Circular CSSF 22/827 — Update of Circular CSSF 07/325 on EU credit institutions and investment firms in Luxembourg

CIRCULAR CSSF 22/827
1/18
Circular CSSF
22/827
UPDATE OF CIRCULAR CSSF
07/325 AS AMENDED BY
CIRCULAR CSSF 21/765 ON
PROVISIONS RELATING TO
CREDIT INSTITUTIONS AND
INVESTMENT FIRMS OF EU
ORIGIN ESTABLISHED IN
LUXEMBOURG BY WAY OF
BRANCHES OR EXERCISING
ACTIVITIES IN LUXEMBOURG
BY WAY OF FREE PROVISION
OF SERVICES

CIRCULAR CSSF 22/827
2/18
Circular CSSF 22/827
Re: Update of Circular CSSF 07/325 as amended by Circular CSSF 21/765 on provisions relating to credit institutions and investment firms of EU origin established in Luxembourg by way of branches or exercising activities in Luxembourg by way of free provision of services Luxembourg, 23 December 2022 To all credit institutions and investment firms Ladies and Gentlemen, The purpose of this circular is to amend Circular CSSF 07/325 on provisions relating to credit institutions and investment firms of EU origin established in Luxembourg by way of branches or exercising activities in Luxembourg by way of free provision of services, following the introduction of the revised long form report by Circular CSSF 22/821. The circular draws upon the provisions of the revised long form report and introduces a self-assessment questionnaire to be filled in on an annual basis by Luxembourg branches of credit institutions whose head office is in another Member State. The circular also modifies relevant regulatory references following (i) the latest updates made to the Law of 5 April 1993 on the financial sector and to the Law of 12 November 2004 on the fight against money laundering and terrorist financing, and (ii) the entry into force of Directive 2014/65/EU of the European Parliament and of the Council on markets in financial instruments (“MiFID II Directive”) which replaced Directive 2004/39/EC of the European Parliament and of the Council on markets in financial instruments. The MiFID II Directive was transposed into Luxembourg law by the Law of 30 May 2018 on markets in financial instruments. Please refer to the Annex for the details of the amendments to Circular 07/325. Yours faithfully, Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General
Annex: Circular CSSF 07/325, as amended by Circulars CSSF 21/765 and
CSSF 22/827

CIRCULAR CSSF 22/827
3/18
Annex - Circular CSSF 07/32 5 as amended by Circulars CSSF 21/765
and 22/827
Re: Provisions relating to credit institutions and investment firms of EU origin established in Luxembourg by way of branches or exercising activities in Luxembourg by way of free provision of services Dear Sir, Madam, This circular is issued pursuant to the transposition into Luxembourg law of Directive 2004/39/EC of the European Parliament and of the Council on markets in financial instruments (“MiFID Directive”) through the Law of 13 July 2007 on markets in financial instruments (“MiFID Law”) amending the Law of 5 April 1993 on the financial sector (“LFS”) and updates the circulars that existed in this field (IML 93/100, IML 98/147). The purpose of this circular is to provide further details on the principle of freedom of establishment by way of branches and free provision of services for credit institutions and investment firms whose head office is in another Member State. The MiFID Directive incorporates the principles that had already been set down in Directive 93/22/EEC on investment services in the securities field, such as the single authorisation recognised in all the Member States of the European Union. Nevertheless, it raises the level of harmonisation in order to ensure increased investor protection and to allow credit institutions and investment firms to provide their banking and investment activities/services in all Member States based on the principle of supervision by the home supervisory authority. For branches of credit institutions and investment firms of EU origin, certain fields of supervision, however, fall within the remit of the supervisory authority of the host Member State, considered as the authority that is the closest to the branch and better placed to detect problems and intervene in order to ensure compliance with the rules imposed on branches. The purpose of this circular is to provide additional information on the role of the CSSF as host authority and to point The circular also provides additional information on the role of the CSSF as host authority and points out to credit institutions and investment firms whose head office is in another Member State the provisions that their Luxembourg branches must comply with under Directive 2014/65/EU of the European Parliament and of the Council on markets in financial instruments (“MiFID II Directive”), which was transposed into Luxembourg law through the Law of 30 May 2018 on markets in financial instruments (“MiFID II Law”). Most of the requirements concern both credit institutions and investment firms. Nevertheless, in certain cases, the legislator purposely differentiated between both statuses. Luxembourg, 19 November 2007 To all credit institutions and investment firms In case of discrepancies between the French and the English text, the French text shall prevail.

