← Luxembourg

Submission of the revised long form report (LFR) through the S3 solution

Obsah (5)Article 1Article 36Article 35Article 45Article 54

Published on 3 January 2024 Email this Share this on LinkedIn Share this on Facebook Communiqué Submission of the revised long form report (LFR) through the S3 solution On 15 November 2023, the CSSF m

the CRD Directive.

  1. The circular also concerns investment firms whose head office is in another Member State and which provide in Luxembourg, by way of a branch or by free provision of services, investment services/activities covered by their authorisation as defined by section A of Annex I to the MiFID II Directive.
  2. Where a credit institution or investment firm whose head office is in another Member State appoints a tied agent established in Luxembourg (as defined in Article 4

(1)
(29)of the MiFID II Directive), this tied agent shall be subject to the notification provisions as described in point II.
  1. and will be listed on the CSSF website in the register of tied agents established in Luxembourg. For tied agents the provisions under point II.
  2. apply. II. Luxembourg branches of credit institutions or investment firms whose head office is in another Member State (the “branch” or the “branches”) II.
  3. Notifications in connection with the establishment of a branch II.1.
  4. Notification procedure for credit institutions or investment firms whose head office is in another Member State wishing to establish a branch in Luxembourg
  5. Article 30 of the Law of 5 April 1993 on the financial sector (“LFS”) provides that credit institutions or investment firms whose head office is in another Member State are permitted to establish themselves in Luxembourg by way of a branch after having performed in their home Member State the notification procedure as referred to in Article 35 of the CRD Directive and Article 35 of the MiFID II Directive and provided that their services/activities are covered by their authorisation and fall within Annex I to the CRD Directive or section A or B of Annex I of 1

Article 1(14) of the LFS, “Member State” shall mean a Member State of the European Union.

The States that are contracting parties to the European Economic Area Agreement other than the Member States of the European Union, within the limits set forth by this agreement and related acts are considered as equivalent to Member States of the European Union. “Another Member State” shall mean a Member State other than Luxembourg. CIRCULAR CSSF 07/325 as amended by Circulars CSSF 21/765, CSSF 22/827 and CSSF 25/898 4/13 the MiFID II Directive. An additional authorisation procedure with Luxembourg authorities is not required.

  1. Unless there is reason to doubt the adequacy of the administrative structure or the financial situation of the requesting professional, taking into account the activities envisaged, the competent authority of the home Member State shall communicate to the CSSF the notification file submitted to that authority by the notifying institution within three months of receipt of that file at the most. The CSSF shall inform the institution on how the supervision will be performed in the fields falling under its competence and shall draw its attention on the conduct of business rules, as well as on the rules of general interest governing the exercise of those services/activities. The branch may commence business on receipt of that information or, failing such information, within two months from the date of transmission of the communication by the competent authority of the home Member State. The branch informs the CSSF of the date at which business commences, which will be the date on which it will be registered on the official list of credit institutions or investment firms respectively. II.1.
  3. Changes to the notification Any change to the information to be provided in a notification as mentioned below (Article 35

(10)of the MiFID II Directive and Article 36
(3)of the CRD Directive) shall be notified in writing at least one month before the change comes into force. The following information is concerned: (
  1. a)the programme of operations stating inter alia the banking and investment services/activities as well as the ancillary services which the branch intends to perform, and the organisational structure of the branch and the use, where applicable, of a tied agent; (
  2. b)the address in the host Member State from which documents may be obtained; (
  3. c)the name of the person(
  4. s)responsible for the management of the branch. 7.

Article 36

(3)of the CRD Directive, credit institutions shall notify any change referred to in point 6 to the competent authority of their home Member State as well as to the CSSF. On the other hand,

Article 35(10) of the Mi

FID II Directive, investment firms shall notify any change as referred to in point 6 solely to the competent authority of the home Member State which shall communicate the change to the CSSF. II.1.

