CSSF Regulation No 16-13 on Reporting Infringements of the Law of 23 July 2016 and Regulation (EU) No 537/2014

In case of discrepancies between the French and the English text, the French text shall prevail. CSSF Regulation N° 16-13 relating to the reporting of infringements of the Law of 23 July 2016 concerning the audit profession and Regulation (EU) No 537/2014 on specific requirements regarding statutory audit of public-interest entities (Mémorial A – No 244 of 5 December 2016) The Executive Board of the Commission de Surveillance du Secteur Financier, Having regard to Article 108a of the Constitution; Having regard to the Law of 23 December 1998 establishing a financial sector supervisory commission ("Commission de surveillance du secteur financier"), and in particular Article 9(2) thereof; Having regard to the Law of 23 July 2016 concerning the audit profession, and in particular Article 36(7) thereof; Having regard to the opinion of the Consultative Committee for the Audit Profession; Decides: Article 1: Subject matter and definitions (1) The CSSF defines the rules specifying the mechanisms referred to in Article 36(7) of the Law of 23 July 2016 concerning the audit profession, in order to report to the CSSF presumed or actual breaches of the above-mentioned law or of Regulation (EU) No 537/2014 on specific requirements regarding statutory audit of public-interest entities. (2) For the purpose of this regulation, the following definitions shall apply: a. “Audit Law” means the Law of 23 July 2016 concerning the audit profession; b. “Regulation (EU) No 537/2014” means Regulation (EU) No 537/2014 of the European Parliament and of the Council of 16 April 2014 on specific requirements regarding statutory audit of public-interest entities; c. “reporting person” means a person reporting a presumed or actual breach of the Audit Law or of Regulation (EU) No 537/2014 to the CSSF; d. “reported person” means a person who is accused by the reporting person of having committed, or intending to commit, a breach of the Audit Law or of Regulation (EU) No 537/2014; and e. “report of breach” means a report submitted by the reporting person to the CSSF regarding a presumed or actual breach of the Audit Law or of Regulation (EU) No 537/2014. Article 2: Dedicated staff members (1) The CSSF shall assign dedicated members of its staff, hereinafter referred to as “dedicated staff members”, to handle reports of breaches. (2) Dedicated staff members shall exercise the following functions:

1. providing any interested person with information on the procedures for reporting breaches;
2. receiving and following-up reports of breaches;
3. maintaining contact with the reporting person where the latter has identified himself or herself. Article 3: Information regarding the receipt of reports of breaches and their follow-up (1) The CSSF shall publish on its website in a separate and accessible section the information regarding the receipt and the follow-up of reports of breaches.

2 (2) The CSSF shall establish independent and autonomous communication channels, which are both secure and ensure confidentiality, for receiving and following-up the reporting of breaches. (3) The CSSF shall also ensure that a report of breach received by means other than the communication channels referred to in paragraph 2 is promptly forwarded without modification to the dedicated staff members of the CSSF by using the communication channels referred to in paragraph 2. Article 4: Record-keeping of reports received (1) The CSSF shall keep records of every report of breach received in accordance with the Audit Law and Regulation (EU) No 537/2014. (2) The CSSF shall promptly acknowledge the receipt of written reports of breaches to the postal or electronic address indicated by the reporting person, unless the reporting person explicitly requested otherwise or where the CSSF reasonably believes that acknowledging receipt of a written report would jeopardise the protection of the reporting person’s identity. (3) Where an unrecorded telephone line is used for reporting of breaches, the CSSF shall have the right to document oral reporting in the form of accurate minutes of the conversation prepared by the dedicated staff members of the CSSF. In cases where the reporting person has disclosed his or her identity, the CSSF shall offer the possibility to the reporting person to check, rectify and agree with the minutes of the call by signing them. (4) Where a person requests a physical meeting with the dedicated staff members of the CSSF for reporting a breach, the CSSF shall ensure that complete and accurate records of the meeting are kept in a durable and retrievable form. The CSSF shall have the right to document the records of the physical meeting in the form of:

