1 February 2010 providing details on certain provisions of the amended Law of 12 November 2004 on the fight against money laundering and terrorist financing, Regulation (EC) 1781/2006 of the European Parliament and of the Council of 15 November 2006 on information on the payer accompanying transfers of funds, international acts on the fight against terrorist financing brought to the attention of the institutions through CSSF circulars, CSSF regulations on the fight against money laundering and terrorist financing, CSSF circulars in these matters. The réviseur d’entreprises agréé shall also review the proper implementation of the procedures concerned. Moreover, the outcome of these controls shall be presented in the annexe in the schedule “Measures to combat money laundering and terrorist financing and on the prevention of the use of the financial sector for the purposes of money laundering and terrorist financing” of IRE. This IRE schedule, which shall be filled in with the comments “yes”, “no” and “n/a” (non applicable), shall be completed, where applicable, by figures or supplementary explanations. The réviseur d’entreprises agréé may also refer to the outcome of these controls in other sections of the long form report; • a declaration whether an audit of compliance with the professional's AML/CFT policy is performed on a regular basis by existence of a regular control of compliance with procedures by the internal audit functiondepartment and by the compliance officer in charge of the control of compliance with the professional obligations, as defined in Article 1(1) of CSSF Regulation 12-02 of 14 December 2012; • the verification of the training and awareness-raising information measures for employees as regards money laundering and terrorist financing, and, in particular, with respect to the identification of money laundering and terrorist financing transactions; • historical statistics concerning suspicious transactions that have been detected, which inform on the number of suspicious transaction cases reported to reports filedthe State prosecutor (Financial Intelligence Unit) by the investment firm with the FIU by the professional, as well as the total amount of funds involved; • the control of the application by the professional, in its respective role, of the provisions of Regulation (EU) 2015/847 and the percentage of fund transfers for

CIRCULAR CSSF 21/768 16/21 which data on the payer or payee were missing or incomplete and the measures taken in this context by the professionalassessment of the investment firms' analysis of money laundering and terrorist financing risks to which it is exposed. The réviseur d’entreprises agréé shall verify if the procedures, infrastructures and controls with respect to combating money laundering and terrorist financing set up by the investment firm, as well as the extent of the measures taken by it, are appropriate considering the money laundering and terrorist financing risk to which the investment firm is or might be exposed notably through its activities, the nature of its customer and the products and services offered. The réviseur d'entreprises agréé shall verify notably if the investment firm complies with its obligations on customer and beneficial owner identification. The réviseur d'entreprises agréé shall state how the sample of reviewed files was selected, as well as the coverage ratio of the population (number of files reviewed/total number of customers; volume of selected customer assets/total volume of customer assets). Where the réviseur d'entreprises agréé identifies cases of non-compliance with the legal or regulatory provisions or deficiencies, the réviseur d'entreprises agréé shall give detailed indications enabling the CSSF to appraise the situation (number of pending incomplete files as a percentage of the total number of reviewed files, details of the deficiencies identified, etc.). (also refer to Chapter V. “Reporting to the CSSF by virtue of Article 54(3) of the Law on the financial sector” below).” Note: It should be noted that the réviseurs d'entreprises agréés shall also inform the CSSF of all denunciations made under Article 5 of the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended, and which concern a professional of the financial sector under the supervision of the CSSF.”9 Similarly, the réviseurs d’entreprises agréé shall inform the CSSF in case s/he deems that the professional should have made a denunciation but has not. Where applicable, the above-mentioned long form report shall encompass the professional's branches and its majority-owned subsidiaries abroad. It shall cover, in particular, the branches' and majority-owned subsidiaries' compliance with the applicable provisions as regards the prevention of money laundering and terrorist financing and it shall include, in that respect: • an analysis of money laundering and terrorist financing risks incurred by the branches and majority-owned subsidiaries. This point shall be covered in point 10 “Branches”, either in Part IV “Consolidated long form audit report” or in this section, respectively; • a description and assessment of the money laundering and terrorist financing risk management in the branches and majority-owned subsidiaries. This point shall be covered in point 10 “Branches”, either in Part IV “Consolidated long form audit report” or in this section, respectively; • the verification of the implementation of and compliance with the professional's AML/CFT policy in the branches or majority-owned subsidiaries. This point shall 9 Circular CSSF 10/486

CIRCULAR CSSF 21/768 17/21 be covered in point 10 “Branches”, either in Part IV “Consolidated long form audit report” or in this section, respectively. 9. Professional obligations as regards the rules of conduct The long form report shall describe and assess compliance with Article 37 of the Law on the financial sector and principles laid down in Circular CSSF 2000/15 concerning the rules of conduct in the financial sector, as well as the fair application of internal procedures for the implementation of the rules of conduct. 10. Branches The branches of investment firms shall be included by the réviseur d'entreprises agréé in his/her annual audit. “This audit shall be handled in a separate chapter in the long form report for every individual branch and shall cover the prudential aspects (financial situation, risks, organisation) as well as compliance with the provisions applicable to the prevention of money laundering and terrorist financing, as well as rules of conduct and it shall provide the following information:”10 • an organisation chart of the branch; • a description of the branch’s activities; • a description and assessment of the procedures as regards internal control implemented by the branch, the existence of an own internal audit function and the modes of integration of the branch in the inspection plan of the internal audit department of the head office; • the serious deficiencies that the control of the internal audit at the branch may have revealed; • an assessment of the appropriateness of the administrative and accounting organisation; “• the implementation and verification of compliance with procedures as regards the prevention of money laundering and terrorist financing within the branch;”11 • the implementation and verification of compliance with Luxembourg procedures as regards the rules of conduct within the branch; • the integration of the branch from an accounting point of view; • the integration of IT and processing systems of the branch into the IT and processing systems of the head office; “• an analysis of risks incurred by the branch, including money laundering and terrorist financing risk;”12 • a description and assessment of the risk management in the branch, including money laundering and terrorist financing risk; • the verification of the implementation of and compliance with the professional's AML/CFT policy in the branch. 11. Relations with affiliated undertakings The réviseur d'entreprises agréé shall certify that s/he has examined the intra-group transactions and specify if they have been effected at market conditions. 10 Circular CSSF 10/486 11 Circular CSSF 10/486 12 Circular CSSF 10/486