  1. Opening of additional places of business
  2. A credit institution or investment firm of EU origin having a branch in Luxembourg may open additional places of business without having to use the notification procedure referred to in point II.1.1 of this circular.

Article 1

(32)of the LFS, several places of business established in Luxembourg by a credit institution or investment firm whose head office is in another Member State are regarded as a single branch. 9. The credit institution or investment firm of EU origin shall designate one of the places of business as the main place of the establishment in Luxembourg. The managers of this main place shall have authority over all the places of business established in Luxembourg and shall be the contacts of the CSSF. Where opening additional places of business constitutes a change of the programme of operations and/or implies a change in the address of the main place of business, CIRCULAR CSSF 07/325 as amended by Circulars CSSF 21/765, CSSF 22/827 and CSSF 25/898 5/13 the credit institution or investment firm of another Member State shall inform the competent authorities beforehand,

point 7 above, of the opening of additional places of business. II.

  1. Branch infrastructure
  2. As opposed to the freedom to provide services, the establishment of a branch implies the existence in Luxembourg of an operational unit ensuring a permanent physical presence of the credit institution or investment firm.
  3. On account of its geographical distance and its activity in specific markets, a Luxembourg branch enjoys a certain functional independence from its head office in the home Member State. Moreover, in the exercise of its activities, it shall comply with certain specific rules that apply under the Luxembourg legislation. These factors, together with the CSSF’s right to monitor as supervisory authority of the host Member State

its residual competences, imply that the branch, as an entity, must meet certain organisational and infrastructure requirements, as described below. - The effective management of the branch must be exercised in Luxembourg

the rules and instructions set out by the head office of the branch. The branch in Luxembourg represents an operational entity whose staff numbers depend on the activities carried on. Another entity of the group may by no means enter into transactions on behalf of the Luxembourg branch. - The credit institution or investment firm entrusts the management of the branch to one or more managers, of whom at least one must reside in Luxembourg. These persons must have adequate professional experience and competence. - Any branch established in Luxembourg must have an administrative structure. All accounting and all transaction-related documents must be available at the branch. Records shall also include the recording of telephone conversations or electronic communications relating to, at least, transactions concluded when dealing on own account and the provision of client order services that relate to the reception, transmission and execution of client orders as well as those that are intended to result in such transactions, even if these conversations or communications do not result in the conclusion of such transactions or in the provision of client order services.

Article 45

(5)of the LFS, the branch shall arrange for records to be kept of all services/activities and transactions undertaken by it,

the period laid down in the LFS or the Commercial Code, which shall be sufficient to allow the CSSF to monitor compliance with the requirements under the LFS and, in particular, its obligations towards clients or potential clients, without prejudice to the possibility for the competent authority of the home Member State to have direct access to these records. II.

  1. General legal framework
  2. Branches shall respect the general legal framework (general laws, in particular as regards civil law, commercial law, labour law, AML/CFT law, law on the implementation of restrictive measures in financial matters and criminal law) applicable to all activities performed in Luxembourg. CIRCULAR CSSF 07/325 as amended by Circulars CSSF 21/765, CSSF 22/827 and CSSF 25/898 6/13
  3. Where a branch does not comply with these legal requirements, Article 46

(2)of the LFS authorises the CSSF to take the necessary steps as described in point 41 below in order to remedy such situation. Articles 8-2 and 8-4 of the Law of 12 November 2004 on the fight against money laundering and terrorist financing (“AML/CFT Law”) and Article 6
(4)of the Law of 19 December 2020 on the implementation of restrictive measures in financial matters provide the CSSF with similar powers. II.
  1. Supervision of the branch II.4.
  2. General provisions
  3. The competent authorities of the home Member State shall be responsible for the supervision of services/activities provided by the branch without prejudice to the provisions on the competences conferred upon the CSSF by the LFS or other sectoral legislation.
  4. The competent authorities of the home Member State and the CSSF shall actively cooperate in the context of their respective supervisory missions; the arrangements for this cooperation may be fixed in bilateral Memoranda of Understanding between the authorities concerned. II.4.
  5. Scope of the CSSF’s supervision 16.

