Management committee report on the effectiveness of organisational measures and statement on periodic prudential reporting

NBB_2025_18 – 25 November 2025 Circular – Page 1/12 14 Boulevard de Berlaimont – 1000 Brussels +32 2 221 38 12 Company number: 0203.201.340 Brussels RLE www.nbb.be Circular Brussels, 25 November 2025 Reference: NBB_2025_18 Your contact:
Nicolas Strypstein
Tel. +32 2 221 44 74 – Mobile +32 494 53 38 90 nicolas.strypstein@nbb.be Management committee report on the effectiveness of organisational measures (including those applicable specifically to investment services and activities) and statement on periodic prudential reporting Scope1 Credit institutions, stockbroking firms, payment institutions, electronic money institutions, institutions providing support to central securities depositories, approved or designated financial holding companies and mixed financial holding companies and investment holding companies incorporated under Belgian law, as well as Belgian branches of the aforementioned institutions when the latter are incorporated under the law of a non-EEA country and Belgian branches of aforementioned institutions where the latter are incorporated under the law of an EEA country (restriction to provisions of general interest). Summary/Objectives This circular updates and replaces Circular NBB_2011_09 dated 20 December 2011 on (i) the assessment report by the senior management on the system of internal control, (ii) the assessment report by the senior management on internal controls in relation to investment services and activities and (iii) the statement by the senior management on periodic prudential reporting. Having regard to intervening changes2 in the prudential supervisory legislation and in order to reduce the administrative burden associated with preparing the reports mentioned in points (i) and (ii) above, these reports are replaced by a single “management committee report on the effectiveness of organisational measures”. The main changes compared to the former reports on internal control are:
i. revision of the scope ratione materiae;
ii. integration of the descriptive section of the former report on the system of internal control into the
governance memorandum so that the new report focuses solely on the effectiveness of organisational measures and the measures taken to remedy any shortcomings identified;
iii. integration of the report on specific organisational measures in relation to investment services and
activities into the general report on organisational measures; and
iv. alignment of the reporting framework with that of the governance memorandum.
1 Specific areas of application are specified in the body of the circular; these are more precise and take precedence. 2 Circular NBB_2011_09 was based on the former Banking Act of 22 March 1993, which referred to the report by senior management on internal control. This wording was revised in 2014, when the new Banking Act of 25 April 2014 was published, to refer to the “management committee report on the effectiveness of organisational measures”.

NBB_2025_18 – 25 November 2025 Circular – Page 2/12 This circular also clarifies the supervisory expectations concerning the statement on prudential reporting (extension to all prudential reporting). Dear Sir or Madam, This circular updates and replaces Circular NBB_2011_09 dated 20 December 2011 on (i) the report by senior management on the assessment of the system of internal control, (ii) the report by senior management on the assessment of internal control in relation to investment services and activities and (iii) the statement by senior management on periodic prudential reporting. Having regard to intervening changes in the prudential supervisory legislation and in order to reduce the administrative burden associated with preparing reports (i) and (ii) above, these reports are replaced by a management committee3 report on the effectiveness of organisational measures, which incorporates the management committee’s report on the effectiveness of organisational measures specifically for investment services and activities. The expectations of the supervisory authority (NBB/ECB) regarding this report are set out in the first
section of this circular. The content of the management committee’s statement on periodic prudential
reporting is specified in the second section.