CIRCULAR CSSF 22/827
4/18
Table of contents
I. Scope 5
II. Luxembourg branches of credit institutions or investment firms whose head
office is in another Member State established in Luxembourg (“the branch” or “the branches”) 6 II.1. Notifications in connection with the establishment of a branch 6 II.1.1 Notification procedure for credit institutions or investment firms whose head office is in another Member State wishing to establish a branch in Luxembourg 6 II.1.2 Changes to the notification 6 II.1.3 Opening of additional places of business 7 II.2 Branch infrastructure 7 II.3 General legal framework 8 II.4. Supervision of the branch 9 II.4.1 General provisions 9 II.4.2 Scope of the CSSF’s supervision 9 II.4.3 Instruments of supervision 10

1. Periodic reports to provide to the CSSF 10
2. External audit 13
3. On-the-spot inspections by the authority of the home
   country and the CSSF 14
   II.4.4 Measures to be taken by the CSSF in case of non-compliance by the branch with the Luxembourg provisions or in case of emergency 15
   III. Free provision of services in Luxembourg by credit institutions and investment
   firms whose head office is in another Member State 15 III.1. Notifications relating to the freedom to provide services 15 III.2 Non-compliance with the Luxembourg provisions by credit institutions or investment firms performing activities/services under the freedom to provide services in Luxembourg 16
   IV. Transitional provisions 16
   V. Repealing provisions and entry into force 16

CIRCULAR CSSF 22/827
5/18
I. Scope

1. The circular concerns applies to credit institutions whose head office is in another
   Member State1 and which provide in Luxembourg, by way of a branch or by free provision of services, activities covered by their authorisation as defined in AnnexeAnnex I to Directive 2006/48/EC relating2013/36/EU of the European Parliament and of the Council on access to the taking upactivity of credit institutions and pursuit of the businessprudential supervision of credit institutions (“CRD Directive”). Pursuant to the aforementioned AnnexeAnnex, the services and activities provided for in sections A and B of AnnexeAnnex I to the MiFID II Directive, when referring to the financial instruments provided for in section C of AnnexeAnnex I of that Directive, are subject to mutual recognition in accordance with the CRD Directive.
2. The circular also concerns investment firms whose head office is in another
   Member State and which provide in Luxembourg, by way of a branch or by free provision of services, investment services/activities covered by their authorisation as defined by section A of AnnexeAnnex I to the MiFID II Directive.
3. Where a credit institution or investment firm whose head office is in another
   Member State appoints a tied agent established in Luxembourg (as defined in articleArticle 4(1)(2529) of the MiFID II Directive) established in Luxembourg,), this tied agent shall be subject to the notification provisions of the LFS applicable to Luxembourg branches of credit institutions and investment firms of another Member State. For a credit institution or investment firm whose head office is in another Member State appointing a tied agent in Luxembourg while already having a branch there, the tied agent shall be considered as an additional business place of this branch, as described in point II.1. and will be listed on the CSSF website in the register of tied agents established in Luxembourg. For tied agents the provisions under point II.3. belowapply. 1 In accordance with articleArticle 1(14) of the LFS, “Member State” shall mean a Member State of the European Union. The States that are contracting parties to the European Economic Area Agreement other than the Member States of the European Union, within the limits set forth by this agreement and related acts are considered as equivalent to Member States of the European Union. “Another Member State” shall mean a Member State other than Luxembourg.

