CSSF Circular 24/850 as Amended: Annual Reporting and Statutory Auditor Requirements for Support PFS

In case of discrepancies between the French and the English texts, the French text shall prevail. CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 1/11 Circular CSSF 24/850 as amended by Circular CSSF 25/903 Practical rules concerning the descriptive report and the self￾assessment questionnaire to be submitted on an annual basis by support PFS Engagement of the réviseurs d'entreprises agréés (approved statutory auditors) of support PFS and practical rules concerning the management letter and the separate report to be drawn up on an annual basis

In case of discrepancies between the French and the English texts, the French text shall prevail. CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 2/11 Circular CSSF 24/850 as amended by Circular CSSF 25/903 Practical rules concerning the descriptive report and the self￾assessment questionnaire to be submitted on an annual basis by support PFS Engagement of the réviseurs d'entreprises agréés (approved statutory auditors) of support PFS and practical rules concerning the management letter and the separate report to be drawn up on an annual basis To all support PFS Luxembourg, 19 January 2024 Ladies and Gentlemen, The purpose of this circular is to define the practical rules concerning the preparation and annual submission of the below-mentioned documents by support PFS and their réviseurs d'entreprises agréés (approved statutory auditors, “REA”). More specifically, this circular introduces, on the one hand, a self-assessment questionnaire to be completed on an annual basis by support PFS (“self-assessment questionnaire”) and to be submitted to the CSSF as a replacement of the risk assessment report (“RAR”) required under Circular CSSF 12/5441. The self-assessment questionnaire represents the result of an in-depth review of the objective and content of the information the CSSF requests to receive on the support PFS’ self￾assessment and management of the risks to that it may expose the financial sector. It takes into account the regulatory developments and the main points that the CSSF intends to bring to the support PFS’ attention. On the other hand, this circular broadly details the role and engagement of REAs in the context of the statutory audit of support PFS. Moreover, it establishes a specific regulatory framework applicable to the management letter, and also introduces a separate report (“separate report”). The separate report includes the specific procedures that the CSSF requests the REA to perform in relation to the support PFS’ self-assessment questionnaire. Both documents must be drawn up by the support PFS’ REAs on an annual basis. Lastly, this circular adapts and simplifies the descriptive report to be provided on an annual basis by support PFS and repeals Circulars CSSF 12/544 and CSSF 19/7272 following the introduction of the new supervisory tools by this circular. 1 Circular CSSF 12/544 on the optimisation of the supervision exercised on the “support PFS” by a risk-based approach, repealed by this circular. 2 Circular CSSF 19/727 on new arrangements for the transmission of the documents required under Circular CSSF 12/544, repealed by this circular.

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 3/11 TABLE OF CONTENTS

1. Scope and legal basis..................................................................................................... 4
2. Risk-based approach...................................................................................................... 4
3. Practical rules concerning the descriptive report and the self-assessment questionnaire to be submitted by support PFS on an annual basis ......................................................................... 5 3.1. Descriptive report .................................................................................................... 5 3.2. Self-assessment questionnaire .................................................................................. 5
4. Practical rules concerning the engagement of REAs............................................................ 7 4.1. The statutory audit of a support PFS .......................................................................... 7 4.2. The management letter ............................................................................................ 7 4.3. The separate report ................................................................................................. 8
5. Obligation of the REA to report to the CSSF ...................................................................... 9
6. Instructions for the preparation and filing of the expected documents................................ 10 6.1. Documents to be submitted and submission modalities............................................... 10 6.2. Practical modalities ................................................................................................ 11
7. Entry into force ........................................................................................................... 11

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 4/11

1. Scope and legal basis This circular applies to all PFS exercising one or several support PFS activities as defined in Articles 29-1 to 29-6 of the Law of 5 April 1993 on the financial sector (“LFS”) and classified as "I" by the CSSF. Support PFS must refer to the identification codes as published on the CSSF website in the “Search Entities” application. The requirements introduced by this circular are notably based on the following legal provisions:

• the self-assessment questionnaire, as specified in Section 3.2 of this circular, is introduced pursuant to point (2) of Article 53(1) of the LFS which allows the CSSF to require or demand the provision of information from support PFS for the exercise of its functions;
• the definition of the specific regulatory framework applicable to the management letter to be drawn up by the REA, as specified in Section 4.2 of this circular, results from Article 54(1) of the LFS which allows the CSSF to set rules on the scope of the mandate for the audit of the annual accounting documents of support PFS and on the content of the reports and written comments issued by the REA;
• the separate report to be drawn up by the REA, as specified in Section 4.3. of this circular, is introduced: o pursuant to Article 49 of CSSF Regulation No 12-02 of 14 December 2012 (“RCSSF 12- 02”)3 as regards the section of the separate report relating to the prevention of money laundering and terrorist financing (Section “AML/CFT Aspects”); o pursuant to Article 54(2) of the LFS which allows the CSSF to instruct a REA to carry out audits on one or several specific aspects of the activity and operation of support PFS, as regards all the other sections of the separate report.

2. Risk-based approach The extent of the self-assessment questionnaire and of the list of specific procedures to be performed by the REA is linked to the application of the principle of proportionality and of a risk-based supervisory approach. In practice, a support PFS that is considered to be less risky will have to respond to a limited number of questions and will be subject to a smaller number of specific procedures to be performed by its REA. In this context, a rating system is put in place by the CSSF in order to determine the risk to which every support PFS is exposing the financial sector. This rating system is based on several criteria and takes into account, in particular, the nature of the activities performed that require a support PFS authorisation, the turnover, the clients of the financial sector and the size of the support PFS. Each year, and at the latest at the closing of its financial year, the CSSF will inform the support PFS of the risk category that has been assigned to it (low, medium, high). However, for the first year of application, as defined in Section 7 of this circular, the CSSF may, on an exceptional basis, provide the support PFS with this information at the latest one month after the publication of this circular. The support PFS may request the CSSF to provide details on the criteria that have been selected for the risk rating. 3 CSSF Regulation No 12-02 of 14 December 2012 on the fight against money laundering and terrorist financing, as amended

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 5/11 3. Practical rules concerning the descriptive report and the self-assessment questionnaire to be submitted by support PFS on an annual basis 3.1. Descriptive report Support PFS must provide the descriptive report on an annual basis, describing in particular their administrative and accounting organisation, internal control system, IT infrastructure and the activities provided to the financial sector. The structure of the descriptive report, as well as the list of documents expected as part of the descriptive report, are available on the website of the CSSF. When a specific section of the structure or an expected document does not apply to the support PFS, the latter shall explicitly state it. 3.2. Self-assessment questionnaire This circular introduces a self-assessment questionnaire to be completed by support PFS for each year or period subject to statutory audit. The objective of the self-assessment questionnaire is to request support PFS to perform a self￾assessment of certain risks and of their compliance with regard to legal and regulatory requirements. The themes of the questions applicable to support PFS are determined in accordance with the activities provided to the financial sector, and thus in accordance with the authorisations held by the support PFS. The self-assessment questionnaire is split into four sections that each support PFS must fill in in accordance with the authorisation held, according to the allocation set out in Table 1 (“Allocation of the self-assessment questionnaire sections”) below.

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 6/11 Table 1 - Allocation of the self-assessment questionnaire sections Section Support PFS concerned ICT-related aspects4 - IT systems and communication networks operators of the financial sector (Article 29-3 of the LFS)

