CSSF Regulation No 15-02 relating to the supervisory review and evaluation process for CRR institutions

COMMISSION de SURVEILLANCE du SECTEUR FINANCIER

In case of discrepancies between the French and the English text, the French text shall prevail CSSF Regulation N° 15-02 relating to the supervisory review and evaluation process that applies to CRR institutions (Mémorial A – No. 161 of 14 August 2015) The Executive Board of the Commission de Surveillance du Secteur Financier,

Having regard to Article 108a of the Constitution; Having regard to the Law of 23 December 1998 establishing a financial sector supervisory commission ("Commission de surveillance du secteur financier") and in particular Article 9(2) thereof; Having regard to the Law of 5 April 1993 on the financial sector and in particular Articles 42, 43 and 53-1 thereof; Having regard to the Law of 23 December 1998 relating to the monetary status and to the Central Bank of Luxembourg (“Banque centrale du Luxembourg”) and in particular Article 2(4) thereof; Having regard to Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC; Having regard to Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 648/2012; Having regard to Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions, and in particular Articles 4(1)(e), 4(3) and 9(1) thereof; Having regard to the opinion of the Consultative Committee for Prudential Regulation; Decides: Part I Definitions and scope Chapter I Definitions Article 1 Definitions (1) For the purposes of this regulation, the following definitions shall apply:  "LFS" shall mean the law of 5 April 1993 on the financial sector, as amended;  "EBA" shall mean the European Banking Authority established by Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010;  "principle of proportionality" shall mean the principle according to which CRR institutions shall implement these rules in accordance with their size, internal organisation and the nature, scale and complexity of the risks inherent in the business model and activities; 1

COMMISSION de SURVEILLANCE du SECTEUR FINANCIER

 "CRR institution" shall mean an institution within the meaning of Article 1(11a) of the LFS, as well as the Luxembourg branches of such institutions incorporated in a third country, hereinafter deemed to be included in the notion of CRR institution. (2) The definitions included in Article 1 of the LFS shall apply to this regulation. Chapter 2 Scope Article 2 Governance and treatment of risks (1) The CRR institution shall apply Chapters 1 and 2 of Part II of this regulation in accordance with the level of application referred to in Article 38 of the LFS. (2) The CRR institution shall apply Chapter 5 of Part II of this regulation in accordance with the level of application of the requirements set out in Part One, Title II of Regulation (EU) No 575/2013. Article 3 Internal capital and liquidity adequacy assessment process (1) Any CRR institution which is neither a subsidiary in Luxembourg where it is authorised, nor a parent undertaking, and any CRR institution excluded from the scope of consolidation by virtue of Article 19 of Regulation (EU) No 575/2013 shall satisfy the obligations laid down in Chapters 3 and 4 of Part II of this regulation on an individual basis. By virtue of Article 12 of the LFS, the caisses rurales affiliated to the central credit institution of the caisses rurales shall be waived from the obligations laid down in Chapters 3 and 4 of Part II of this regulation, as they are credit institutions that are permanently affiliated to a central body in accordance with Article 10 of Regulation (EU) No 575/2013. Where a CRR institution is exempt from applying the own funds requirements on a consolidated basis provided for in Article 15 of Regulation (EU) No 575/2013, the requirements of Chapters 3 and 4 of Part II of this regulation shall apply on an individual basis. (2) CRR institutions that are a parent undertaking, to the extent and in the manner laid down in the Part One, Title II, Chapter 2, Sections 2 and 3, of Regulation (EU) No 575/2013, which define the methods and the scope of the prudential consolidation, shall meet the obligations set out in Chapters 3 and 4 of Part II of this regulation on a consolidated basis. (3) CRR institutions controlled by a parent financial holding company or a parent mixed financial holding company in Luxembourg, to the extent and in the manner prescribed in Sections 2 and 3 of Part One, Title II, Chapter 2 of Regulation (EU) No 575/2013, shall meet the obligations set out in Chapters 3 and 4 of Part II of this regulation on the basis of the consolidated situation of that financial holding company or mixed financial holding company. Where several CRR institutions are controlled by a parent financial holding company or a parent mixed financial holding company in Luxembourg, the first subparagraph shall apply only to the CRR institution which is subject to supervision on a consolidated basis in accordance with Article 49 of the LFS. (4) Subsidiary CRR institutions shall apply the requirements set out in Chapters 3 and 4 of Part II of this regulation on a sub-consolidated basis if those CRR institutions, or their parent undertaking where it is a financial holding company or mixed financial holding company, have a CRR institution or a financial institution or an asset management company as defined in Article 2, point 5 of Directive 2002/87/EC as a subsidiary in a third country, or hold a participation in such an undertaking. 2

