Requirements Applicable to Special Approved Statutory Auditor for Credit Institutions Issuing Covered Bonds

Circulaire CSSF 26/907 Requirements Applicable to the Special Approved Statutory Auditor for Credit Institutions Issuing Covered Bonds

CIRCULAIRE CSSF 26/907 2/7 Circulaire CSSF 26/907 Requirements Applicable to the Special Approved Statutory Auditor for Credit Institutions Issuing Covered Bonds

To all credit institutions issuing covered bonds within the meaning of Article 1, point 15) of the amended Law of 8 December 2021 and to special approved statutory auditors Luxembourg, 18 February 2026

Dear Madam, Dear Sir,

This circular clarifies the requirements applicable, regarding specific supervision of covered bond issuances, to credit institutions issuing within the meaning of Article 1, point 15) of the amended Law of 8 December 2021 on the issuance of covered bonds (hereinafter "the Law") transposing Directive (EU) 2019/2162 on covered bonds and public supervision of covered bonds and implementing Regulation (EU) 2019/2160 amending Regulation (EU) No 575/2013 as regards exposures in the form of covered bonds, as well as the requirements applicable to their special approved statutory auditor ("SASA"), referred to in particular in Article 17 of the Law.

Articles without legislative reference refer to the Law.

1. Clarifications on the conditions to be met by the SASA

Pursuant to Article 17 of the Law, every issuing credit institution is required to appoint a SASA and submit it for CSSF authorization. The CSSF considers that:

i. only a statutory auditor or an approved audit firm in accordance with the requirements of the Law of 23 July 2016 on the audit profession may exercise the mandate of SASA under the Law; ii. the SASA must possess the skills and knowledge necessary to carry out its audit tasks; iii. issuing credit institutions designate and communicate to the CSSF for approval the name of a statutory auditor or, in the case of an approved audit firm, one or more lead audit partners acting as the main persons responsible for the SASA mandate; iv. a statutory auditor or partners of the same approved audit firm cannot simultaneously hold the functions of SASA and statutory auditor who performs the statutory audit of the accounts.

2. SASA Mission before the issuance of covered bonds

Pursuant to Article 17, paragraph 6, of the Law, the SASA is required to issue a certificate attesting to the existence of the legally required coverage and its registration in the mortgage register in accordance with the provisions of the Law (hereinafter the "Certificate").

CIRCULAIRE CSSF 26/907 3/7

The requirements regarding the existence of the legally required coverage, namely that the coverage assets are duly constituted and reach the prescribed amounts, are described in section 4 points i) and iii) of this circular. The requirements regarding registration in the mortgage register are described in section 4 point ii) of this circular.

In order to allow verification of these requirements prior to the issuance of covered bonds, the Certificate consists of the following reports prepared by the SASA:

i. Limited Assurance Report by Issuance Program

The SASA prepares a limited assurance report intended for the issuing credit institution in accordance with the international standard ISAE 3000 (revised)1. This report presents its conclusion regarding the fact that, based on the procedures implemented and sufficient and appropriate evidence obtained, nothing has come to its attention that calls into question whether the contemplated issuance of covered bonds under the relevant issuance program is compliant, in all its significant aspects, with the requirements regarding the existence of coverage described in section 4 points i) a, b, c, e, f, g, h, i, j and k and iii) b of this circular and those regarding registration in the mortgage register described in section 4 point ii) of this circular.

It is for the SASA to determine the nature, timing, and extent of the necessary diligence to achieve the objectives of the mission. The procedures selected must be adapted to the risks of material misstatement identified, with regard to the criteria defined by the Law and by CSSF Regulation No 25-03 (hereinafter the "Regulation").

This limited assurance report will be prepared no later than 15 days before the contemplated issuance date of the first tranche of covered bonds under the program in question and submitted to the CSSF prior to the issuance of this first tranche.

ii. Agreed-Upon Procedures Report by "Tranche" of the Issuance Program

The SASA prepares an agreed-upon procedures report intended for the issuing credit institution in accordance with the international standard ISRS 4400. This report presents the procedures performed as well as any exceptions regarding the requirements regarding the existence of coverage described in section 4 point i) b, c, d, f, g, i and j and iii) a and c of this circular and those regarding registration in the mortgage register described in section 4 point ii) of this circular.