Article 45

(4)of the LFS, the supervision of investment services/activities and ancillary services which the branch provides in Luxembourg falls under the responsibility of the CSSF, which shall ensure that the branch complies with the obligations set out in Articles 37-3 (conduct of business rules when providing investment services to clients), 37-5 (obligation to execute orders on terms most favourable to the client) and 37-6 (client order handling rules) of the LFS. 17. The CSSF is also competent to ensure that the investment services/activities and ancillary services provided by the branch in Luxembourg comply with the obligations set out in Articles 14 to 26 of Regulation (EU) No 600/2014 on markets in financial instruments (“MiFIR”). 18.

Article 45

(6)of the LFS, the branches shall provide the CSSF, upon request, with the information necessary to the monitoring of their compliance with the standards applicable in Luxembourg for the cases provided for in points 16 and 17 above. The information to be provided by these branches is the same information as the CSSF requires for these purposes from credit institutions and investment firms authorised in Luxembourg.
  1. The supervision of the CSSF as described above is a limited exception to the principle of supervision by the competent authority of the home Member State, which remains responsible for the supervision of services/activities of branches established in Luxembourg as regards the services/activities performed within the territory of the home Member State of the credit institution or investment firm and all services/activities provided in another Member State. Indeed, all services/activities provided by a branch outside the Luxembourg territory are considered as services/activities performed by the credit institution or investment firm, and not by the branch established in Luxembourg. CIRCULAR CSSF 07/325 as amended by Circulars CSSF 21/765, CSSF 22/827 and CSSF 25/898 7/13
  2. Branches dealing only with eligible counterparties, as defined in Article 37-7 of the LFS, are exempted from the application of Articles 37-3 (conduct of business rules), with the exception of its paragraph 2a, 37-5 (best execution) and 37-6
(1)(client order handling rules) of the LFS. II.4.
  1. Instruments of supervision
  2. Periodic reports to provide to the CSSF a) Requirement for branches to report transactions on financial instruments 21.

Article 45

(4)of the LFS, the CSSF is the authority competent for ensuring that the investment services/activities and ancillary services provided in Luxembourg by the branch fulfil the obligations laid down in Article 26 of MiFIR.
  1. As per the provisions of Article 14 of Commission Delegated Regulation (EU) 2017/590, credit institutions and investments firms that execute transactions shall report these transactions to the competent authority of the home Member State. Where transactions are executed wholly or partly through a branch of a credit institution or an investment firm established in another Member State, the transactions shall be reported only once by the credit institution or the investment firm to the competent authority of the home Member State.
  2. As a result of these provisions, credit institutions and investment firms established in another Member State shall report to the competent authority of their home Member State transactions executed through their branches established in Luxembourg. The CSSF will receive these transaction reports from the concerned competent authorities.
  3. Circular CSSF 17/674 provides further clarifications on the obligation to report transactions on financial instruments b) Specific provisions relating to branches of credit institutions whose head office is in another Member State 25.

