Practical rules concerning the statutory audit mandate of the statutory auditors

CIRCULAR CSSF 22/826 AS AMENDED BY CIRCULAR CSSF 23/845 1/9 Circular CSSF 22/826 as amended by Circular CSSF 23/845 Practical rules concerning the statutory audit mandate of the statutory auditors

CIRCULAR CSSF 22/826 AS AMENDED BY CIRCULAR CSSF 23/845 2/9 Circular CSSF 22/826 as amended by Circular CSSF 23/845 Practical rules concerning the statutory audit mandate of the approved statutory auditors (réviseurs d’entreprises agréés) To all Luxembourg credit institutions and Luxembourg branches of non-EU credit institutions Luxembourg, 23 December 2022 Ladies and Gentlemen, The purpose of this circular is to define the scope of the statutory audit mandate and the content of the reports and written comments issued by the réviseur d’entreprises agréé (REA) in the context of its audit of the annual accounting documents (audit reports) prepared pursuant to Article 54(1) of the Law of 5 April 1993 on the financial sector, as amended (LFS). The circular also clarifies the REA’s reporting obligations under Article 54(3) of the LFS. The circular draws upon the provisions formerly contained in Circular CSSF 01/27. The latter was repealed by Circular CSSF 22/821 as of 31 December 2022.

CIRCULAR CSSF 22/826 AS AMENDED BY CIRCULAR CSSF 23/845 3/9 TABLE OF CONTENTS

1. Scope of application and legal basis 4
2. Mandate 4
3. Report on annual accounts 5
4. Reporting to the CSSF 6
5. Final provisions 7

CIRCULAR CSSF 22/826 AS AMENDED BY CIRCULAR CSSF 23/845 4/9

1. Scope of application and legal basis The provisions of this circular are applicable to credit institutions1 incorporated under Luxembourg law, including their branches, as well as Luxembourg branches of third-country credit institutions (institution). The provisions of this circular are not applicable to Luxembourg branches of EU credit institutions. For the purpose of this circular, the term “annual accounts” shall be understood as: • the balance sheet, the profit and loss account and the notes to the accounts, as drawn up by an institution on a statutory or consolidated basis, pursuant to Article 2(1) and Article 85(1) of the Law of 17 June 1992 relating to the accounts of credit institutions, as amended (Law on the accounts of banks) and according to the Luxembourg statutory format for annual accounts. • the statement of financial position, the statement of profit or loss and other comprehensive income, the statement of changes in equity, the statement of cash flows and the notes to the financial statements, pursuant to Article 76a of the Law on the accounts of banks. These documents shall constitute a composite whole. As concerns Luxembourg branches of non-EU credit institutions (third-country branches), the term “annual accounts” is to be understood as the final annual accounting information drawn up according to the Law on the accounts of banks with regard to the branches’ activities in Luxembourg. The requirements outlined in this circular are based on Article 54(1) of the LFS.
2. Mandate The institutions must give a written and detailed mandate to their REA, containing at least the following provisions:
3. The statutory audit of annual accounts as drawn up by an institution on a statutory or consolidated basis must be carried out in accordance with EU Regulation No 537/20142, the Law of 23 July 2016 concerning the audit profession, as amended (Audit Law) and with International Standards on Auditing (ISAs) and the International Code of Ethics for Professional Accountants, including the International Independence Standards, issued by the International Ethics Standards Board for Accountants (IESBA) as adopted for Luxembourg by the CSSF;
4. The statutory audit must cover, to the extent relevant for the purpose of the statutory audit of annual accounts and in line with the applicable auditing standards, the pertinent business 1 This circular applies to both significant supervised entities and less significant supervised entities as defined in Article 2, points (16) and (7) of Regulation (EU) No 468/2014 of the European Central Bank (ECB) of 16 April 2014, as amended(the SSM Framework Regulation) respectively. 2 Regulation (EU) No 537/2014 of the European Parliament and of the Council of 16 April 2014 on specific requirements regarding statutory audit of public-interest entities, as amended.

CIRCULAR CSSF 22/826 AS AMENDED BY CIRCULAR CSSF 23/845 5/9 areas of the institution, whether they are recorded on the balance sheet or as off-balance sheet items. The mandate given to the REA must not exclude a type of activity, a category of transactions or a specific transaction from the scope of the audit. Furthermore, the audit must encompass the banking risks, as well as the financial, organisational and internal control-related aspects of the institution pertaining to the annual accounts; 3. The mandate for the statutory audit of the institution must cover all the institution's branches abroad; 4. For the purpose of his statutory audit, the REA has to ensure that the account balance “Provisions” is not significantly misstated. The CSSF would like to highlight that as part of his/her diligence, the REA shall also cover the risk, in line with applicable International Standards on Auditing as adopted by the CSSF, that, if securities entrusted with the bank in its depositary/custody services would turn out to be unavailable for restitution, the corresponding provision would be adequately reflected in the audited accounts. In this context, the REA should ensure that the going concern assumption still applies to the audited entity. 5. In accordance with Article 111 of the Law on the accounts of banks, the institution which prepares the consolidated accounts for publication must have them audited by the REA to whom the audit of the annual accounting documents has been entrusted. The audit shall lead to the drawing-up of a report on consolidated accounts. The institutions and the REA must immediately inform the CSSF if the REA terminates his/her mandate before expiry of the term or if s/he decides not to renew his/her mandate. Institutions must also notify the CSSF of their duly justified intention to terminate the mandate of their REA or not to renew it. The CSSF will analyse, for each request to change the REA, the reasons for the envisaged change and will assess whether the institution’s management body has, during the selection procedure of the new REA, carefully assessed the adequacy of the competence and resources of the latter based on the type and volume of the institution’s activities and the nature and complexity of its internal systems. At the same time, the institutions shall transmit to the CSSF a copy of the mandate given to the new REA. 3. Report on annual accounts The provisions of the Law on the accounts of banks and the rules and instructions issued by the CSSF for the drawing-up of institutions' accounts shall be strictly complied with. Any departure requires the prior consent from the CSSF. Where an REA notifies an institution that s/he will give an opinion other than unqualified, or refuses to certify the accounts, this institution and his/her REA must immediately inform the CSSF thereon (cf. also Section 4 below on the Reporting to the CSSF) in accordance with Article 54 of the LFS.