1. an audio recording of the conversation in a durable and retrievable form in accordance with the provisions in force regarding data protection; or
2. accurate minutes of the meeting prepared by the dedicated staff members of the CSSF. In cases where the reporting person has disclosed his or her identity, the CSSF shall offer the possibility to the reporting person to check, rectify and agree with the minutes of the meeting by signing them. Article 5: Protection procedures for personal data (1) The CSSF shall store the records referred to in Article 4 in a confidential and secure system. (2) Access to the system referred to in paragraph 1 shall be subject to restrictions ensuring that the data stored therein is only available to the CSSF staff members for whom access to that data is necessary to perform their professional duties. Article 6: Transmission of data inside and outside of the CSSF (1) The CSSF shall have in place adequate procedures for the transmission of personal data of the reporting person and reported person inside and outside of the CSSF. (2) The CSSF shall also ensure that the transmission of data related to a report of breach within or outside of the CSSF does not reveal, directly or indirectly, the identity of the reporting person or reported person or any other references to circumstances that would allow the identity of the reporting person or reported person to be deducted, unless such transmission is in accordance with the confidentiality rules applicable to the reporting of breaches. Article 7: Procedures for the protection of the reported persons (1) Where the identity of reported persons is not known to the public, their identity shall be protected at least in the same manner as for persons that are under investigation by the CSSF. (2) The procedures set out in Article 5 shall also apply for the protection of the identity of the reported persons.

3 Article 8: Review of the procedures by competent authorities The CSSF shall review its procedures for receiving reports of breaches and their follow-up regularly, and at least once every two years. In reviewing such procedures the CSSF shall take account of its experience and that of other competent authorities and adapt its procedures accordingly and in line with market and technological developments. Article 9: Publication This CSSF regulation shall be published in the Mémorial and on the website of the Commission de Surveillance du Secteur Financier. Luxembourg, 21 November 2016 COMMISSION DE SURVEILLANCE DU SECTEUR FINANCIER Jean-Pierre FABER Françoise KAUTHEN Claude SIMON Claude MARX Director General

4 EXPLANATORY MEMORANDUM This draft CSSF regulation is implementing the last subparagraph of Article 36(7) of the Law of 23 July 2016 concerning the audit profession. It describes the mechanisms to promote the reporting of infringements as well as the procedures for reporting infringements and the follow-up of the reports. The will of the European legislator was to ensure that the Member States have adequate arrangements to encourage whistleblowers to alert them to possible breaches of the above-mentioned law or Regulation (EU) No 537/2014 and to protect the whistleblowers from reprisals. These arrangements should be included in the mechanisms which allow the appropriate protection of the reported person, in particular regarding his or her right to personal data protection and the procedures for ensuring his or her rights to defence and his or her right to be heard before adopting a decision concerning him or her, as well as the right to challenge such decision before a Court. The implemented mechanisms should also ensure appropriate protection of whistleblowers, not only with respect to the right to personal data protection, but also by ensuring that they are not victims of undue reprisals. COMMENTS ON THE ARTICLES Comment on Article 1: Article 1 of this draft CSSF regulation specifies the subject matter and main definitions which are used in this regulation. Comment on Article 2: Article 2 of this draft CSSF regulation lays down that the CSSF shall appoint dedicated persons from among its agents in order to handle the reported breaches and shall specify the functions exercised by these persons. Comment on Article 3: Article 3 of this draft CSSF regulation indicates that the CSSF shall publicly disclose and make easily accessible information about the available communication channels with the CSSF and about the applicable procedures. Comment on Article 4: Article 4 of this draft CSSF regulation specifies that the CSSF shall ensure the adequate record-keeping of all reports of breaches and that every report is retrievable within the CSSF and that information received through reports could be used as evidence in enforcement actions, where appropriate. Comment on Article 5: Article 5 of this draft CSSF regulation sets out the rules of the CSSF in order to protect personal data during reports of breaches. Comment on Article 6: Transmission of personal data connected to reports of breaches by the CSSF could be necessary to evaluate a report of breaches and to undertake the necessary investigation and enforcement actions. When transmitting data within the CSSF or to third parties, the CSSF should preserve the confidentiality to the maximum extent possible in accordance with national law. Article 6 of this draft CSSF regulation aims at ensuring the appropriate transmission of data regarding reported breaches in accordance with the confidentiality rules applicable in Luxembourg. Comment on Article 7: Article 7 of this draft CSSF regulation aims to protect the identity of the reported persons. Comment on Article 8: Article 8 of this draft CSSF regulation provides for the regular and at least biennial (once every two years) review of the procedures for receiving and following-up reports of breaches in order to ensure

5 that the procedures are adequate and state of the art, and thus serving their purpose. For this purpose, it is important that the CSSF evaluates its own experiences. Comment on Article 9: No comment.