Article 45

(6)of the LFS, the details and procedures of the reporting by branches are indicated in the summary of periodic information to be provided by credit institutions to the CSSF in Circular CSSF 14/593 as amended. 26. Luxembourg branches of credit institutions whose head office is in another Member State shall fill in and submit to the CSSF on a yearly basis a self-assessment questionnaire (“SAQ”). This SAQ is based on the following powers of the CSSF to obtain information from branches in the context of its legal supervisory mandate: - Article 53
(1)points
(2)and
(8)of the LFS; - Article 45
(2)of the MiFID II Law; - Article 58-5 of the Law of 10 November 2009 on payment services, on the activity of electronic money institution and settlement finality in payment and securities settlement systems; CIRCULAR CSSF 07/325 as amended by Circulars CSSF 21/765, CSSF 22/827 and CSSF 25/898 8/13 - Article 147
(2)of the Law of 17 December 2010 relating to undertakings for collective investment and Article 50
(2)of the Law of 12 July 2013 on Alternative Investment Fund Managers; - Article 62
(1)of the Law of 13 July 2005 on institutions for occupational retirement provision in the form of pension savings companies with variable capital (SEPCAVs) and pension savings associations (ASSEPs).
  1. The individual modules of the SAQ to be completed annually by branches and applicable exemptions are directly recorded in the CSSF’s digital solution and are also described on the CSSF website (www.cssf.lu/en/prudential-reporting-credit-institutions).
  2. The information communicated in the SAQ shall be accurate and as concise as possible, while providing a true and fair view. The SAQ is available in digital form and will be adapted for subsequent financial years as required, including in response to developments of the legal and regulatory framework.
  3. The SAQ must be reviewed and electronically signed by the authorised management and transmitted via the CSSF eDesk portal within six months after the closure of the financial year.
  4. Procedures and explanations on the practical modalities regarding the preparation and transmission of the SAQ as well as the user guide “Authentication and user account management” are made available via the CSSF eDesk portal. c) Specific provisions relating to branches of investment firms whose head office is in another Member State 31.

Article 45

(6)of the LFS, branches must submit a statistical balance sheet (and off-balance sheet) and a statistical profit and loss account.
  1. External audit
  2. The procedure for the external audit of branches’ accounts falls under the competence of the competent authorities of the home Member State.
  3. Branches are required, however, to have a review executed by an external réviseur d’entreprises (statutory auditor)

the provisions of this circular for specific subjects on which the CSSF maintains a control responsibility as supervisory authority of their host Member State, in particular as regards compliance with the rules on the prevention of money laundering and compliance with the applicable conduct of business rules when providing investment services/activities as well as ancillary services to clients. 34. The réviseur d’entreprises agréé (approved statutory auditor, “REA”) shall prepare on a yearly basis a report on the compliance with the rules on the prevention of money laundering and the fight against terrorism (“AML/CFT”) and on the applicable conduct of business rules when providing investment services/activities as well as ancillary services to clients. The AML/CFT part of the report shall follow, as far as applicable, the provisions of section 3.2 of Circular CSSF 22/821, as amended, on the long form report. The part on the applicable conduct of business rules when providing investment services/activities as well as ancillary services to clients shall describe the arrangements under, and assess compliance with, the requirements incumbent on the branch pursuant to the scope of application defined in Article 37a of the LFS as well as the fair application of internal procedures for the implementation of the conduct of business rules. CIRCULAR CSSF 07/325 as amended by Circulars CSSF 21/765, CSSF 22/827 and CSSF 25/898 9/13 This report shall include a description of the procedures and controls in place within the branch 2 as well as an appraisal by the REA. Instead of providing a single report covering both topics, the REA may provide two separate reports. 35.