CIRCULAR CSSF 22/827
6/18
II. Luxembourg branches of credit institutions or investment firms whose
head office is in another Member State established in Luxembourg (“(the “branch” or the “branches”) II.1. Notifications in connection with the establishment of a branch II.1.1 Notification procedure for credit institutions or investment firms whose head office is in another Member State wishing to establish a branch in Luxembourg
4. Article 30 of the Law of 5 April 1993 on the financial sector (“LFS”)LFS provides
that credit institutions or investment firms whose head office is in another Member State are permitted to establish themselves in Luxembourg by way of a branch after having performed in their home countryMember State the notification procedure as referred to in article 25Article 35 of the CRD Directive and article 32Article 35 of the MiFID II Directive and provided that their services/activities are covered by their authorisation and fall within AnnexeAnnex I to the CRD Directive or section A or B of AnnexeAnnex I to Directive 2004/39/EC of the European Parliament and of the Council on markets in financial instruments (“MiFID Directive”)MiFID Directive. An additional authorisation fromprocedure with Luxembourg authorities is not required.
5. Unless there is reason to doubt the adequacy of the administrative structure or
the financial situation of the requesting professional, taking into account the activities envisaged, the competent authority of the home countryMember State shall communicate to the CSSF the notification file submitted to that authority by the notifying institution within three months of receipt of that file at the most. The CSSF shall inform the institution on how the supervision will be performed in the fields falling under its competence and shall draw its attention on the conduct of business rules, as well as on the rules of general interest governing the exercise of those services/activities. The branch may commence business on receipt of that information or, failing such information, within two months from the date of transmission of the communication by the competent authority of the home Member State. The branch informs the CSSF of the date at which business commences, which will be the date on which it will be registered on the official list of credit institutions and investment firms respectively. II.1.2 Changes to the notification
6. Any change to the information to be provided in a notification as mentioned below
(article 32(2Article 35(10) of the MiFID II Directive and article 26Article 36(3) of the CRD Directive) shall be notified in writing at least one month before the change comes into force. The following information is concerned:
(a) the programme of operations stating inter alia the banking and investment or banking services/activities as well as the ancillary services which the branch intends to perform, and the organisational structure of the branch and the use, where applicable, of a tied agent;

CIRCULAR CSSF 22/827
7/18
(b) the address in the host Member State from which documents may be obtained; (c) the name of the person(s) responsible for the management of the branch.
7. In accordance with article 26Article 36(3) of the CRD Directive, credit institutions
shall notify any change referred to in point 6 to the competent authority of their home countryMember State as well as to the CSSF. On the other hand, in accordance with article 32(9Article 35(10) of the MiFID II Directive, investment firms shall notify any change as referred to in point 6 solely to the competent authority of the home Member State which shall communicate the change to the CSSF. II.1.3 Opening of additional places of business
8. A credit institution or investment firm of EU origin having a branch in Luxembourg
may freely open additional places of business without having to use the notification procedure referred to in point II.1.1 of this circular. In accordance with articleArticle 1(32) of the LFS, several places of business established in Luxembourg by a credit institution or investment firm whose head office is in another Member State are regarded as a single branch.
9. The credit institution or investment firm of EU origin shall designate one of the
places of business as the head office of the establishment in Luxembourg. The managers of this head office shall have authority over all the places of business established in Luxembourg and shall be the contacts of the CSSF. Where opening additional places of business constitutes a change of the programme of operations and/or implies a change in the address of the head place of business, the credit institution or investment firm of another Member State shall inform the competent authorities beforehand, in accordance with point 7 above, of the opening of additional places of business.
10. The head place of business shall transmit annually to the CSSF, by 31 January, a
list stating the addresses of the places of business that the branch has in Luxembourg. II.2 Branch infrastructure
1110. As opposed to the freedom to provide services, the establishment of a branch
implies the existence in Luxembourg of an operational unit ensuring a permanent physical presence of the credit institution or investment firm.