COMMISSION de SURVEILLANCE du SECTEUR FINANCIER

Article 4 Review and evaluation and supervisory measures Part III of this regulation shall apply in accordance with the level of application of the requirements of Part One, Title II of Regulation (EU) No 575/2013. Where Article 15 of Regulation (EU) No 575/2013 applies ("Derogation to the application of own funds requirements on a consolidated basis for groups of investment firms"), the requirements of Part III of this regulation shall apply to the supervision of CRR investment firms on an individual basis. Part II Technical criteria concerning the organisation and treatment of risks Chapter 1 Governance in relation to risk Article 5 Governance arrangements The CRR institution shall have robust governance arrangements as defined in Article 5(1a), (1b) and (3) and in Article 17(1a) of the LFS. Article 6 Risk management (1) The management body shall approve and periodically review the strategies and policies for taking up, managing, monitoring and mitigating the risks the CRR institution is or might be exposed to, including those posed by the macroeconomic environment in which it operates, taking into account the status of the business cycle. (2) The management body shall devote sufficient time to consideration of risk issues. The management body shall be actively involved in and ensure that adequate resources are allocated to the management of all material risks as well as in the valuation of assets, the use of external credit ratings and internal models relating to those risks. (3) The CRR institution shall establish reporting lines to the management body that cover all material risks, risk management policies and changes thereof. These reporting lines provide the management body in its supervisory function and, where a risk committee has been established, the risk committee, with adequate access to information on the risk situation of the CRR institution and, if necessary and appropriate, to the risk management function and to external expert advisors. The management body in its supervisory function and, where one has been established, the risk committee shall determine the nature, the amount, the format, and the frequency of the information on risk which it is to receive. Article 7 Specialised committees (1) CRR institutions that are significant in terms of their size, internal organisation and the nature, scope and complexity of their activities shall establish a risk committee composed of members of the management body who do not perform any executive functions in the CRR institution concerned. Members of the risk committee shall have appropriate knowledge, skills and expertise to fully understand and monitor the risk strategy and the risk appetite of the CRR institution. 3

COMMISSION de SURVEILLANCE du SECTEUR FINANCIER

(2) The risk committee shall advise the management body on the CRR institution's overall current and future risk appetite and risk strategy and assist the management body in overseeing the implementation of that strategy by the authorised management. The management body shall retain overall responsibility for risks. The risk committee shall review whether prices of assets and liabilities offered to clients take fully into account the CRR institution's business model and risk strategy. Where prices do not properly reflect risks, taking into account the business model and risk strategy, the risk committee shall present a remedy plan to the management body. In order to assist in the establishment of sound remuneration policies and practices, the risk committee shall, without prejudice to the tasks of the remuneration committee, examine whether incentives provided by the remuneration system take into consideration risk, own funds, liquidity and the likelihood and timing of earnings. (3) The CSSF may allow a CRR institution which is not considered significant in terms of its size, internal organisation and the nature, scope and complexity of its activities, to establish a joint risk and audit committee as referred to in Article 39 of Directive 2006/43/EC of the European Parliament and of the Council of 17 May 2006 on statutory audits of annual accounts and consolidated accounts. Members of the combined committee shall have the knowledge, skills and expertise required for the risk committee and for the audit committee. Article 8 Risk control function Having regard to the principle of proportionality, CRR institutions shall have a risk control function independent from the operational functions and which shall have sufficient authority, status, resources and access to the management body. The risk control function shall be able to report directly to the management body in its supervisory function, without referral to the authorised management, and raise concerns and warn the management body in its supervisory function where risk developments affect or may affect the CRR institution significantly. (2) The risk control function shall ensure that all material risks are identified, measured and properly reported. It shall be actively involved in elaborating the CRR institution's risk strategy and in all material risk management decisions and it shall deliver a complete view of the whole range of risks to which the CRR institution is exposed. (3) The head of the risk control function shall be an independent authorised manager with distinct responsibility for the risk control function. Where the principle of proportionality does not require such an appointment, another member of the senior management of the CRR institution may assume that function, provided there is no conflict of interest. The head of the risk control function shall not be removed without prior approval of the management body in its supervisory function and shall be able to have direct access to the management body where necessary. (4) The application of this article shall be without prejudice to the application of Grand-ducal Regulation of 13 July 2007 relating to organisational requirements and rules of conduct in the financial sector. 4