It is for the SASA to determine the nature, timing, and extent of the necessary diligence to achieve the objectives of the mission.

This agreed-upon procedures report from the SASA is required for each of the tranches of the issuance program. The issuing credit institution submits this report to the CSSF prior to the issuance of each tranche of covered bonds.

The limited assurance report provided for in section 2 point i) of this circular is not intended to be updated for each issuance of a tranche of covered bonds.

1 Other assurance engagements other than audits or reviews of historical financial information, published by the IAASB (International Auditing and Assurance Standards Board).

CIRCULAIRE CSSF 26/907 4/7

3. Annual SASA Mission after the issuance of covered bonds

In application of Article 17, paragraphs 1 and 2, of the Law, the SASA is required to implement appropriate and sufficient audit procedures in order to obtain reasonable assurance that the issuing credit institution complies with the requirements of the Law as well as the Regulation, concerning:

• The covered assets of the covered bonds which, in accordance with the law, must: o be duly constituted; o be registered in the mortgage register; o reach the prescribed amount; and o continue to exist. • The estimation of immovable and movable assets serving as real security has been done sincerely and prudently and in accordance with the valuation methods and procedures of the Law and the Regulation. • The realization value of renewable energy generating assets serving as coverage assets has been determined sincerely and prudently and in accordance with the valuation methods and procedures of the Law and the Regulation.

The requirements regarding the fact that the coverage assets are duly constituted are described in section 4 point i. The requirements regarding the registration of coverage assets in the mortgage register are described in section 4 point ii). The requirements regarding the fact that the coverage assets reach the prescribed amount are described in section 4 point iii). The requirements regarding the fact that the coverage assets continue to exist are described in section 4 point iv). The requirements regarding the estimation of immovable and movable assets are described in section 4 point i). The requirements regarding the realization value of renewable energy generating assets are described in section 4 point i).

Within the framework of this mission, on an annual basis, the SASA prepares, in accordance with the international standard ISAE 3000 (revised), a reasonable assurance report intended for the issuing credit institution. This report presents its conclusion based on the assessment of the sufficiency and appropriateness of the evidence obtained. The diligence implemented, as well as the required elements, allow the SASA to express an opinion on the result of its mission, in conformity with the verifications and controls required by the Law.

For this purpose, it confirms for all covered bond issuances for which it has been mandated, that these satisfy, in all significantly important respects, the requirements imposed by the Law and the Regulation, namely the covered assets of the covered bonds:

• are duly constituted, including the valuation of movable, immovable, and renewable energy generating assets; • are registered in the mortgage register, including the prerogatives related to segregation; • reach the prescribed amount, including coverage and liquidity requirements; and • continue to exist, including the prerogatives related to retention and cancellation.

The annual report includes the information to be transmitted to the CSSF in the context of the issuance of covered bonds, as specified in CSSF Circular 25/895, notably the last quarterly statement (Q4) of the year, and on which the SASA provides reasonable assurance that the latter was prepared in accordance with this circular, for all covered bond issuance programs.

It is for the SASA to determine the nature, timing, and extent of the necessary diligence to achieve the objectives of the mission. The procedures selected are designed and executed in a manner to address the risks of material misstatement identified, with regard to the criteria defined by the Law and by the Regulation.

The issuing credit institution submits the SASA's report to the CSSF no later than 6 months after the closing of the accounting period.