Article 54

(2)of the LFS, the CSSF has the right to appoint the external réviseur (auditor) of the credit institution or investment firm to execute controls at the Luxembourg branch on subjects for which the CSSF is competent. Article 8-2 of the AML/CFT Law and Article 6
(4)of the Law on the implementation of restrictive measures in financial matters provide the CSSF with similar powers.
  1. Where the CSSF decides to make use of this facility, it shall communicate to the managers of the branch the terms of the mandate to be given to the réviseurs. The managers of the branch shall liaise with the réviseur of the head office of the credit institution or investment firm or, where applicable, its local representative and organise the practical schedule of the audit. The branch shall communicate the audit report issued by the external réviseur to the CSSF.
  2. The REA submits the report(s) to the branch, which shall submit it/them in electronic form subsequently to the CSSF within six months after the closure of the financial year as described in Circular CSSF 19/
  4. On-site inspections by the competent authority of the home Member State and the CSSF
  5. The competent authorities of the home Member State may carry on on-the-spot verifications at the branches of credit institutions (Article 45
(7)of the LFS) and investment firms (Article 45
(9)of the LFS) established in Luxembourg whose head office is in another EU Member State, after having informed the CSSF. They may also request the CSSF to verify some information. In this case, the CSSF shall either carry out the verification itself or appoint a réviseur d’entreprises or any other independent expert at the expenses of the branch. 39. According to Article 9-2a
(9)of the AML/CFT Law, the CSSF may act on a duly reasoned and substantiated request from a competent home authority to carry out an investigation or on-site inspection, in the framework of its duties in the field of anti-money laundering and counter terrorist financing, of persons subject to their respective supervisory powers, subject to the following conditions: - the investigation or on-site inspection does not adversely affect the sovereignty, security or public policy of the State of Luxembourg; - the investigation or on-site inspection is not likely to impede proceedings initiated in Luxembourg in respect of the same facts and against the same persons; - no final judgement has been delivered in relation to such persons for the same facts in Luxembourg; - the competent home authority grants the same right to the CSSF; and 2 The authorised management of the branch is responsible for providing the REA with the required information for the drafting of the descriptive parts of the report. The REA may include in its report descriptive elements directly provided by the branch’s authorised management, but s/he shall verify and ensure that these elements are correct and adequate. If needed, s/he may have to perform some amendments. CIRCULAR CSSF 07/325 as amended by Circulars CSSF 21/765, CSSF 22/827 and CSSF 25/898 10/13 - the competent home authority provides guarantees of professional secrecy that are at least equivalent to the professional secrecy to which the CSSF is subject. The CSSF may, upon request, allow the presence of staff of the competent home authority during the investigation or on-site inspection. The investigation or on-site inspection shall, however, be subject to the overall control of the CSSF. Where the CSSF is not able to act on such a request, it has to inform the competent home authority thereof in as detailed a manner as possible. II.4.
  1. Measures to be taken by the CSSF in case of non- compliance by the branch with the Luxembourg provisions or in case of emergency
  2. Article 46 of the LFS describes the precautionary measures available to the CSSF as supervisory authority of the host Member State.
  3. Paragraph 1 of that Article provides that the CSSF shall refer to the competent authority of the home Member State of the credit institution or investment firm whenever it has clear and demonstrable grounds for believing that one of its branches in Luxembourg is in breach of the obligations arising from the provisions of the LFS which do not confer powers on the CSSF. If the irregular situation persists, despite the measures taken by the competent authority of the home Member State of the credit institution or investment firm or because such measures prove inadequate, the CSSF may take, after informing the competent authority of the home Member State, all appropriate measures needed in order to protect investors or the proper functioning of the markets in Luxembourg.