COMMISSION de SURVEILLANCE du SECTEUR FINANCIER

Chapter 2 Treatment of risks Article 9 Credit and counterparty risk (1) Credit-granting shall be based on sound and well-defined criteria. The process for approving, amending, renewing, and re-financing credits shall be clearly established. (2) CRR institutions shall have internal methodologies that enable them to assess the credit risk of exposures to various obligors, securities or securitisation positions and credit risk at the portfolio level. In particular, internal methodologies shall not rely solely or mechanistically on external credit ratings. CRR institutions that are significant in terms of their size, internal organisation and the nature, scale and complexity of their activities, shall develop internal credit risk assessment capacity and increase the use of the internal ratings based approach for calculating own funds requirements for credit risk in accordance with Part Three, Title II, Chapter 3 of Regulation (EU) No 575/2013, where their exposures are material in absolute terms and where they have at the same time a large number of significant counterparties. (3) The CRR institution shall use effective systems for ongoing management and monitoring of their various credit risk-bearing portfolios and exposures, including for identifying and managing problematic credits and for making adequate value adjustments and provisions. (4) Diversification of credit portfolios shall be adequate, taking into account the CRR institution's target markets and overall credit strategy. Article 10 Residual risk The risk that recognised credit risk mitigation techniques used by the CRR institution prove less effective than expected shall be addressed and controlled by the CRR institution notably by means of its written policies and procedures. Article 11 Concentration risk The written policies and procedures of the CRR institution shall notably provide for the treatment and control of concentration risk arising from: – exposures to each counterparty, including central counterparties; – exposures to groups of connected counterparties; – exposures to counterparties operating in the same economic sector or in the same geographical region; – credit exposures deriving from a same activity, business or commodity; or – the application of credit risk mitigation techniques, and in particular risks associated with large indirect credit exposures (such as a single collateral issuer). Article 12 Securitisation risk (1) The risks arising from securitisation transactions in relation to which the CRR institutions are investor, originator or sponsor, including reputational risks (such as arise in relation to complex structures or products), shall be evaluated and addressed through appropriate policies and 5

COMMISSION de SURVEILLANCE du SECTEUR FINANCIER

procedures, to ensure that the economic substance of the transaction is fully reflected in the risk assessment and management decisions. (2) Liquidity plans to address the implications of both scheduled and early repayment shall exist at CRR institutions which are originators of revolving securitisation transactions involving early repayment provisions. Article 13 Market risk (1) The CRR institution shall implement policies and processes for the identification, measurement and management of all material sources and effects of market risks. (2) Where the short position falls due before the long position, the CRR institution shall also take measures against the risk of a shortage of liquidity. (3) Having regard to the principle of proportionality, the CRR institution shall develop an internal risk assessment capacity and increase the use of internal models for calculating own funds requirements for the specific risk of debt instruments in the trading book, as well as for calculating own funds requirements for the default and migration risk where the exposures of this CRR institution to specific risk are material in absolute terms and where it has a large number of significant positions in debt instruments from different issuers. Article 14 Interest risk arising from non-trading book activities The CRR institution shall implement systems to identify, evaluate and manage the risk arising from potential changes in interest rates that affect its non-trading activities. Article 15 Operational risk (1) The CRR institution shall implement policies and processes to evaluate and manage its exposure to operational risk, including model risk, and to cover low-frequency high-severity events. It shall articulate what constitutes operational risk for the purposes of those policies and procedures. (2) The CRR institution shall implement contingency and business continuity plans to ensure the CRR institution's ability to limit losses and operate on an ongoing basis in the event of severe business disruption. Article 16 Liquidity risk (1) The CRR institution shall have robust strategies, policies, processes and systems for the identification, measurement, management and monitoring of liquidity risk over an appropriate set of time horizons, including intra-day. Those strategies, policies, processes and systems shall be tailored to business lines, currencies, branches and legal entities and shall include adequate allocation mechanisms of liquidity costs, benefits and risks. (2) The strategies, policies, processes and systems referred to in paragraph 1 of this article shall be proportionate to the complexity, risk profile, scope of operation of the CRR institution and risk tolerance set by the management body and reflect the CRR institution's importance in each Member State in which it carries out business. The CRR institution shall communicate risk tolerance with regard to all relevant business lines. 6