1. Management committee report on the effectiveness of organisational measures
   1.1. Scope
   The following institutions are subject to the requirement of a management committee report on the effectiveness of organisational measures:
   − credit institutions;
   − Belgian branches of credit institutions incorporated under the law of an EEA country (limited to general good provisions); − Belgian branches of credit institutions incorporated under the law of a non-EEA country;6 − stockbroking firms; − Belgian branches of stockbroking firms incorporated under the law of an EEA country (limited to general good provisions); − Belgian branches of stockbroking firms incorporated under the law of a non-EEA country;9 − payment institutions; − Belgian branches of payment institutions incorporated under the law of an EEA country (limited to general good provisions); − electronic money institutions; 3 For purposes of this circular, if an institution does not have a management committee, the term “management committee” should be read as referring to “effective management”, i.e. persons with direct and decisive influence over the management of the institution’s activities. 4 Article 59 §2 of the Act of 25 April 2014 on the legal status and supervision of credit institutions (hereinafter the “Act of 25 April 2014”). 5 Articles 315, 316 and 326 of the Act of 25 April 2014. 6 Article 333 §1(7) of the Act of 25 April 2014 (reference to Article 59 of the same Act). 7 Article 59 §2 of the Act of 20 July 2022 on the legal status and supervision of stockbroking firms (hereinafter the “Act of 20 July 2022”). 8 Articles 211, 212 and 221 of the Act of 20 July 2022. 9 Article 226 of the Act of 20 July 2022. 10 Article 36 of the Act of 11 March 2018 on the legal status and supervision of payment institutions and electronic money institutions (hereinafter the “Act of 11 March 2018”). 11 Article 131 of the Act of 11 March 2018. 12 Article 180 of the Act of 11 March 2018.

NBB_2025_18 – 25 November 2025 Circular – Page 3/12 − Belgian branches of electronic money institutions incorporated under the law of an EEA country (limited to general good provisions);13 − institutions providing support to central securities depositories;14 − Belgian branches of foreign institutions providing support to central securities depositories;15 − approved or designated financial holding companies and mixed financial holding companies incorporated under Belgian law16; and − investment holding companies17.
1.2. Context
The supervisory legislation applicable to the abovementioned institutions provides that their statutory governing body and management committee are responsible for establishing a robust and adequate corporate governance system. In addition, this system must, pursuant to the applicable supervisory legislation, be subject to periodic monitoring, assessment and reporting. In particular, the following obligations apply:
a) The statutory governing body must:

• assess periodically, and at least once a year, the effectiveness of the institution’s organisational
  measures, including those relating specifically to investment services and activities; 18 and
• ensure the integrity of the accounting and financial reporting systems, including operational and
  financial control systems, and assess, at least once a year, the functioning of internal controls to ensure that they provide reasonable assurance as to the reliability of the financial reporting process and comply with the accounting rules in force. b) The management committee must:
• take the necessary actions to ensure compliance with and the implementation of organisational
  measures, including specific organisational measures for investment services and activities; 20 and
• report to the statutory governing body, the accredited statutory auditor and the supervisory authority
  (NBB/ECB) on the effectiveness of these organisational measures, including the specific organisational measures relating to investment services and activities. This circular deals solely with the procedures for the latter report, referred to as the “management committee report on the effectiveness of organisational measures” and focuses mainly on internal controls. In accordance with the supervisory legislation, the accredited statutory auditor assists with prudential supervision. As part of its duties to the financial institution, , the auditor must assess the internal controls put in place by the institution and communicate the findings of this assessment to the NBB/ECB.22 This assessment is based on the management committee's report on the effectiveness of organisational measures, without being an isolated assessment of the adequacy of the entire internal control 13 Article 218 of the Act of 11 March 2018. 14 Article 10 §5, paragraph 6, of the Royal Decree of 26 September 2005 on the legal status of settlement institutions and institutions treated as settlement institutions. 15 Article 36 of the Royal Decree of 26 September 2005 on the legal status of settlement institutions and institutions treated as settlement institutions (reference to Chapter II of the same Royal Decree, including Article 10). 16 Articles 168 and 205 of the Act of 25 April 2014. 17 Article 178 of the Act of 20 July 2022. 18 See Article 56 §1, first paragraph, of the Act of 25 April 2014 and equivalent provisions in other sectoral legislation. 19 See Article 58 §1 of the Act of 25 April 2014 and equivalent provisions in other sectoral legislation. 20 See Article 59 §1 of the Act of 25 April 2014 and equivalent provisions in other sectoral legislation. 21 See Article 59 §2, first paragraph, of the Act of 25 April 2014 and equivalent provisions in other sectoral legislation. 22 See Article 225, paragraph 1(1), of the Act of 25 April 2014 and equivalent provisions in other sectoral legislation.