CIRCULAR CSSF 22/827
8/18
1211. On account of its geographical distance and its activity in specific markets, a
Luxembourg branch enjoys a certain functional independence from its head office in the home countryMember State. Moreover, in the exercise of its activities, it shall comply with certain specific rules that apply under the Luxembourg legislation. These factors, together with the CSSF’s right to monitor as hostsupervisory authority of the host Member State in accordance with its residual competences, imply that the branch, as an entity, must meet certain organisational and infrastructure requirements, as described below.

• The effective management of the branch must be exercised in Luxembourg in
  accordance with the rules and instructions set out by the head office of the branch. The branch in Luxembourg represents an operational entity whose staff numbers depend on the activities carried on. Another entity of the group may by no means enter into transactions on behalf of the Luxembourg branch.
• The credit institution or investment firm entrusts the management of the branch
  to one or more managers, of whom at least one must reside in Luxembourg Those persons must have adequate professional experience and competence.
• Any branch established in Luxembourg must have an administrative structure.
  All accounting and all transaction-related documents must be available at the branch. Records shall also include the recording of telephone conversations or electronic communications relating to, at least, transactions concluded when dealing on own account and the provision of client order services that relate to the reception, transmission and execution of client orders as well as those that are intended to result in such transactions, even if those conversations or communications do not result in the conclusion of such transactions or in the provision of client order services. In accordance with articleArticle 45(5) of the LFS, the branch shall arrange for records to be kept of all services/activities and transactions undertaken by it, in accordance with the period laid down in the LFS or the Commercial Code, which shall be sufficient to allow the CSSF to monitor compliance with the requirements under the LFS and, in particular, its obligations towards clients or potential clients, without prejudice to the possibility for the competent authority of the home Member State to have direct access to these records. II.3 General legal framework

1312. Branches shall respect the general legal framework (general laws, in particular
      as regards civil law, commercial law, labour law, AML/CFT law, law on the implementation of restrictive measures in financial matters and criminal law) applicable to all activities performed in Luxembourg. Moreover, by virtue of article 35(4) of the LFS, the branches are required to apply the Luxembourg standards adopted in relation to anti-money laundering and terrorist financing (cf. Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended, and Circular CSSF 05/211) and in relation to professional secrecy.

CIRCULAR CSSF 22/827
9/18
1413. Where a branch does not comply with these legal requirements, articleArticle
46(2) of the LFS authorises the CSSF to take the necessary steps as described in point 344541 below in order to remedy such situation. Articles 8-2 and 8-4 of the Law of 12 November 2004 on the fight against money laundering and terrorist financing (“the AML/CFT Law”) and Article 6(4) of the Law of 19 December 2020 on the implementation of restrictive measures in financial matters provide the CSSF with similar powers. II.4. Supervision of the branch II.4.1 General provisions
1514. The competent authorities of the home Member State shall be responsible for
the supervision of services/activities provided by the branch without prejudice to the provisions on the competences conferred upon the CSSF by the LFS or other sectoral legislation.
1615. The competent authorities of the home countryMember State and the CSSF
shall actively cooperate in the context of their respective supervisory missions; the arrangements for this cooperation may be fixed in bilateral Memoranda of Understanding between the authorities concerned. II.4.2 Scope of the CSSF’s supervision
1716. In accordance with articleArticle 45(4) of the LFS, the supervision of
investment services/activities and ancillary services which the branch provides in Luxembourg falls under the responsibility of the CSSF, which shall ensure that the branch complies with the obligations set out in articlesArticles 37-3 (conduct of business rules when providing investment services to clients), 37-5 (obligation to execute orders on terms most favourable to the client) and 37-6 (client order handling rules) of the LFS. Circular CSSF 07/307 provides further clarifications on this subject.
1817. The CSSF is also competent to ensure that the investment services/activities
and ancillary services provided by the branch in Luxembourg comply with the obligations set out in articles 26 (obligation for systematic internalisersArticles 14 to publish firm quotes), 27 (post-trade disclosure by credit institutions and investment firms) and 28 (obligation to uphold integrity 26 of Regulation (EU) No 600/2014 on markets, report transactions and maintain records) of the MiFID law. in financial instruments (“MiFIR”).
1918. In accordance with articleArticle 45(6) of the LFS, the branches shall provide
the CSSF, upon request, with the information necessary to the monitoring of their compliance with the standards applicable in Luxembourg for the cases provided for in points 17 16 and 18 17 above. The information to be provided by these branches is the same information as the CSSF requires for these purposes from credit institutions and investment firms authorised in Luxembourg.