• Dematerialisation service providers of the financial sector (Article 29- 5 of the LFS)
• Conservation service providers of the financial sector (Article 29-6 of the LFS) Operational aspects5 - Client communication agents (Article 29-1 of the LFS)
• Administrative agents of the financial sector (Article 29-2 of the LFS) Transversal aspects (except “AML/CFT”)
• Client communication agents (Article 29-1 of the LFS)
• Administrative agents of the financial sector (Article 29-2 of the LFS)
• IT systems and communication networks operators of the financial sector (Article 29-3 of the LFS)
• Dematerialisation service providers of the financial sector (Article 29- 5 of the LFS)
• Conservation service providers of the financial sector (Article 29-6 of the LFS) Anti-money laundering and counter-terrorist financing aspects (“AML/CFT aspects”)
• Client communication agents (Article 29-1 of the LFS)
• Administrative agents of the financial sector (Article 29-2 of the LFS)
• IT systems and communication networks operators of the financial sector (Article 29-3 of the LFS)
• Dematerialisation service providers of the financial sector (Article 29- 5 of the LFS)
• Conservation service providers of the financial sector (Article 29-6 of the LFS) By way of derogation from the foregoing: a) Where a support PFS authorised under Articles 29-3, 29-5 or 29-6 of the LFS also holds one or more authorisations under Articles 29-1 or 29-2 of the LFS, it must only fill in the sections “ICT￾related aspects”, “Transversal aspects” and “AML/CFT aspects”; it does thus not have to complete the questions and procedures under “Operational aspects”. b) Depending on the activities carried out and the risk to that the support PFS may expose the financial sector, and as opposed to the section allocation provided for in Table 1, the CSSF may request a support PFS, on an exceptional basis, to fill in a section of the questionnaire which has not been allocated to it or, on the contrary, exempt the support PFS from providing it. The CSSF will transmit the requests as per point (b) above to the support PFS concerned at the latest at the closing of their financial year. However, for the first year of application, as defined in Section 7 of this circular, the CSSF may transmit such request to the support PFS concerned at the 4 Information and Communication Technology (ICT) 5 It should be noted that the sections covering the operational and transversal aspects also include a certain number of ICT-related questions.

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 7/11 latest one month after the publication of this circular. In the absence of such communication, support PFS must comply with the allocation as set out in Table 1. In accordance with the risk-based approach detailed in Section 2 of this circular, the number of questions that a support PFS must answer depends on the risk category that has been assigned by the CSSF to this support PFS. Hence, two support PFS with the same authorisation and that have to fill in the same sections of the self-assessment questionnaire may have to respond to a different volume of questions based on their risk category. Depending on the developments of the legal and regulatory requirements applicable to support PFS as well as on the prudential supervision requirements, the self-assessment questionnaire may be adapted over the coming years. 4. Practical rules concerning the engagement of REAs In accordance with Article 22(1) of the LFS, support PFS must entrust the statutory audit of their accounts to a REA on an annual basis. In this context, this circular defines, pursuant to Article 54(1) of the LFS, a specific regulatory framework applicable to the management letter that the REA will have to draw up to the attention of the persons responsible for the support PFS and the CSSF. Moreover, pursuant to Article 54(2) of the LFS and Article 49 of RCSSF 12-02, this circular introduces a separate report to be drawn up by the REA on an annual basis, in compliance with the details provided in Section 4.3 below. 4.1. The statutory audit of a support PFS Pursuant to Article 33 of the Law of 23 July 2016 concerning the audit profession, the statutory audit of a support PFS must be carried out in compliance with the international auditing standards as adopted by the CSSF. On this basis, the REA presents the results of the statutory audit in an audit report which includes its audit opinion. 4.2. The management letter This circular introduces a specific legal framework for the management letter that REAs must draw up, for each year or period subject to a statutory audit, to the attention of the persons responsible for the support PFS. The management letter must be completed by the REA through the eDesk platform. In the context of the management letter, the REA is not required to carry out any further procedures other than those already performed during the statutory audit, as referred to in Section 4.1 of this circular. In accordance with the applicable auditing standards, the REA must report, in a management letter addressed to the persons responsible for the support PFS, the weaknesses and points needing improvement that it observed during its statutory audit of the support PFS, and that are, based on