NBB_2025_18 – 25 November 2025 Circular – Page 4/12 environment, taking into account all of the tasks of the approved auditor. The NBB/ECB expects the accredited statutory auditor in particular to examine whether the aforementioned report reflects the manner in which the members of the management committee proceeded to draft it and whether the report is based on sufficient documentation.
1.3. Concepts of organisation and internal control
The concept of “organisation” is very broad and covers a range of aspects described in the supervisory legislation24 and specified in the NBB’s Governance Manuals for the banking sector (Circular NBB_2022_23) and the stockbroking sector (Circular NBB_2024_04):

• an adequate management structure based, at the highest level, on a clear distinction between the
  institution’s effective management, on the one hand, and the control of that management, on the other, and providing, within the institution, for an adequate separation of functions and a well-defined, transparent and consistent system for the allocation of responsibilities;
• adequate organisational measures for administration and accounting as well as internal control,
  including a system of internal control that provides reasonable assurance regarding the reliability of financial reporting;
• effective procedures to identify, measure, manage, monitor and internally report the risks to which the
  institution may be exposed, including the prevention of conflicts of interest;
• adequate independent internal audit, risk management and compliance functions;
• an adequate integrity policy;
• a remuneration policy that ensures sound and effective risk management and prevents the taking of
  risks in excess of the tolerance level set by the institution;
• IT control and security mechanisms appropriate to the institution’s activities and sufficiently robust to
  ensure the security and authentication of information transfer methods, minimise the risk of data corruption and unauthorised access, and prevent information leaks in order to maintain data confidentiality at all times;
• an adequate internal alert system, in accordance with the legislation transposing Directive (EU)
  2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law, providing in particular for a specific, independent and autonomous channel to report breaches of the standards and codes of conduct applicable to the institution;
• the implementation of adequate business continuity measures to ensure the continuity of critical
  functions or their restoration as quickly as possible as well as, without prejudice to the specific requirements for investment services and activities, the resumption of the provision of normal services and the exercise of normal activities within a reasonable period of time. Specific attention should be paid to internal control. Internal control refers to the set of measures intended to ensure:
  − orderly and prudent conduct of business, guided by well-defined objectives; − cost-effective and efficient use of resources; − adequate knowledge and control of risks in order to protect assets; − the integrity and reliability of financial and management-related information; − compliance with laws and regulations as well as with internal policies, plans and procedures. The concept of internal control is further clarified in the NBB’s Regulation of 19 May 2015 on internal control and the internal audit function and Circular NBB_2015_21 on internal control and the internal audit function, which remain fully applicable. The supervisory authority expects the report to pay specific attention to the measures taken to ensure that the institution has internal controls and organisational measures in place to monitor its operational activities. 23 See Circular NBB_2024_12 / Accreditation of auditors and audit firms and the duty of cooperation of accredited statutory auditors (pages 27 and 54). 24 See Article 21 of the Banking Act of 25 April 2014 and equivalent provisions in other sectoral legislation.

NBB_2025_18 – 25 November 2025 Circular – Page 5/12 The supervisory authority also expects institutions to have a robust methodology and criteria for assessing the quality of the system of internal control. 25 The report on the effectiveness of the organisational measures shall specify the methodology and criteria used. The internal audit function may assist the management committee in establishing this methodology. The report on organisational measures should cover all of these aspects.
1.4. Changes compared to the former report on internal control
The main changes are:

• extension of the scope ratione materiae of the report on organisational measures, which now covers
  all areas falling within the concept of organisation (in particular the management structure, risk culture and integrity, remuneration, the IT infrastructure and ICT security);
• inclusion in the governance memorandum27 of the descriptive section previously included in the
  report on internal control, so that the report on the effectiveness of organisational measures now covers only assessment aspects. With regard to the description of internal control to be included in the governance memorandum, it should be noted that the level of detail is less than what was previously required in the report on internal control. Nevertheless, the NBB expects the descriptive information included in the governance memorandum to allow a good understanding of the organisation of internal control and the various components of the internal controls. The governance memorandum should therefore include a full description of this organisation and these controls as well as, where applicable, references or links to the internal policies and procedures in which this organisation and controls are described in more detail; 28 and
• an assessment focus on aspects relating to the effectiveness of the organisational measures taken
  and to be taken.
  1.5. Content of the report
  The objectives of the management committee’s report on the effectiveness of organisational measures are to:
• ensure that financial institutions verify compliance with the statutory and regulatory requirements
  relating to organisation as well as the effectiveness of the measures taken to ensure such compliance; 25 The supervisory authority recommends that financial institutions use the COSO framework or another methodology that is commonly accepted at national and international level, sufficiently substantiated and consistently applied. This methodology describes, in particular, the rules to be followed in terms of documentation and assessment. 26 The prudential supervisory legislation stipulates that the internal audit function shall provide the statutory governing body and the management committee with an independent assessment of the quality and effectiveness of the internal control, risk management and governance systems (see Article 39 of the Act of 25 April 2014 and equivalent provisions in other sectoral legislation). 27 The description of organisational measures (including internal controls) is thus henceforth to be included, for the most part, in the governance memorandum drawn up in accordance with the model annexed to the Governance Manuals for the banking sector and the stockbroking sector. It should be noted that the governance memorandum must be updated whenever there are significant changes to the management structure or organisation of the financial institution and should be reviewed at least once a year by the statutory governing body (see Articles 23 and 56 of the Banking Act of 25 April 2014 and equivalent provisions in other prudential supervisory legislation). With regard to payment institutions and electronic money institutions, the NBB’s uniform letter of 8 February 2022 to all registered payment institutions, electronic money institutions and limited electronic money institutions on qualitative reporting does not require the preparation of a governance memorandum. Therefore, for payment institutions and electronic money institutions, the description of organisational measures (including internal controls) should be included in the report on the effectiveness of organisational measures. In addition, for these institutions and having regard to the principle of proportionality, a simplified reporting framework has been established. This is set out in Annex 2 to this circular. 28 Financial institutions should ensure that the supervisory authority has an up-to-date version of these policies and procedures. These may be submitted via the NBB’s dedicated platform (see the new NBB circular on qualitative reporting by credit institutions and stockbroking firms) or on an ad hoc basis.

NBB_2025_18 – 25 November 2025 Circular – Page 6/12

• allow the NBB/ECB to monitor, where appropriate, implementation of the measures taken by the
  management committee to remedy any organisational shortcomings that may have been identified; and
• enable accredited statutory auditors to conduct their own assessment of the internal controls put
  in place by credit institutions and set out their conclusions on this subject in their report to the supervisory authority. The report consists of two parts:
  − an assessment; and
  − a statement of the measures taken or to be taken to remedy any shortcomings identified. The content of the report may be modified, in consultation with the NBB/ECB, depending on the nature, level and complexity of the institution’s activities (application of the principle of proportionality). The report is also expected to include a list of all work performed by the internal audit function over the past year or two years relating to the organisation of the financial institution and to summarise briefly the recommendations made and the follow-up actions taken.
  1.5.1. Assessment by the management committee
  The management committee shall assess the adequacy and functioning of the organisational measures and internal controls and report on the measures taken to remedy any shortcomings identified. This exercise shall take the form of a self-assessment covering all topics listed in Annex 1 to this circular (including the underlying policies and procedures). The supervisory authority expects the self-assessment to be sufficiently granular (topic by topic) rather than general in nature. Where self-assessment of an area results in a positive assessment of the adequacy of the measures taken having regard to the applicable regulatory requirements and based on the methodology and criteria selected by the management committee, the report may be limited to a statement to this effect. However, where shortcomings are identified in a particular area during the financial year and measures have been (or will be) taken to remedy the situation, the management committee shall clearly explain these shortcomings, the measures taken and the impact thereof on the overall (enterprise-wide) assessment. Any aspect giving rise to a qualified or negative assessment must be commented on in the report so that the statutory governing body, the accredited statutory auditor and the NBB/ECB can clearly identify the shortcomings detected and the timeline for remediation.
  1.5.2. Statement of measures taken and to be taken
  The management committee shall provide a list of the measures it has taken during the period under review with respect to organisation and internal control and the measures it intends to take to remedy any shortcomings identified. This list shall, insofar as possible, adhere to the structure set out in Annex 1 to this circular.
  1.6. Format of the report, reporting frequency and concise summary
  1.6.1. Format
  The outline set out in Annexes 1 or 2, as appropriate, to this circular constitutes a framework which should be used to the extent possible to assess the adequacy and functioning of organisational and internal control measures. This outline has been simplified compared to those annexed to Circular NBB_2011_09 and posted online along with the template for the governance memorandum annexed to the Governance Manuals for the banking and stockbroking firms sectors.