  4. If a branch does not comply with the requirements of the LFS which confer powers on the CSSF, the latter may address an injunction to the credit institution or the investment firm as provided for in Article 59 of the LFS. If the credit institution or investment firm concerned fails to take the necessary steps, the CSSF may take all appropriate measures to ensure that the credit institution or investment firm puts an end to the irregular situation. The CSSF shall inform the competent authority of the home Member State of the measures taken. If, despite the measures taken, the irregular situation persists, the CSSF may take, after having informed the competent authority of the home Member State, the appropriate measures to prevent or penalise further irregularities, or even prevent the credit institution or investment firm from initiating any new transaction in Luxembourg. Such measures shall be notified to the European Commission.
  5. Article 46
(4)of the LFS provides that, in emergencies and before following the procedure described in point 42 above, the CSSF may take any precautionary measures necessary to protect the interests of depositors, investors or others to whom services are provided. Such measures shall be notified to the European Commission and to the competent authorities of the home Member State. CIRCULAR CSSF 07/325 as amended by Circulars CSSF 21/765, CSSF 22/827 and CSSF 25/898 11/13 III. Free provision of services in Luxembourg by credit institutions and investment firms whose head office is in another Member State III.1. Notifications relating to the freedom to provide services 44. According to Article 39
(1)of the CRD Directive, any credit institution whose head office is in another Member State wishing to exercise the freedom to provide services by carrying on its activities in Luxembourg for the first time shall notify the competent authorities of its home Member State of the activities it intends to carry on. These activities must be included in Annex I of that Directive. 45. According to Article 34
(1)of the MiFID II Directive, any investment firm authorised and supervised by the competent authority of another Member State may exercise the freedom to provide investment services/activities as well as ancillary services in Luxembourg by way of the free provision of services, provided that such services/activities are covered by its authorisation. Ancillary services may only be provided together with an investment service/activity. The exercise of these services/activities is not subject to an additional authorisation by the CSSF. A notification to the competent authority of the home Member State is sufficient. 46. The competent authority of the home Member State shall transmit the notification of the institution to the CSSF within one month. The credit institution or investment firm may commence the provision of its services/activities in Luxembourg as soon as it is informed of this transmission. 47. Any change in the initial details included in the notification must be notified in writing to the competent authority of the home Member State at least one month before the implementation of this change, which will transmit it to the CSSF. III.2. Non-compliance with the Luxembourg provisions by credit institutions or investment firms performing activities/services under the freedom to provide services in Luxembourg 48. The provisions of point 41 of this circular also apply to credit institutions and investment firms performing activities/services under the freedom to provide services in Luxembourg. IV. Repealing provisions and entry into force 49. This circular enters into force on 19 November 2007. Circulars IML 93/100 and IML 98/147 are repealed with effect on 19 November 2007. CIRCULAR CSSF 07/325 as amended by Circulars CSSF 21/765, CSSF 22/827 and CSSF 25/898 12/13 Claude WAMPACH Director Françoise KAUTHEN Director Marco ZWICK Director Jean-Pierre FABER Director Claude MARX Director General CIRCULAR CSSF 07/325 as amended by Circulars CSSF 21/765, CSSF 22/827 and CSSF 25/898 13/13 Circulaire CSSF 22/821 telle que modifiée par les circulaires CSSF 23/845, 24/865 et 25/897 Compte rendu analytique Règles pratiques concernant le questionnaire d’autoévaluation à soumettre par les établissements Mission et rapports y relatifs des réviseurs d’entreprises agréés En cas de divergences entre les textes français et anglais, le texte anglais prévaut. Circulaire CSSF 22/821 telle que modifiée par les circulaires CSSF 23/845, 24/865 et 25/897 Compte rendu analytique Règles pratiques concernant le questionnaire d’auto-évaluation à soumettre par les établissements Mission et rapports y relatifs des réviseurs d’entreprises agréés À tous les établissements de crédit de droit luxembourgeois et aux succursales luxembourgeoises d’établissements de crédit d’origine hors UE Luxembourg, le 25 octobre 2022 Mesdames, Messieurs, La circulaire CSSF 22/821 publiée le 25 octobre 2022 a introduit une version révisée du compte rendu analytique à la suite de développements réglementaires et de l’évolution des pratiques de surveillance depuis 2001. La révision du compte rendu analytique tel que prévu dans la circulaire CSSF 01/27 résultait d’un réexamen approfondi de son objectif, champ d’application et contenu afin de l’aligner sur les priorités prudentielles et de surveillance ainsi que de supprimer les redondances entre les exigences de reporting existantes. La circulaire a introduit un questionnaire d’auto-évaluation à remplir annuellement par les établissements. Elle a également introduit le(
  1. s)rapport(