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 8/11 the REA’s professional judgement, of sufficient importance to be brought to the attention of the persons responsible for the support PFS or of the CSSF. The management letter must also include the follow-up of the weaknesses or points needing improvement raised in the management letters issued in preceding financial years and that have not been “closed” in the previous management letter, only where those weaknesses or points needing improvement relate to the statutory audit. The weaknesses and points needing improvement that are not related to the statutory audit must be followed up internally by the support PFS and must no longer be mentioned in the management letter6. The REA must consider the weakness or point needing improvement as “closed” where the necessary corrective measures have been put in place to remedy this weakness or point needing improvement and where the persons responsible for the support PFS have put in place appropriate measures to prevent such issues from arising in the future. Moreover, for each weakness or point needing improvement, the REA must obtain the comments of the persons responsible for the support PFS before submitting the management letter through the eDesk platform. Such comments must mandatorily include, among others, the following information:

• a detailed explanation of the reasons and circumstances relating to the occurrence of the weakness or point needing improvement identified by the REA;
• a detailed explanation of the measures taken or decided in order to remedy the weakness or the point needing improvement and to prevent their recurrence in the future. These measures must be complemented by a detailed remediation plan and timetable. If the persons responsible for the support PFS do not respond in a timely manner and within a reasonable time frame to the weaknesses or points needing improvement raised by the REA in the management letter, the REA will issue this management letter specifying that no comments have been received by the persons responsible for the support PFS on the weaknesses or points raised. 4.3. The separate report This circular introduces a separate report to be completed by the REAs of support PFS, for each year or period for which a self-assessment questionnaire has been submitted by the support PFS. The purpose of the separate report is notably to ensure the reliability of the answers provided by the support PFS in the self-assessment questionnaire and to provide answers to a set of questions determined by the CSSF. The REA that performs the tests provided for in the separate report must be the REA appointed by the support PFS to carry out the statutory audit, as referred to in Section 4.1 of this circular. The drawing-up of a separate report consists of a set of procedures, defined by the CSSF, to be implemented by the REA and that are broken down into predefined topics. Pursuant to Article 49 of RCSSF 12-02, the separate report also covers matters relating to anti￾money laundering and countering the financing of terrorism (AML/CFT), taking notably into account 6 The approach and the expectations described in this paragraph also apply to the weaknesses and points needing improvement indicated in the reports relating to the compliance with financial sector laws, regulations and circulars issued in previous financial years.

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 9/11 the “very low” risk level allocated to the support PFS sector due to the low-risk nature of their activities. Depending on the activities of a support PFS, a procedure may not be applicable. In this case, the REA must explicitly indicate this in the separate report. The procedures are directly indicated in the separate report and consist in sample testing or verifications to be carried out by the REA. The sizes of the samples are determined by the CSSF based on a risk-based approach and they must be detailed in the separate report. Similarly to the number of questions asked to support PFS as part of the self-assessment questionnaire, the number of procedures to be carried out by the REA depends on the risk category that has been assigned by the CSSF to the support PFS. Hence, two support PFS with the same authorisation and that have to fill in the same sections of the self-assessment questionnaire may have to provide separate reports with a different number of specific procedures depending on the risk category assigned to them. A rotation plan will be established for the tests to be performed by the REA based on the activities and risk categories of the support PSF, and the allocation of specific procedures according to the risk categories of the support PSF will also be directly integrated into the eDesk platform. Depending on the developments of the legal and regulatory requirements applicable to support PFS as well as on the prudential supervision requirements, the procedures to be implemented by the REA and the rotation plan of the specific procedures may be adapted over the coming years, following the amendments that might also be made to the self-assessment questionnaire. The results of these procedures are reported by the REA in the separate report in the form of answers to a set of mainly closed-ended questions or confirmations and they do not result in an opinion in accordance with auditing, insurance or any related services standards. Any comments provided, where applicable, by the REA in the report must be concise, clear and meet the objectives and provide answers to the questions asked. The support PFS must issue comments on the observations made by the REA (providing its response – agreement or disagreement – and, where applicable, the action plan and the implementation date) before transmitting the report through the eDesk platform. 5. Obligation of the REA to report to the CSSF The REA is required to report to the CSSF pursuant to Article 54(3) of the LFS. Such reporting shall not only relate to adverse effects in the short term (as it is the case for the certification of annual accounts) but also in the medium and long term (objective of the prudential supervision). Consequently, the REA shall communicate to the CSSF the information of which s/he became aware while carrying out the statutory audit of a support PFS or, where applicable, while performing any other legal or regulatory mission concerning the support PFS, and which is relevant from a prudential point of view and/or likely to require an urgent action by the CSSF. The facts to be considered are, among others, items constituting a material infringement of legislation, affecting the continuous functioning of the institution or leading to refusal to certify the accounts or to reservations thereto. The legal requirement to “promptly” report the relevant information to the CSSF does not prevent the REA from consulting first the persons responsible for the support PFS, provided that the latter are not conflicted and that the discussion does not unduly delay the transmission of information to the CSSF.