CIRCULAR CSSF 22/827
10/18
2019. The supervision of the CSSF as described above is a limited exception to the
principle of supervision by the competent home authority of the home Member State, which remains responsible for the supervision of services/activities of branches established in Luxembourg as regards the services/activities performed within the territory of the home Member State of the credit institution or investment firm and all services/activities provided in another Member State. Indeed, all services/activities provided by a branch outside the Luxembourg territory are considered as services/activities performed by the credit institution or investment firm, and not by the branch established in Luxembourg.
2120. Branches dealing only with eligible counterparties, as defined in articleArticle
37-7 of the LFS, are exempted from the application of articlesArticles 37-3 (conduct of business rules), with the exception of its paragraph 2a, 37-5 (best execution) and 37-6(1) (client order handling rules) of the LFS (cf. Circular CSSF 07/307, point 41)..
22. As regards exclusively branches of credit institutions, article 45(3) of the LFS
entrusts the CSSF, in cooperation with the competent authority of the home Member State, with the supervision of the liquidity of these branches. For the performance of its responsibilities in this field, the CSSF requires these branches to provide it with the same information as provided by Luxembourg-incorporated credit institutions (article 45(6) of the LFS). II.4.3 Instruments of supervision

1. Periodic reports to provide to the CSSF
   (a) Requirement for branches to report transactions on financial instruments
2. In accordance with article 35(1Article 45(4) of the MiFID LawLFS, the CSSF is
   the authority competent for ensuring that the investment services provided and the investment /activities performed and ancillary services provided in Luxembourg by the Luxembourg branches of branch fulfil the obligations laid down in Article 26 of MiFIR. 232.As per the provisions of Article 14 of Delegated Regulation (EU) No 2017/590, credit institutions and investment firms authorisedinvestments firms that execute transactions shall report these transactions to the competent authority of the home Member State. Where transactions are executed wholly or partly through a branch of a credit institution or an investment firm established in another Member State. These branches must report their , the transactions to the CSSF.
3. As per the provisions of article 32(7) of the MiFID Directive, these branches shall
   report the transactions undertakenbe reported only once by them and considered as the credit institution or the investment services provided outside Luxembourgfirm to the competent authority of the home Member State.

CIRCULAR CSSF 22/827
11/18
243.As In accordance with CESR guidelines on reporting for branches (cf. Annexe 3:
CESR Level 3 Guidelines on MiFID Transaction reporting published on 29 May 2007, ref. CESR/07-301), the branches concerned may however choose toa result of these provisions, credit institutions and investment firms established in another Member State shall report to the CSSF in its capacity as competent authority of the hosttheir home Member State, all transactions, whether executed within the context of investment services providedthrough their branches established in Luxembourg or outside the territory of Luxembourg.. The CSSF will forward the appropriate information to the home Member State authorityreceive these transaction reports from the concerned competent authorities.
2524. Circular CSSF 07/30217/674 provides further clarifications on the obligation to
report transactions on financial instruments.
(b) Specific provisions relating to branches of credit institutions whose head office is in another Member State
2625. In accordance with articleArticle 45(6) of the LFS, the details and procedures
of the reporting by branches are indicated in the summary of periodic information to be provided by credit institutions to the CSSF, under point I.3 of Annexe 3 of circular CSSF 07/316 in Circular CSSF 14/593 as amended. 276.Luxembourg branches of credit institutions whose head office is in another Member State shall fill in and submit to the CSSF on a yearly basis a self￾assessment questionnaire (“SAQ”). This self-assessment questionnaireSAQ is based on the following powers of the CSSF to obtain information from branches in the context of its legal supervisory mandate:

• Article 53(1) paragraphs 2 and 8 of the LFS;
• Article 45(2) of the MiFID II Law;
• Article 58-5 of the Law of 10 November 2009 on payment services, on the
  activity of electronic money institution and settlement finality in payment and securities settlement systems;
• Article 147(2) of the Law of 17 December 2010 relating to undertakings for
  collective investment and Article 50(2) of the Law of 12 July 2013 on Alternative Investment Fund Managers;
• Article 62(1) of the Law of 13 July 2005 on institutions for occupational
  retirement provision in the form of pension savings companies with variable capital (SEPCAVs) and pension savings associations (ASSEPs). 287.The self-assessment questionnaireSAQ to be completed annually by branches consists of the following sections:

CIRCULAR CSSF 22/827
12/18
Section Description Exemptions
MiFID
Overview of the organisational and operational setup with regard to MiFID, as well as a description of investment services and financial instruments offered by the branches to their clients. This
section shall include information on
distribution and communication means and on the client database. Branches that did not provide any investment services or sell or advise in relation to structured deposits1 during the financial year. PSD 2 Overview of payment services and a description of the interface through which those payment services are offered to clients. Branches that did not provide any payment services during the financial year. Depositary bank Quantitative and qualitative overview of the UCI depositary function and the related services as well as a self￾assessment against the main legal requirements. Branches that did not provide depositary and related services.
298. The information communicated in the SAQ shall be accurate and as concise as
possible, while providing a true and fair view. The SAQ is available in digital form and will be adapted for subsequent financial years as required, including in response to developments of the legal and regulatory framework.
29. The SAQ must be reviewed and electronically signed by the authorised
management and transmitted via the CSSF eDesk portal within six months after the closure of the financial year.
30. Procedures and explanations on the practical modalities regarding the preparation
and transmission of the SAQ as well as the user guide “Authentication and user account management” are made available via the CSSF eDesk portal. (c) Specific provisions relating to branches of investment firms whose head office is in another Member State
27351. In accordance with articleArticle 45(6) of the LFS, branches must submit a
statistical balance sheet (and off-balance sheet) and a statistical profit and loss account. 1 Structured deposits are defined in Article 1(7c) of the LFS.

CIRCULAR CSSF 22/827
13/18
2. External audit
28362. The procedure for the external audit of branches’ accounts falls under the
competence of the homecompetent authorities of the home Member State.
29373. Branches are required, however, to have a review executed by an external
auditor in accordance with the provisions of this circular for specific subjects on which the CSSF maintains a control responsibility as hostsupervisory authority of their host Member State, in particular as regards compliance with the rules on the prevention of money laundering and compliance with the applicable conduct of business rules when providing investment services/activities as well as ancillary services to clients.
30. For the purpose of drawing up its report, the réviseur d’entreprises (statutory
auditor) shall apply mutatis mutandis the provisions applicable to the establishment of the annual long form audit report to comply with the professional obligations as regards the fight against money laundering and terrorist financing and the conduct of business rules when providing investment services. The report of the réviseur d'entreprises includes
384. The statutory auditor (réviseur d’entreprises agréé, “REA”) shall prepare on a
yearly basis a report on the compliance with the rules on the prevention of money laundering and the fight against terrorism (AML/CFT) and on the applicable conduct of business rules when providing investment services/activities as well as ancillary services to clients. The AML/CFT part of the report shall be basedfollow, as far as applicable, on the provisions of section 3.3 of Circular CSSF 22/821 on the long form report. while tThe part on the applicable conduct of business rules when providing investment services/activities as well as ancillary services to clients shall describe the arrangements under, and assess compliance with, the requirements incumbent on the branch pursuant to the scope of application defined in Article 37a of the LFS Article 37 of the LFS and principles laid down in Circular CSSF 07/307 concerning the conduct of business rules in the financial sector, as well as the fair application of internal procedures for the implementation of the conduct of business rules. This report shall include a description of the procedures and controls in place within the branch1 as well as an appraisal by the réviseur d'entreprises. The descriptive parts ofREA. Alternatively, to providing a single report covering both topics, the REA may provide two separate reports shall be made available to the réviseur d'entreprises by the branches.30. 1 The authorised management of the branch is responsible for providing the REA with the required information for the drafting of the descriptive parts of the report. The REA may include in its report descriptive elements directly provided by the branch’s authorised management, but s/he shall verify and ensure that these elements are correct and adequate. If needed, s/he may have to perform some amendments.