NBB_2025_18 – 25 November 2025 Circular – Page 7/12 Institutions shall adapt it to their organisation and the risks to which they are exposed. They shall ensure that they do not change the reporting format, so that the NBB/ECB can make comparisons over time and identify developments. Since the report now focuses on evaluating organisational arrangements and listing measures taken or to be taken to remedy any shortcomings identified, it is recommended that each year's report start “from scratch”. The use of “track changes” to identify changes made from one year to the next is therefore no longer relevant. In addition, the report should include an executive summary describing:

• the manner in which it was prepared and the functions involved in its drafting;
• a list of the most significant breaches, the measures taken to remedy them and the timetable for
  doing so;
• a list of the main changes to the report compared with the previous year’s version;
• where applicable, the reasons for any deviations from the outline 1 and 2 annexed to this circular.
  1.6.2. Frequency
  The reporting frequency is specified in the supervisory legislation. This frequency is either annual or biennial depending on the type of establishments concerned:
  Institutions subject to annual reporting - Significant credit institutions (subject to direct supervision by the ECB);
• Branches established in Belgium of credit institutions from
  a non-EEA Member State;
• Payment institutions;
• Branches established in Belgium of payment institutions
  belonging to an EEA Member State (provisions of general interest);
• Electronic money institutions; and
• Financial companies (mixed) governed by Belgian law at
  the head of a group that is subject to direct supervision by the ECB.
  Institutions subject to biennial reporting - Less significant credit institutions (not subject to direct supervision by the ECB);
• Branches established in Belgium of credit institutions from
  an EEA Member State (provisions of general interest; NB:
  annual reporting for branches of significant importance);
• Stockbroking firms;
• Branches established in Belgium of stockbroking firms
  from an EEA Member State (provisions of general interest;);
• Branches established in Belgium of stockbroking firms
  from a non-EEA Member State;
• Institutions providing support to a central securities
  depository;
• Branches established in Belgium of foreign institutions
  providing support to a central securities depository;
• Financial companies (mixed) governed by Belgian law at
  the head of a group that is not subject to direct supervision by the ECB; and
• Investment holding companies.
  More specifically, the report is sent to the NBB/ECB and the accredited statutory auditor on 1 February for institutions subject to annual reporting and on 1 April for institutions subject to biennial reporting.