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 10/11 As regards the communication modalities, it is understood that:

• the reporting of the REA is carried out spontaneously, in written or oral form; in case of serious problems, it is recommended that the oral communications be followed by a written confirmation as quickly as possible;
• the priority should be given to timely rather than precise and complete reporting in the first place;
• in the reporting to the CSSF, the REA shall explicitly inform on the actual or possible problems noted. Examples of facts or decisions falling or likely to fall under the reporting obligation to the CSSF include, among others, the following:
• major conflicts within the decision-making bodies of the institution;
• unexpected departure of a key function holder;
• major financial difficulties in a branch or subsidiary;
• serious deficiencies in the internal control framework;
• significant errors in the prudential reporting;
• granting of an interim dividend while the institution has insufficient or barely sufficient own funds;
• major incidents in the IT organisation or infrastructure;
• activity change without appropriate infrastructure;
• frauds likely to generate important losses;
• important legal disputes;
• inappropriate assessment in relation to a merger/split project of undertakings. As a reminder, Article 54(4) of the LFS guarantees that the disclosure in good faith to the CSSF by a REA of any fact or decision as referred to in paragraph 3 of that Article shall not constitute a violation of the obligation of professional secrecy or a breach of any restriction on disclosure of information imposed by contract, and shall not expose that REA to liability of any kind.

6. Instructions for the preparation and filing of the expected documents 6.1. Documents to be submitted and submission modalities All documents to be submitted in the context of this circular must be transmitted in electronic form through the eDesk platform:

• The descriptive report and its annexes;
• The documents required in the context of the financial year-end (including the REA’s management letter);
• The self-assessment questionnaire;
• The separate report. The descriptive report and the self-assessment questionnaire must be electronically approved and signed by the authorised management prior to their transmission to the CSSF.

CIRCULAR CSSF 24/850 as amended by Circular CSSF 25/903 11/11 The separate report and the management letter issued by the REA must be electronically signed by the partner in charge of the mandate within the audit firm s/he represents. Once signed, these documents must be submitted by the support PSF to the CSSF. All documents must be transmitted at the latest within seven months following the closing date of the financial year of the support PFS. As soon as it comes to their attention, the support PFS must inform the CSSF of any reported delay and indicate the reasons for and the probable duration of the delay. In case of withdrawal or deregistration of the support PFS from the official list held by the CSSF during the year, the self-assessment questionnaire and the separate report covering the period from the last financial year-end to the date of withdrawal or deregistration will, in principle, be required within the same seven-month time frame. The above-mentioned submission deadlines may be reviewed by the CSSF for subsequent financial years. The procedure available on the eDesk platform will clearly specify the documents to be submitted; an exhaustive list of the required documents will also be published on the CSSF website. 6.2. Practical modalities The procedures and explanations relating to the practical modalities regarding the preparation and transmission of all documents referred to under Section 6.1 will be made available to the support PFS and their REA on the website of the CSSF. A user guide detailing the account creation and authentication procedures on the eDesk platform is also made available on the eDesk homepage. 7. Entry into force The instructions of this circular must be complied with in their entirety for the financial years closing on 31 December 2025 or after 31 December 2025. All financial years closing as from the above￾mentioned date will thus fall within the scope of this circular. This circular repeals Circulars CSSF 12/544 and CSSF 19/727. Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General