COMMISSION de SURVEILLANCE du SECTEUR FINANCIER

(3) Having regard to the principle of proportionality, the CRR institution shall have a liquidity risk profile that is consistent with, and not in excess of, that required for a well-functioning and robust system. (4) The CRR institution shall develop methodologies for the identification, measurement, management and monitoring of funding positions. Those methodologies shall include the current and projected material cash-flows in and arising from assets, liabilities, off-balance￾sheet items, including contingent liabilities and the possible impact of reputational risk. (5) The CRR institution shall distinguish between pledged and unencumbered assets that are available at all times, in particular during emergency situations. It shall take into account the legal entity in which assets reside, the country where assets are legally recorded either in a register or in an account as well as their eligibility and shall monitor how assets can be mobilised in a timely manner. (6) The CRR institution shall also have regard to existing legal, regulatory and operational limitations to potential transfers of liquidity and unencumbered assets amongst entities, both within and outside the European Economic Area. (7) The CRR institution shall consider different liquidity risk mitigation tools, in particular a system of limits and liquidity buffers in order to be able to withstand a range of different stress events, and an adequately diversified funding structure and access to funding sources. Those arrangements shall be reviewed regularly. (8) The CRR institution shall consider alternative scenarios on liquidity positions and on risk mitigants and review the assumptions underlying decisions concerning the funding position at least annually. For those purposes, alternative scenarios shall address, in particular, off-balance sheet items and other contingent liabilities, including those of Securitisation Special Purpose Entities (SSPE) or other special purpose entities, as referred to in Regulation (EU) No 575/2013, in relation to which the CRR institution acts as sponsor or provides material liquidity support. (9) The CRR institution shall consider the potential impact of institution-specific, market-wide and combined alternative scenarios. Different time periods and varying degrees of stressed conditions shall be considered. (10) The CRR institution shall adjust its strategies, policies and limits on liquidity risk and develop effective contingency plans, taking into account the outcome of the alternative scenarios referred to in paragraphs 8 and 9 of this article. (11) The CRR institution shall have in place liquidity recovery plans setting out adequate strategies and proper implementation measures in order to address possible liquidity shortfalls, including in relation to branches established in another Member State. The CRR institution shall test these plans at least annually, update them on the basis of the outcome of the alternative scenarios set out in paragraphs 8 and 9 of this article and report them to the authorised management for approval, so that policies and processes can be adjusted accordingly. The CRR institution shall take the necessary operational steps in advance to ensure that liquidity recovery plans can be implemented immediately. For credit institutions, such operational steps shall include in particular the holding of collateral immediately available for central bank funding. This may include in particular, as the case may be, the holding of collateral in the currency of another Member State, or in the currency of a third country to which the CRR institution has exposures, and which is held, where operationally necessary, within the territory of a host Member State or of a third country to the currency of which the CRR institution is exposed. 7

COMMISSION de SURVEILLANCE du SECTEUR FINANCIER

Article 17 Risk of excessive leverage (1) The CRR institution shall have policies and processes in place for the identification, management and monitoring of the risk of excessive leverage. Indicators for the risk of excessive leverage shall include in particular the leverage ratio determined in accordance with Article 429 of Regulation (EU) No 575/2013 and mismatches between assets and obligations. (2) The CRR institution shall manage the risk of excessive leverage in a precautionary manner by taking due account of potential increases in the risk of excessive leverage caused by reductions of the CRR institution's own funds through expected or realised losses, depending on the applicable accounting rules. To that end, the CRR institution shall be able to withstand a range of different stress events with respect to the risk of excessive leverage. Chapter 3 Internal capital adequacy assessment process Article 18 Internal capital adequacy assessment process (1) The CRR institution shall have in place sound, effective and comprehensive strategies and processes to assess and maintain on an ongoing basis the amounts, types and distribution of internal capital that it considers adequate to cover the nature and level of the risks to which it is or might be exposed. Therefore, the CRR institution shall notably take into account the elements set out in the following two paragraphs. (2) With reference to the second paragraph of Article 9, where own funds requirements are based on a rating by an External Credit Assessment Institution (ECAI) or based on the fact that an exposure is unrated, this shall not exempt the CRR institution from additionally considering other relevant information for assessing its allocation of internal capital. (3) Internal capital shall be adequate to cover material market risks that are not subject to an own funds requirement as set out in Regulation (EU) No 575/2013. The CRR institution, which has, in calculating own funds requirements for position risk in accordance with Part Three, Title IV, Chapter 2, of Regulation (EU) No 575/2013, netted off its positions in one or more of the equities constituting a stock-index against one or more positions in the stock-index future or other stock-index product shall have adequate internal own funds to cover the basis risk of loss caused by a divergent development between the future's or other product's value and the value of the equities constituting the stock-index. The CRR institution shall also have such adequate internal capital where it holds opposite positions in stock-index futures which are not identical in respect of either their maturity or their composition or both. Where using the treatment in Article 345 of Regulation (EU) No 575/2013 ("Underwriting; Reduction of net positions"), the CRR institution shall ensure that it holds sufficient internal capital against the risk of loss which exists between the time of the initial commitment and the following working day. (4) The strategies and processes referred to in the first paragraph of this article shall be subject to regular internal review to ensure that they remain comprehensive and proportionate to the nature, scale and complexity of the activities of the CRR institution. 8