CIRCULAR CSSF 22/827
14/18
395.In accordance with articleArticle 54(2) of the LFS, the CSSF has the right to appoint the external auditor of the credit institution or investment firm to execute controls at the Luxembourg branch on subjects for which the CSSF is competent.
Article 8-2 of the AML/CFT Law and Article 6(4) of the Law on the implementation
of restrictive measures in financial matters provide the CSSF with similar powers.
314036. Where the CSSF decides to make use of this facility, it shall
communicate to the managers of the branch the terms of the mandate to be given to the auditors. The managers of the branch shall liaise with the auditor of the head office of the credit institution or investment firm or, where applicable, its local representative and organise the practical schedule of the audit. The branch shall communicate the audit report issued by the external auditor to the CSSF.
4137. The REA submits the report(s) to the branch, which shall submit it/them in
electronic form subsequently to the CSSF within six months after the closure of the financial year as described in Circular CSSF 19/731.
3. On-the-spot inspections by the competent authority of the home
countryMember State and the CSSF
324238. The competent home authorities of the home Member State may carry
on on-the-spot controls at the branches of credit institutions (articleArticle 45(7) of the LFS) and investment firms (articleArticle 45(9) of the LFS) established in Luxembourg whose head office is in another EU Member State, after having informed the CSSF. They may also request the CSSF to verify some information. In this case, the CSSF shall either carry out the verification itself or appoint an auditor or any other independent expert at the expenses of the branch.
4339. According to Article 9-2a(9) of the AML/CFT Law, the CSSF may act on a duly
reasoned and substantiated request from a competent home authority to carry out an investigation or on-site inspection, in the framework of its duties in the field of anti-money laundering and counter terrorist financing, of persons subject to their respective supervisory powers, subject to the following conditions:

• the investigation or on-site inspection does not adversely affect the
  sovereignty, security or public policy of the State of Luxembourg;
• the investigation or on-site inspection is not likely to impede proceedings
  initiated in Luxembourg in respect of the same facts and against the same persons;
• no final judgement has been delivered in relation to such persons for the same
  facts in Luxembourg;
• the competent home authority grants the same right to the CSSF; and
• the competent home authority provides guarantees of professional secrecy
  that are at least equivalent to the professional secrecy to which the CSSF is subject.