NBB_2025_18 – 25 November 2025 Circular – Page 8/12
1.6.3. Concise summary (for institutions subject to biennial reporting)
As mentioned in the section above, the supervisory legislation provides for biennial reporting by certain financial institutions. For years when a full report is not required, a concise summary shall be submitted. This must contain:
− a summary of significant developments and changes during the reference year; − a statement by the management committee formally confirming that the organisation and measures taken comply with the statutory and regulatory provisions. This concise summary must also be provided to the statutory governing body, the accredited statutory auditor and the supervisory authority31 and comply with the practical arrangements set out above (e.g. it must be signed by the chairperson of the management committee). The supervisory authority reminds institutions that, pursuant to the supervisory legislation (see, for example, Article 135 of the Act of 25 April 2014), it may request a full report on an ad hoc basis at any time and by way of derogation from the aforementioned biennial frequency, if this proves necessary for supervisory purposes. This could be the case, for example, if an institution is affected by specific events (e.g. a significant change in its activities, a merger or restructuring) or if certain problems arise within it (e.g. non-compliance with the prudential sectoral acts or the imposition of a remedial period).
1.6.3. Consolidated reporting
The obligation to draw up a report on the effectiveness of organisational measures applies to both individual institutions and on a consolidated basis, bearing in mind that the supervisory authority (NBB/ECB) allows supervised entities within a group to combine their reports on the effectiveness of organisational measures into a single report, provided the scope of (sub)consolidation is clearly specified. 33 This approach does not detract from the responsibility of the management committee of each supervised entity to comply with its statutory obligations, including in terms of reporting to the statutory governing body, the accredited statutory auditor and the supervisory authority. Approved or designated financial holding companies and mixed financial holding companies34 are not required to report on an individual basis but must prepare a consolidated report. 29 Including in relation to investment services or activities. 30 If a significant but minor/negative change that does not affect compliance is identified when this statement is issued, a brief comment must be appended to the statement to facilitate understanding of the shortcoming. 31 Insofar as the concise summary also concerns investment services and activities, the supervisory authority will make this information available to the FSMA in accordance with the prudential supervisory legislation. 32 See the explanatory memorandum to the Act of 11 July 2021 transposing Directive 2019/878 of the European Parliament and of the Council of 20 May 2019, Directive 2019/2034 of the European Parliament and of the Council of 20 May 2019, Directive 2019/2177 of the European Parliament and of the Council of 27 November 2019, Directive 2019/2034 of the European Parliament and of the Council of 19 December 2019, and Directive 2021/338 of the European Parliament and of the Council of 16 February 2021 and containing miscellaneous provisions, Parl. House of Representatives, 2020-2021, Doc. 55 – 1999/001, p. 35. 33 The relevant aspects of parent companies and regulated subsidiaries included in the consolidated or sub￾consolidated report must be clearly identifiable. 34 Financial holding companies and mixed financial holding companies exempted by the NBB/ECB on the basis of
Article 212/2 of the Banking Act dated 25 April 2014 are not required to submit a report on the effectiveness of
organisational measures (or a report on the specific measures relating to investment services and activities) provided such a report has been submitted by the entity designated as responsible for the group. Exempt financial holding companies and mixed financial holding companies are required, however, to submit a statement on periodic prudential reporting. For more information, see Communication NBB_2022_30 on reporting expected from (mixed) financial holding companies governed by Belgian law following the modification of their supervisory regime in the Banking Law.

NBB_2025_18 – 25 November 2025 Circular – Page 9/12
1.7. Report on the effectiveness of specific organisational measures for investment
services and activities
1.7.1. Scope
The following institutions are required to report on the effectiveness of specific organisational measures for investment services and activities:
− credit institutions;
− Belgian branches of credit institutions governed by the law of a non-EEA country; − stockbroking firms; − institutions providing support to central securities depositories; − Belgian branches of institutions providing support to central securities depositories; − financial holding companies and mixed financial holding companies incorporated under Belgian law.
1.7.2. Inclusion of the management committee report on the effectiveness of specific
organisational measures for investment services or activities in the general report on the effectiveness of organisational measures The prudential supervisory legislation stipulates that institutions listed in point 1.7.1 above are required to have adequate policies and procedures to ensure compliance with the statutory provisions on investment services and activities. In practice, under the supervision of the statutory governing body, the management committee must take the necessary measures to ensure that the institution has:
A. appropriate rules applicable to personal transactions in financial instruments carried out by the institution, its directors, senior managers, employees, tied agents and representatives; B. adequate organisational and administrative measures to prevent conflicts of interest in relation to investment services and activities;
C. adequate measures to ensure the continuity of investment services and activities;
D. adequate measures to limit the operational risk associated with outsourcing; E. a database relating to its investment services and activities; F. adequate measures to ensure the protection of client assets. In this context, the management committee must draw up, at the frequency specified in the supervisory legislation, a report on the specific organisational measures and internal controls relating to investment services and activities. This report must be submitted to the statutory governing body, the accredited statutory auditor and the NBB/BCE. In accordance with the supervisory legislation, the supervisory authority makes this information available to the FSMA. The supervisory legislation allows this report to be included in the more general report on the effectiveness of organisational measures. It is nonetheless requested that this specific report form
Section 7 of the general report, in accordance with the outline set out in Annex 1 (this requirement is due
to the fact that this report must be made available to the FSMA).
35 It should be noted that payment and electronic money institutions are not required to prepare a report on the assessment of internal controls in relation to investment services and activities but are subject to a different qualitative reporting requirement, namely a report on the protection of the assets of the users of payment services. This report falls outside the scope of the present circular. 36 Article 59 §2 in conjunction with Articles 64 to 66 and 74/1 to 74/3 of the Act of 25 April 2014. 37 Article 333 of the Act of 25 April 2014 (reference to Article 59 of the same Act). 38 Article 59 §2 in conjunction with Articles 37 to 40, 68 to 73 and 82 of the Act of 20 July 2022. 39 Article 10 §5, paragraph 6, of the Royal Decree of 26 September 2005. 40 Article 36 of the Royal Decree of 26 September 2005 (reference to Chapter II of the same Royal Decree, including Article 10bis). 41 Articles 168 and 205 of the Act of 25 April 2014.