CIRCULAR CSSF 21/768 18/21 The following shall notably be described and commented upon:

• the policies and goals pursued by the investment firm in its relations with the affiliated undertakings;
• the type of executed intra-group transactions;
• the guarantees issued to the benefit of/received by the affiliated undertakings;
• the share of interest received from the affiliated undertakings, or the share of interest paid to the affiliated undertakings respectively;
• the fees charged for services provided or received.

12. Follow-up on issues raised in previous reports The réviseur d'entreprises agréé shall follow up on serious irregularities and weaknesses observed during the previous audits and described in detail either in the previous long form report, or in a separate management letter addressed to the management.
13. General conclusion The réviseur d'entreprises agréé shall take position in the general conclusion on the essential points of his/her audit, so as to provide an overview of the situation of the audited investment firm. More generally, the réviseur d'entreprises agréé shall summarise the main notes and conclusions of his/her report. S/he shall also indicate the main recommendations and observations made to the management of the investment firm within the scope of the audit of the annual accounts, as well as the management’s response thereon. Where the réviseur d’entreprises agréé addresses a separate management letter to the management, the general conclusion only needs to refer to the document concerned, which shall be annexed to the long form report. The réviseur d'entreprises agréé shall describe the existence of any problems of the institution with foreign supervisory authorities of which s/he is aware. IV. Consolidated long form audit report The consolidated long form audit report shall be drawn up according to the same principles and format as the annual audit report. It shall however focus on the specific information regarding the consolidated situation. The consolidated long form audit report shall specify the scope of consolidation and any changes thereto during the year under review, as well as the list of participations that are not included in the consolidation, by indicating on which grounds. For each consolidated undertaking, the consolidation method shall be described. Where the investment firm subject to the consolidated supervision of the CSSF is exempt from publishing consolidated accounts or where the scope of consolidation of the publication of consolidated accounts differs from the scope of consolidation of the supervision on a consolidated basis, the consolidated long form audit report shall be based on the consolidated accounting situation corresponding to the scope of consolidated supervision carried out by the CSSF.

CIRCULAR CSSF 21/768 19/21 “The aim of the consolidated long form audit report is to provide an overview of the group's situation and to give indications as to the management, organisation and activities of the group, as well as on the structure of the group’s risk, including with respect to money laundering and terrorist financing”.13 The consolidated long form audit report shall briefly present the different points of the format for each consolidated subsidiary. As regards majority-owned subsidiaries, the consolidated long form report shall also include: • an analysis of money laundering and terrorist financing risks incurred by the subsidiary; • a description and assessment of the money laundering and terrorist financing risk management in the subsidiary; • the verification of the implementation of and compliance with the professional's AML/CFT policy in the subsidiary. V. Reporting to the CSSF by virtue of Article 54(3) of the Law on the financial sector In accordance with Article 54(3) of the Law on the financial sector, the réviseur d'entreprises agréé is required promptly to report to the CSSF any fact or decision of which s/he becomes aware while performing the duty of auditing the annual accounting documents of a professional of the financial sector or any other statutory duty, where that fact or decision: • concerns that professional of the financial sector and • is likely to:

• constitute a material infringement of the provisions of the Law on the financial sector or the implementing regulatory provisions, or
• affect the continuous functioning of the professional, or
• lead to refusal to certify the accounts or to the expression of reservations. The réviseur d’entreprises agréé is also required promptly to report to the CSSF any fact or decision meeting one of the three criteria mentioned above, of which s/he becomes aware during the course of his/her audit of the annual accounting documents or another statutory duty for an undertaking linked by virtue of control to the professional of the financial sector for which s/he carries out a statutory duty. The réviseur d’entreprises agréé is also required to provide the CSSF with all information or certificates it requires with respect to matters the réviseur d'entreprises agréé is or should be aware of within the scope of his/her duty. In return for this requirement to report to the CSSF, Article 54(4) of the Law on the financial sector guarantees that the réviseur d'entreprises agréé, who, in good faith, discloses confidential information pursuant to paragraph 3, is protected against any third-party claims. 13 Circular CSSF 10/486

CIRCULAR CSSF 21/768 20/21 VI. Final provisions The CSSF may, upon a written and duly justified request, exempt an investment firm from drawing up an annual long form audit report or a consolidated long form audit report according to the nature and inherent risks of its activities. The provisions of this circular shall be binding in their entirety for the annual accounts ending after 31 December 2003. Yours faithfully, COMMISSION de SURVEILLANCE du SECTEUR FINANCIER Charles KIEFFER Arthur PHILIPPE Jean-Nicolas SCHAUS Director General

CIRCULAR CSSF 21/768 62 /21 Commission de Surveillance du Secteur Financier 283, route d’Arlon L-2991 Luxembourg (+352) 26 25 1

1 direction@cssf.lu www.cssf.lu