COMMISSION de SURVEILLANCE du SECTEUR FINANCIER

Chapter 4 Liquidity adequacy assessment process Article 19 Liquidity adequacy assessment process (1) The strategies, policies, processes and systems referred to in the first paragraph of Article 16 shall be such as to ensure that the CRR institution maintains at all times the level, composition and quality of liquidity buffers that it considers adequate to cover the nature and level of the liquidity risks to which it is or might be exposed. (2) The provisions referred to in the first paragraph of this article shall be subject to regular internal review to ensure that they remain comprehensive and proportionate to the nature, scale and complexity of the activities of the CRR institution. Chapter 5 Information to be provided by CRR institutions that use an internal approach for the calculation of own funds requirements according to Chapter 3 of Title II (credit risk) or Chapter 5 of Title IV (market risk) of Part Three of Regulation (EU) No 575/2013 Article 20 Benchmark portfolios CRR institutions permitted to use internal approaches for the calculation of risk weighted exposure amounts or own funds requirements except for operational risk shall report to the CSSF and to the EBA the results of the calculations of their internal approaches for their exposures or positions that are included in the benchmark portfolios defined by the EBA. They shall communicate to these authorities, separately from the aforementioned results, the results of the specific portfolios that the CSSF would have defined in consultation with the EBA. These reports shall be based on procedures, models, definitions and IT means defined by the EBA. The CRR institutions shall submit the results of their calculations, together with an explanation of the methodologies used to produce them, at an appropriate frequency, and at least annually. 9

COMMISSION de SURVEILLANCE du SECTEUR FINANCIER

Part III Prudential supervision Chapter 1 Supervisory review and evaluation process Article 21 Implementation of the supervisory review and evaluation process (1) For the purposes of the implementation of the supervisory review and evaluation process, the CSSF shall review the arrangements, strategies, processes and mechanisms implemented by the CRR institutions to comply with the LFS and this regulation, and Regulation (EU) No 575/2013, and shall evaluate, on the basis notably of the technical criteria defined in Article 22: (a) risks to which the CRR institutions are or might be exposed; (b) adequacy of the arrangements, strategies, processes and mechanisms implemented by CRR institutions and the own funds and liquidity held by them to ensure a sound management and coverage of their risks; (c) risks revealed by stress testing taking into account the principle of proportionality; and (d) risks that a CRR institution poses to the financial system taking into account the identification and measurement of systemic risk under Article 23 of Regulation (EU) No 1093/2010, or recommendations of the European Systemic Risk Board, where necessary. (2) The frequency and intensity of the review and evaluation referred to in the first paragraph shall be established taking into account the principle of proportionality and the systemic importance of the CRR institution. The frequency shall be at least annual for the CRR institutions covered by the supervisory examination programme referred to in Article 26(2). Article 22 Technical criteria for the supervisory review and evaluation (1) In addition to credit, market and operational risks, the supervisory review and evaluation pursuant to Article 21 shall include at least: (a) the results of the stress test carried out in accordance with Article 177 of Regulation (EU) No 575/2013 by CRR institutions applying an internal ratings based approach; (b) the exposure to and management of concentration risk by CRR institutions, including their compliance with the requirements set out in Part Four of Regulation (EU) No 575/2013 and Article 11 of this regulation; (c) the robustness, suitability and manner of application of the policies and procedures implemented by CRR institutions for the management of the residual risk associated with the use of recognised credit risk mitigation techniques; (d) the extent to which the own funds held by a CRR institution in respect of assets which it has securitised are adequate having regard to the economic substance of the transaction, including the degree of risk transfer achieved; (e) the exposure to, measurement and management of liquidity risk by CRR institutions, including the development of alternative scenario analyses, the management of risk mitigants (in particular the level, composition and quality of liquidity buffers) and the establishment of effective contingency plans. In this regard, the CSSF shall regularly carry out a comprehensive assessment of the overall liquidity risk management by CRR institutions and promote the development of sound internal methodologies. These reviews take into account the role played by CRR institutions in the financial markets; (f) the impact of diversification effects and how such effects are factored into the risk measurement system; (g) the results of stress tests carried out by CRR institutions using an internal model to calculate market risk own funds requirements under Part Three, Title IV, Chapter 5 of Regulation (EU) No 575/2013; (h) the geographical location of CRR institutions' exposures; 10