NBB_2025_18 – 25 November 2025 Circular – Page 10/12 The report must contain (i) an assessment of specific measures relating to investment services and activities (a self-assessment of the aforementioned topics A to F) and (ii) a statement of the measures taken and to be taken by the management committee in this area, in accordance, insofar as possible, with the outlines appended to this circular. In addition, the above rules on the report on the report on organisational measures apply mutatis mutandis to the report on specific organisational measures for investment services and activities.
2. Management committee statement on periodic prudential reporting
2.1. Scope of application
The following institutions are subject to the requirement to have a statement from the Management committee concerning periodic prudential reporting:
− credit institutions;
− Belgian branches of credit institutions incorporated under the law of an EEA country (limited to general good provisions); − Belgian branches of credit institutions incorporated under the law of an non-EEA country; − stockbroking firms ; − Belgian branches of stockbroking firms incorporated under the law of an EEA country; − Belgian branches of stockbroking firms incorporated under the law of a non-EEA country; − payment institutions; − electronic money institutions; − institutions providing support to central securities depositories; − financial holding companies and mixed financial holding companies incorporated under Belgian law, and − investment holding companies incorporated under Belgian law53.
2.2. Content and frequency
The supervisory legislation stipulates that the management committee shall submit to the NBB/ECB a statement on periodic prudential reporting at the end of the first half of the financial year and at the end of the financial year. The management committee thus declares to the NBB/ECB every six months that the institution’s periodic prudential returns comply with the statutory requirements. A copy of this statement is sent to the statutory governing body with a copy to the accredited statutory auditor. 42 Thus, the description of organisation measures for investment services and activities must be included in the governance memorandum. The extract from the governance memorandum on this subject will be made available to the FSMA. It should be noted that payment institutions and electronic money institutions are not required to prepare a report on the effectiveness of specific organisational measures for investment services and activities. It should also be noted that accredited statutory auditors must assess the internal controls implemented by the institution in relation to investment services and activities and communicate their findings on this subject to the NBB/ECB. 43 Article 106 §2 of the Act of 25 April 2014. 44 Article 317 of the Act of 25 April 2014 (reference to Article 106 of the same Act). 45 Article 335 §1(5) of the Act of 25 April 2014 (reference to Article 106 of the same Act). 46 Article 109 §2 of the Act of 20 July 2022. 47 Article 213 of the Act of 20 July 2022 (reference to Article 109, §2 of the same Act). 48 Article 227 of the Act of 20 July 2022 (reference to Article 109 of the same Act). 49 Articles 77 and 78 of the Act of 11 March 2018. 50 Article 197 of the Act of 11 March 2018. 51 Article 38, paragraph 2, of the Royal Decree of 26 September 2005. 52 Articles 168 and 208 of the Act of 25 April 2014. 53 Article 182 of the Act of 20 July 2022.