CIRCULAR CSSF 22/827
15/18
The CSSF may, upon request, allow the presence of staff of the competent home authority during the investigation or on-site inspection. The investigation or on￾site inspection shall, however, be subject to the overall control of the CSSF. Where the CSSF is not able to act on such a request, it has toshall inform the competent home authority thereof in as detailed a manner as possible. II.4.4 Measures to be taken by the CSSF in case of non-compliance by the branch with the Luxembourg provisions or in case of emergency
33440. Article 46 of the LFS describes the precautionary measures available to the
CSSF as supervisory authority of the host Member State.
34451. Paragraph (1) of that articleArticle provides that the CSSF shall refer to the
competent authority of the home Member State of the credit institution or investment firm whenever it has clear and demonstrable grounds for believing that one of its branches in Luxembourg is in breach of the obligations arising from the provisions of the LFS which do not confer powers on the CSSF. If the irregular situation persists, despite the measures taken by the competent authority of the home Member State of the credit institution or investment firm or because such measures prove inadequate, the CSSF may take, after informing the competent authority of the home Member State, all appropriate measures needed in order to protect investors or the proper functioning of the markets in Luxembourg.
35462. If a branch does not comply with the requirements of the LFS which confer
powers on the CSSF, the latter may address an injunction to the credit institution or the investment firm as provided for in articleArticle 59 of the LFS. If the credit institution or investment firm concerned fails to take the necessary steps, the CSSF shall take all appropriate measures to ensure that the credit institution or investment firm puts an end to the irregular situation. The CSSF shall inform the competent authority of the home Member State of the measures taken. If, despite the measures taken, the irregular situation persists, the CSSF may take, after having informed the competent authority of the home Member State, the appropriate measures to prevent or penalise further irregularities, or even prevent the credit institution or investment firm from initiating any new transaction in Luxembourg. Such measures shall be notified to the European Commission.
36473. Article 46(4) of the LFS provides that, in emergencies and before following the
procedure described in point 354642 above, the CSSF may take any precautionary measures necessary to protect the interests of depositors, investors or others to whom services are provided. Such measures shall be notified to the European Commission and to the competent authorities of the home Member State.
III. Free provision of services in Luxembourg by credit institutions and
investment firms whose head office is in another Member State III.1. Notifications relating to the freedom to provide services

CIRCULAR CSSF 22/827
16/18
37484. According to article 28Article 39(1) of the CRD Directive, any credit institution
whose head office is in another Member State wishing to exercise the freedom to provide services by carrying on its activities in Luxembourg for the first time shall notify the competent authorities of its home countryMember State of the activities it intends to carry on. These activities must be included in AnnexeAnnex I toof that Directive 2006/48/EC.
38495. According to article 31Article 34(1) and (2) of the MiFID II Directive, any
investment firm authorised and supervised by the competent authority of another Member State may exercise the freedom to provide investment services/activities as well as ancillary services in Luxembourg by way of the free provision of services, provided that such services/activities are covered by its authorisation. Ancillary services may only be provided together with an investment service/activity. The exercise of these services/activities is not subject to an additional authorisation by the CSSF. A mere communicationA notification to the competent authority of the home Member State is sufficient.
395046. The competent authority of the home countryMember State shall
transmit the notification of the institution to the CSSF within one month. The credit institution or investment firm may commence the provision of its services/activities in Luxembourg as soon as it is informed of this transmission.
405147. Any change in the initial details included in the notification must be
notified in writing to the competent authority of the home countryMember State at least one month before the implementation of this change, which will transmit it to the CSSF. III.2 Non-compliance with the Luxembourg provisions by credit institutions or investment firms performing activities/services under the freedom to provide services in Luxembourg
415248. The provisions of point 344541 of this circular also apply to credit
institutions and investment firms performing activities/services under the freedom to provide services in Luxembourg.
IV. Transitional provisions
42. Pursuant to article 71 of the MiFID Directive, credit institutions and investment
firms of another Member State, already authorised to provide investment services and activities in Luxembourg through the establishment of branches or by providing services may continue to perform their activities and provide their services in Luxembourg without having to submit a new notification at the entry into force of the MiFID law, on 1 November 2007.

CIRCULAR CSSF 22/827
17/18
43. However, where credit institutions or investment firms of another Member State
intend to exercise for the first time, as from 1 November 2007, new activities and services not covered by their existing passport in Luxembourg, they shall submit a notification for these new services/activities in accordance with articles 31 and 32 of the MiFID Directive to the competent authority of their home Member State.
V. Repealing provisions and entry into force
445349. This circular enters into force on 19 November 2007. Circulars IML
93/100 and IML 98/147 are repealed with effect on 19 November 2007. Yours faithfully, COMMISSION DE SURVEILLANCE DU SECTEUR FINANCIER Simone DELCOURT Arthur PHILIPPE Jean-Nicolas SCHAUS Director General

CIRCULAR CSSF 22/827
62
/18
Commission de Surveillance du Secteur Financier 283, route d’Arlon L-2991 Luxembourg (+352) 26 25 1 - 1 direction@cssf.lu www.cssf.lu