COMMISSION de SURVEILLANCE du SECTEUR FINANCIER

(i) the business model of the CRR institution; (j) the assessment of systemic risk, in accordance with the criteria set out in Article 21(1)(d); (k) the existence of an implicit support of a CRR institution to a securitisation; (l) the CRR institutions' exposures to the interest rate risk inherent in their non-trading activities; (m) the exposure of the CRR institutions to the risk of excessive leverage as reflected by indicators of excessive leverage, including the leverage ratio determined in accordance with Article 429 of Regulation (EU) No 575/2013. The adequacy of the leverage ratio and of the arrangements, strategies, processes and mechanisms, implemented by CRR institutions to manage the risk of excessive leverage, shall be assessed by taking into account the business model of the CRR institutions. (2) For the purposes of the determination to be made under Article 21(1)(b), the CSSF shall consider whether the valuation adjustments taken for positions or portfolios in the trading book, as set out in Article 105 of Regulation (EU) No 575/2013, enable the CRR institution to sell or hedge out its positions within a short period without incurring material losses under normal market conditions. (3) For the purposes of the determination to be made under Article 21(1)(b), the CSSF shall include governance arrangements of the CRR institutions, their corporate culture and values, and the ability of members of the management body to perform their duties. These reviews and evaluations shall notably be based on agendas and supporting documents for meetings of the management body and its committees, and the results of the internal or external evaluation of performance of the management body. (4) As a supplement to point (e) of the first paragraph of this article and by reference to the third paragraph of Article 16, the CSSF shall monitor developments in relation to liquidity risk profiles, in particular product design and volumes, risk management, funding policies and funding concentrations. Article 23 Supervisory benchmarking of internal approaches for calculating own funds requirements The CSSF shall, on the basis of the information submitted by CRR institutions in accordance with Article 20 and of the assessment criteria set by the EBA, monitor the range of risk weighted exposure amounts or own funds requirements, as applicable, except for operational risk, for the exposures or transactions in the benchmark portfolio resulting from the internal approaches of those CRR institutions. At least annually, the CSSF shall make an assessment of the quality of those approaches paying particular attention to: (a) those approaches that exhibit significant differences in own funds requirements for the same exposure; (b) approaches where there is particularly high or low diversity, and also where there is a significant and systematic under-estimation of own funds requirements. Where particular CRR institutions diverge significantly from the majority of their peers or where there is little commonality in approach leading to a wide variance of results, the CSSF shall investigate the reasons thereof. Article 24 Ongoing review of the permission to use internal approaches (1) The CSSF shall review on a regular basis, and at least every three years, the CRR institutions' compliance with the requirements regarding approaches that require prior permission by the competent authorities before using such approaches for the calculation of own funds requirements in accordance with Part Three of Regulation (EU) No 575/2013. In particular, it shall have regard to the evolution of the activities of a CRR institution and to the implementation of those approaches to new products. For the review of the permissions it 11

COMMISSION de SURVEILLANCE du SECTEUR FINANCIER

grants to CRR institutions to use internal approaches, the CSSF shall take into account the analyses and benchmarks issued by the EBA for internal approaches. (2) For CRR institutions that use these approaches, the CSSF shall in particular review and assess whether the CRR institution uses well developed and up-to-date techniques and practices and shall ensure, having regard to the principle of proportionality, that the CRR institution does not solely or mechanistically rely on external credit ratings for assessing the solvency of an entity or financial instrument. Article 25 Supervisory stress testing The CSSF shall carry out, where necessary, but at least annually, supervisory stress tests on the CRR institutions it supervises, to facilitate the supervisory review and evaluation process under Article 21. Article 26 Supervisory examination programme (1) The CSSF shall, at least annually, adopt a supervisory examination programme for the CRR institutions it supervises. Such programme shall take into account the supervisory review and evaluation process under Article 21. It shall contain the following: (a) an indication of how the CSSF intends to carry out its tasks and allocate its resources; (b) an identification of the CRR institutions which it intends to subject to enhanced supervision and the measures taken for such supervision, as set out in the third paragraph of this article; (c) a plan for on-site inspections of the CRR institutions, including their branches and subsidiaries established in other Member States in accordance with applicable EU law. (2) The supervisory examination programme shall cover: (a) CRR institutions for which the results of the stress tests referred to in points (a) and (g) of Article 22(1) and Article 25, or the outcome of the supervisory review and evaluation process under Article 21, indicate significant risks to their financial soundness or indicate breaches of Regulation (EU) No 575/2013 and of the LFS, as well as their implementing measures; (b) CRR institutions that pose a systemic risk to the financial system; (c) any other CRR institution, if the CSSF deems it necessary. (3) Where appropriate under Article 21, the CSSF shall take, if necessary, the following measures: (a) an increase in the number or frequency of on-site inspections of the CRR institution; (b) a permanent presence of the CSSF at the CRR institution; (c) additional or more frequent reporting by the CRR institution; (d) additional or more frequent review of the operational, strategic or business plans of the CRR institution; (e) thematic examinations monitoring specific risks that are likely to materialise. (4) Adoption of a supervisory examination programme by the CSSF as the competent authority of the home Member State shall not prevent the competent authorities of the host Member State from carrying out, on a case-by-case basis, on-site inspections and checks of the activities carried out by branches of CRR institutions on their territory in accordance with the applicable EU law. (5) Adoption of a supervisory examination programme by the competent authority of the home Member State shall not prevent the CSSF as competent authority of the host Member State from carrying out, on a case-by-case basis, on-site inspections and checks of the activities carried out by branches of CRR institutions on Luxembourg territory in accordance with the applicable EU law. 12