CIRCULAR CSSF 22/826 AS AMENDED BY CIRCULAR CSSF 23/845 6/9 The REA must report, in accordance with the applicable auditing standards, the weaknesses and points needing improvement that s/he observed during the course of his/her statutory audit of annual accounts of an institution in a management letter addressed to the management of the institution. The observations of the REA must come with comments of the institution's management. The report of the REA on the annual accounts shall be submitted to the CSSF and, in case of a significant institution, to the ECB at least 2 weeks ahead of the ordinary general meeting of shareholders; the management letter (on a statutory or consolidated basis) shall be submitted within six months after the closure of the financial year. For Luxembourg branches of third-country credit institutions the report of the REA on the annual accounts and the management letter shall be submitted to the CSSF within six months after the closure of the financial year. Besides the report on the annual accounts, the institutions shall also spontaneously, and without being specifically requested to do so, communicate to the CSSF all the other documents issued by the REA during his/her statutory audit of annual accounts as referred above. The report of the REA on the annual accounts3 is subject to statutory publication together with the annual accounts and the management report4 it refers to, pursuant to Article 71 and Article 112 of the Law on the accounts of banks. 4. Reporting to the CSSF The REA shall report to the CSSF pursuant to Article 54(3) of the LFS. Such reporting shall not only relate to adverse effects in the short term (as it is the case for the certification of annual accounts) but also in the medium and long term (objective of the prudential supervision). Consequently, the REA shall communicate to the CSSF the information of which s/he became aware while carrying out his/her mission and which is relevant from a prudential point of view and/or likely to require an urgent action by the CSSF. The facts to be considered are, among others, items constituting a material infringement of legislation, affecting the continuous functioning of the institution or leading to refusal to certify the accounts or to reservations thereto. The REA is also required to promptly inform the CSSF of any fact or decision concerning an institution, and fulfilling the criteria enumerated in Article 54(3) of the LFS, of which s/he becomes aware while auditing the annual accounting documents or performing any other statutory task within an undertaking which is linked to that institution by a close link (as defined by Article 1, point (21) of the LFS). The legal requirement to report “promptly” the relevant information to the CSSF does not prevent the REA to consult first the institution’s management body, provided that the latter is not conflicted and that the discussion does not unduly delay the transmission of information to the CSSF. 3 As defined under point (1). 4 The management report should be understood as the management report defined under Article 70 of the Law on the accounts of banks or as the consolidated management report defined under Article 110 of the Law on the accounts of banks.

CIRCULAR CSSF 22/826 AS AMENDED BY CIRCULAR CSSF 23/845 7/9 As regards the communication modalities, it is understood that: • the reporting of the REA is carried out spontaneously, in written or oral form; in case of serious problems, it is recommended that the oral communications be followed by a written confirmation as quickly as possible; • the priority should be given to timely rather than precise and complete reporting in the first place; • in the reporting to the CSSF, the REA shall explicitly inform on the actual or possible problems noted. Examples of facts or decisions falling or likely to fall under the reporting obligation to the CSSF include, among others, the following: • major conflicts within the decision-making bodies of the institution; • non-compliance with the professional obligations notably as regards the prevention of money laundering and terrorist financing or the conduct of business rules; • unexpected departure of a key function holder; • major financial difficulties in a branch or subsidiary; • serious deficiencies in the internal control framework; • significant errors in the prudential reporting; • important and repeated exceeding of internal limits; • inappropriate assessment in relation to a contribution in kind; • inappropriate assessment in relation to credit risk; • granting of an interim dividend while the institution has insufficient or barely sufficient own funds; • important increase of the risks linked to the institution's activity; • important loss of depositors likely to create a liquidity problem; • major incidents in the IT organisation or infrastructure; • activity change without appropriate infrastructure; • non-compliance with the common procedures5 (e.g. qualifying holdings); • frauds likely to generate important losses; • important legal disputes; • inappropriate assessment in relation to a merger/split project of undertakings. As a reminder, Article 54(4) of the LFS guarantees that the disclosure in good faith to the CSSF by an REA of any fact or decision as referred to in paragraph 3 of that article shall not constitute a violation of the obligation of professional secrecy or a breach of any restriction on disclosure of information imposed by contract, and shall not expose that REA to liability of any kind. 5. Final provisions This circular shall apply as from 31 December 2022. 5 Procedures which are ultimately decided on by the ECB regardless of the significance of the credit institution concerned.

CIRCULAR CSSF 22/826 AS AMENDED BY CIRCULAR CSSF 23/845 8/9 Yours faithfully, Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General

CIRCULAR CSSF 22/826 AS AMENDED BY CIRCULAR CSSF 23/845 9/9 Commission de Surveillance du Secteur Financier 283, route d’Arlon L-2991 Luxembourg (+352) 26 25 1-1 direction@cssf.lu www.cssf.lu