NBB_2025_18 – 25 November 2025 Circular – Page 11/12 The management committee declares to the NBB/ECB that the periodic returns it submits are consistent with the accounts and inventories. To this end, it is necessary that the returns be:
− complete, i.e. they must include all data contained in the accounts and inventories on which they are based, and − correct, i.e. they must correspond exactly to the accounts and inventories on which they are based. The management committee confirms that it has done the necessary to ensure that the abovementioned returns are prepared in accordance with the applicable instructions of the NBB/ECB and the accounting and valuation rules for preparation of the annual accounts or, for periodic returns that do not relate to the end of the financial year, the annual accounts for the last financial year. The management committee is now also required to declare that all prudential reporting to the supervisory authority complies with the applicable prudential rules and regulations and the instructions of the supervisory authority, is complete and accurately reflects the institution’s situation. This goes for both quantitative and qualitative reporting. If the management committee cannot make an unqualified statement to this effect, it shall specify the areas in which shortcomings have been identified and the measures that have been or will be taken to remedy them. A template is set out in Annex 3. Financial institutions are requested to adhere to this template. The statement shall be sent to the NBB/ECB no later than three months from the end of the reporting period concerned. A new statement shall be sent if the periodic returns are amended, indicating the reasons for the changes made.
3. Signing and submission of the management committee report on the
effectiveness of organisational measures and statement on periodic prudential reporting The report on the effectiveness of organisational measures must be validated by the institution’s management committee and signed by the chairperson of this committee or, where applicable, the person representing effective management. The statement on periodic prudential reporting must also be signed by the chairperson of the management committee or, where applicable, the person representing effective management. These documents must be transmitted to the supervisory authority (NBB/ECB) via the NBB Supervision portal. They must be drafted in Dutch, French or German, depending on the language of the linguistic region where the financial institution’s registered office is located. English is also accepted. For credit institutions directly supervised by the ECB, these documents should, insofar as possible, be drawn up in English to facilitate the transmission of information to the ECB.

---

NBB_2025_18 – 25 November 2025 Circular – Page 12/12 This circular repeals circular NBB_2011_09 and NBB letter 2015/11 dated 16/11/2015 with immediate effect. The above recommendations therefore apply to (i) the management committee's report on the effectiveness of organisational arrangements to be issued in 2026 (reference year 2025), (ii) the report on specific organisational arrangements for investment services and activities to be issued in 2026, and (iii) the statements concerning periodic prudential reporting to be issued in 2026, for all financial institutions covered by this circular, with the exception of payment and electronic money institutions, for which the application of the new rules is postponed by one year for the aforementioned reporting (i) (postponement to the report to be issued in 2027 – reference year 2026). In addition, specific arrangements are provided for reporting (i) above, ‘report on the effectiveness of organisational arrangements’ to be issued in 2026 (reference year 2025): as this reporting is broader than the former internal control report, sections 1 ‘Management structure’, 4 ‘Risk culture and integrity’, 5 ‘Remuneration’ and 6. ‘IT Infrastructure, ICT security and business continuity’ included in the template in Appendix 1 should not be assessed in 2026 but should be assessed for the first time in the report to be issued in 2027 (reference year 2026). A copy of this circular is being sent to the accredited statutory auditor(s) of your institution. Yours faithfully, Pierre Wunsch Governor Annexes
Annex 1 – Recommended outline for the management committee report on the effectiveness of
organisational measures (including those applicable specifically to investment services and activities) for credit institutions, stockbroking firms, institutions providing support to central securities depositories and financial holding companies and mixed financial holding companies incorporated under Belgian law, as well as Belgian branches of credit institutions governed by the law of a non-EEA country
Annex 2 – Recommended outline for the management committee report on the effectiveness of
organisational measures for payment institutions and electronic money institutions
Annex 3 – Template for the half-yearly/annual statement on periodic prudential reporting