COMMISSION de SURVEILLANCE du SECTEUR FINANCIER

Chapter 2 Supervisory measures and powers Section 1 General supervisory measures Article 27 General supervisory measures The CSSF shall require CRR institutions to take the necessary measures at an early stage to address relevant problems in the following circumstances: (a) the CRR institution does not meet the requirements of this regulation or Regulation (EU) No 575/2013; (b) the CSSF has evidence that the institution is likely to breach the requirements of this regulation or of Regulation (EU) No 575/2013 within the following 12 months. For the purposes of the first subparagraph and the measures taken to implement the first chapter, the CSSF shall have the powers referred to in Articles 53 and 53-1 of the LFS. Section 2 Specific supervisory measures Article 28 Specific own funds and liquidity requirements (1) For the purposes of determining the appropriate level of own funds on the basis of the review and evaluation carried out in accordance with Chapter 1 of Part III, the CSSF shall assess whether any imposition of an additional own funds requirement in excess of the own funds requirement is necessary to capture risks to which a CRR institution is or might be exposed, taking into account the following: (a) the quantitative and qualitative aspects of a CRR institution's assessment process referred to in Article 18; (b) a CRR institution's arrangements, processes and mechanisms referred to in Article 5; (c) the outcome of the supervisory review and evaluation carried out in accordance with Article 21 or 24; (d) the assessment of systemic risk. (2) For the purposes of determining the appropriate level of liquidity requirements on the basis of the review and evaluation carried out in accordance with Chapter 1 of Part III, the CSSF shall assess whether any imposition of a specific liquidity requirement is necessary to capture liquidity risks to which a CRR institution is or might be exposed, taking into account the following: (a) the particular business model of the CRR institution; (b) the CRR institution's arrangements, processes and mechanisms referred to in Part II and in particular in Article 16; (c) the outcome of the supervisory review and evaluation carried out in accordance with Article 21; (d) systemic liquidity risk that threatens the integrity of the financial markets of Luxembourg. The level of this specific liquidity requirement shall, if needed, broadly relate to the disparity between the actual liquidity position of a CRR institution and any liquidity and stable funding requirements established at national or EU level. 13