4. Clarifications on coverage assets

The issuing credit institution is required to provide the SASA with a mandate covering, at a minimum, the following requirements:

i. Typologies of coverage assets used and conditions to be met to ensure they are duly constituted

a. Compliance with the conditions of Article 3 of the Law; b. Compliance of the typologies of assets serving as coverage with the requirements of Article 6, paragraphs 4, 5 and 6, of the Law; c. Compliance of the coverage assets with the conditions provided for in Article 7 paragraph 2, of the Law; d. Regarding coverage assets, compliance with the limits set out in Article 8 paragraphs 1, 2 and 3, of the Law; e. For physical assets used as security, compliance with the valuation criteria set out in Article 8, paragraph 4, of the Law, as well as the technical modalities fixed by the Regulation; f. If applicable, compliance of the coverage assets with the conditions provided for in Article 4, in particular the specific conditions applicable to European covered bonds (super-priority), which are detailed in Article 4, paragraph 1, second paragraph, of the Law, referring in particular to Article 129, paragraph 1, of Regulation (EU) No 575/2013, subject to compliance with the conditions referred to in Article 129, paragraphs 1bis to 3, of said Regulation; g. If applicable, compliance with the conditions for inclusion of claims resulting from derivative contracts in the coverage pool in accordance with the provisions of Article 7, paragraph 3, of the Law and the Regulation; h. If applicable, compliance with the requirements regarding the diversification of the coverage pool of Article 7, paragraph 4, of the Law; i. If applicable, compliance with the particular requirements of Article 12 of the Law; j. If applicable, compliance with the requirements regarding intragroup covered bond aggregation structures of Article 13 of the Law;

CIRCULAIRE CSSF 26/907 6/7

k. If applicable, in the case of renewable energy generating assets, the adequacy of the frequency of revaluation of the realization value with respect to the nature, facts, and particular circumstances of the underlying assets, in particular this revaluation takes place at least annually and is based on current market data and is done under adapted valuation assumptions, pursuant to Article 17, paragraph 2, second paragraph, of the Law.

ii. The coverage assets are registered in the mortgage register

a. The issuing credit institution must, in accordance with Article 15 of the Law, establish and maintain the mortgage register. In this context, the systems, processes, and procedures put in place by the issuing credit institution guarantee and allow verification that the maintenance of the register is performed and documented in accordance with the conditions, rules, and principles of valuation resulting from the Law and the Regulation. Coverage assets become part of the coverage pool from the moment the issuing credit institution registers them in the mortgage register; b. Compliance with the segregation of coverage assets from other assets held by the issuing credit institution as provided for in Article 7, paragraphs 1 and 3, point 3, of the Law, Article 5, paragraph 2, of the Law, Article 8, paragraph 5, of the Law, and Article 15 of the Law; c. Reconciliation of the amounts registered in the mortgage register with the periodic information to be transmitted to the CSSF in the context of the issuance of covered bonds and are, if applicable, derived from the accounting information used in the context of the preparation of the audited annual accounts of the issuing credit institution.

iii. The coverage assets reach the prescribed amount

a. Compliance with coverage requirements as well as compliance with the different regulatory ratios resulting from Articles 6, paragraphs 1, 2 and 3, and Article 9 of the Law; b. Adequacy of the process for determining payment flows for the needs to guarantee the liquidity of the coverage pool for the next 180 days, in accordance with Article 9 of the Law; c. Compliance with the global limits applicable to credit institutions referred to in Article 2, point 2°, of the Law.

iv. The coverage assets continue to exist

a. Compliance with the obligations provided for in Article 17, paragraph 3, first paragraph, of the Law, according to which a coverage asset registered in the mortgage register cannot be cancelled without the written agreement of the SASA, it being understood that the SASA is required to consent to the cancellation of registrations on the mortgage register provided that the remaining coverage assets following the cancellation are sufficient to cover the legal coverage requirements;

CIRCULAIRE CSSF 26/907 7/7

b. Compliance with Article 17, paragraph 3, second paragraph, of the Law pursuant to which the retention of registrations relating to assets in the mortgage register must be ensured; c. Compliance with the requirement that a coverage asset must not be cancelled if the different regulatory ratios resulting from Articles 6, 8 and 9 of the Law are no longer respected.

5. Entry into force and scope

This circular enters into force on the day of its publication. This circular applies to covered bonds issued after 7 July 2022.

Please accept, Madam, Sir, the assurance of our distinguished sentiments.

Pascale TOUSSING Director

Claude WAMPACH Director

Marco ZWICK Director

Jean-Pierre FABER Director

Claude MARX General Manager