COMMISSION de SURVEILLANCE du SECTEUR FINANCIER

Article 29 Specific publication requirements (1) The CSSF may require CRR institutions: (a) to publish information referred to in Part Eight of Regulation (EU) No 575/2013 more than once per year, and to set deadlines for publication; (b) to use specific media and locations for publications other than the financial statements. (2) The CSSF may require parent undertakings to publish annually, either in full or by way of references to equivalent information, a description of their legal structure and governance and organisational structure of their group of CRR institutions, in accordance with Article 5(1a), Article 6(3), (4) and (16), the first and second subparagraphs of Article 17(1a) and Article 38(2) of the LFS. Article 30 Other specific requirements and arrangements (1) With reference to Article 21(1)(d), where a review shows that a CRR institution may pose systemic risk in accordance with Article 23 of Regulation (EU) No 1093/2010, the CSSF shall inform the EBA without delay about the results of the review. (2) With reference to Article 22(4), the CSSF shall take effective action where developments referred to in that article may lead to the instability of an individual CRR institution or of the system. The CSSF shall inform the EBA of any action taken. (3) With reference to Article 22(1)(k), if a CRR institution is found to have provided implicit support on more than one occasion, the CSSF shall take appropriate measures reflective of the increased expectation that the CRR institution will provide future support to its securitisation operations, thus preventing a transfer of significant risk. (4) With reference to Article 22(1)(l), the CSSF shall take measures at least in the case of CRR institutions whose economic value declines by more than 20% of their own funds as a result of a sudden and unexpected change in interest rates of 200 basis points or such change as defined in the EBA guidelines. (5) With reference to Article 23, the CSSF shall take corrective actions if it can be clearly established that a CRR institution's approach leads to an underestimation of own funds requirements which is not attributable to differences in the underlying risks of the exposures or positions. The CSSF shall ensure that its decisions on the appropriateness of corrective actions as referred to in the first subparagraph comply with the principle that such actions must maintain the objectives of an internal approach and therefore do not: (a) lead to the standardisation of, or the propensity to, certain methods; (b) create unjustified incentives; or (c) cause herd behaviour. (6) With reference to the review provided for in Article 24, where material deficiencies are identified in risk capture by a CRR institution's internal approach, the CSSF shall ensure they are rectified or take appropriate steps to mitigate their consequences, in particular by imposing higher multiplication factors, or imposing additional own funds requirements, or taking other appropriate and effective measures. If a CRR institution has received permission to apply an approach that requires prior permission by the competent authorities before using such an approach for the calculation of own funds requirements in accordance with Part Three of Regulation (EU) No 575/2013 but does not meet the requirements for applying such approach anymore, the CSSF shall require the CRR 14

COMMISSION de SURVEILLANCE du SECTEUR FINANCIER

institution to either demonstrate to the satisfaction of the CSSF that the effect of non￾compliance is immaterial, as the case may be, in accordance with Regulation (EU) No 575/2013 or present a plan for the timely restoration of compliance with the requirements and set a deadline for its implementation. The CSSF shall require improvements to that plan if it is unlikely to result in full compliance or if the deadline is inappropriate. If the CRR institution is unlikely to be able to restore compliance within an appropriate deadline and, as the case may be, has not satisfactorily demonstrated that the effect of non-compliance is immaterial, the permission to use the approach shall be revoked or limited to compliant areas or those where compliance can be achieved within an appropriate deadline. In particular, if for an internal market risk model numerous overshootings referred to in Article 366 of Regulation (EU) No 575/2013 reveal that the model is not or is no longer sufficiently accurate, the CSSF shall revoke the permission for using the internal model or impose appropriate measures to ensure that the model is improved promptly. The measures referred to in the previous three subparagraphs shall be applied in compliance with the provisions of EU law as regards co-operation between competent authorities. Section 3 Application of supervisory measures to CRR institutions with similar risk profiles Article 31 Application of supervisory measures to CRR institutions with similar risk profiles (1) Where the CSSF determines under Article 21 that CRR institutions with similar risk profiles resulting from similar business models or the geographical location of exposures, are or might be exposed to similar risks or pose similar risks to the financial system, it may apply to these CRR institutions, in a similar or identical manner, the supervisory review and evaluation process referred to in Article 21 as well as the general and specific supervisory measures set out in Sections 1 and 2 of this chapter and the prudential requirements laid down in Article 53-1 of the LFS. The types of CRR institution referred to in the first subparagraph may in particular be determined in accordance with the criteria referred to in Article 22(1)(j). (2) If it applies the first paragraph, the CSSF shall inform the EBA thereof. Luxembourg, 31 July 2015 COMMISSION DE SURVEILLANCE DU SECTEUR FINANCIER Claude SIMON Andrée BILLON Simone DELCOURT Jean GUILL Director General 15

COMMISSION de SURVEILLANCE du SECTEUR FINANCIER

16 EXPLANATORY MEMORANDUM Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (hereinafter "CRDIV"), was transposed into Luxembourg law by the law of 23 July 2015 which amends, among other things, the law of 5 April 1993 on the financial sector (hereinafter "CRDIV Law"). Certain provisions of CRDIV relating to the supervisory review and evaluation process ("Pillar II" provisions), deemed too granular to be inserted in the CRDIV Law, still need to be transposed. The purpose of this regulation (hereinafter "Pillar II CSSF Regulation") is to ensure the faithful transposition of these provisions into Luxembourg law. The CSSF adopts the Pillar II CSSF Regulation in its capacity as competent authority in accordance with Articles 42, 43 and 53-1 of the law of 5 April 1993 on the financial sector, as amended.