  2. s)de procédures convenues (Agreed Upon Procedures) ainsi qu’un rapport annuel séparé concernant la protection des instruments financiers et des fonds des clients, tel que requis en vertu de l’article 7 du règlement grand-ducal du 30 mai 2018, à établir par les réviseurs d’entreprises agréés (« REA ») des établissements. Le questionnaire d’auto-évaluation et le(
  3. s)rapport(
  4. s)de procédures convenues ne couvraient pas le domaine de la lutte contre le blanchiment et le financement du terrorisme (« LBC/FT ») qui doit être couvert par le REA dans son rapport annuel séparé en application du règlement CSSF N° 1202. Suite à la révision de la circulaire CSSF 22/821 telle que modifiée par la circulaire CSSF 23/845, plus aucun rapport de procédures convenues n’est exigé. Ainsi, le REA n’aura à fournir que le rapport annuel séparé concernant la protection des instruments financiers et des fonds des clients, conformément à l’article 7 du règlement grand-ducal du 30 mai 2018, ainsi que le rapport annuel LBC/FT séparé en application du règlement CSSF N° 12-02. CIRCULAIRE CSSF 22/821 telle que modifiée par les circulaires CSSF 23/845, 24/865 et 25/897 2/10 TABLE DES MATIÈRES 1. Champ d’application et base légale ............................................................................... 4 2. Le questionnaire d’auto-évaluation ............................................................................... 5 3. La mission du REA ...................................................................................................... 5 3.1. Le rapport concernant la protection des instruments financiers et des fonds des clients .... 5 3.2. Le rapport LBC/FT .................................................................................................... 6 4. Procédure de soumission ............................................................................................. 9 4.1. Le questionnaire d’auto-évaluation ............................................................................. 9 4.2. Rapports établis par le REA ....................................................................................... 9 4.3. Règles pratiques ...................................................................................................... 9 5. Dispositions finales ..................................................................................................... 9 CIRCULAIRE CSSF 22/821 telle que modifiée par les circulaires CSSF 23/845, 24/865 et 25/897 3/10 1. Champ d’application et base légale Les dispositions de la présente circulaire s’appliquent aux établissements de crédit 1 de droit luxembourgeois, y compris leurs succursales, ainsi qu’aux succursales luxembourgeoises d’établissements de crédit de pays tiers (« établissement »). La présente circulaire ne s’applique pas aux succursales luxembourgeoises d’établissements de crédit de l’UE. Le compte rendu analytique révisé se compose de trois parties : - un questionnaire d’auto-évaluation à compléter par les établissements ; - un rapport séparé à établir par le REA concernant la protection des instruments financiers et des fonds des clients ; - un rapport séparé à établir par le REA concernant les procédures mises en place par les établissements relatives à la prévention du blanchiment et du financement du terrorisme (« rapport LBC/FT »). Le questionnaire d’auto-évaluation introduit par la présente circulaire repose sur les pouvoirs de la CSSF, énumérés ci-dessous, d’obtenir des informations de la part des établissements dans le cadre de son mandat légal de surveillance : - l’article 53, paragraphe 1, points
(2)et
(8), de la loi modifiée du 5 avril 1993 relative au secteur financier ; - l’article 45, paragraphe 2, de la loi modifiée du 30 mai 2018 relative aux marchés d’instruments financiers ; - l’article 58-5 de la loi modifiée du 10 novembre 2009 relative aux services de paiement, à l’activité d’établissement de monnaie électronique et au caractère définitif du règlement dans les systèmes de paiement et les systèmes de règlement des opérations sur titres ; - l’article 147, paragraphe 2, de la loi modifiée du 17 décembre 2010 concernant les organismes de placement collectif et l’article 50, paragraphe 2, de la loi modifiée du 12 juillet 2013 relative aux gestionnaires de fonds d’investissement alternatifs ; - l’article 62, paragraphe 1, de la loi modifiée du 13 juillet 2005 relative aux institutions de retraite professionnelle sous forme de société d’épargne-pension à capital variable (sepcav) et d’association d’épargne-pension (assep). Le rapport séparé établi par le REA concernant la protection des instruments financiers et des fonds des clients est requis en vertu de l’article 7 du règlement grand-ducal du 30 mai 2018. 2 Le rapport séparé établi par le REA en matière de LBC/FT repose sur l’application de l’article 49, paragraphes 2 et 3, du règlement CSSF N° 12-02 du 14 décembre 2012 (« RCSSF 12-02 »). 3 1 La présente circulaire s’applique à la fois aux entités importantes soumises à la surveillance prudentielle et aux entités moins importantes soumises à la surveillance prudentielle, telles que définies à l’article 2, points
(16)et
(7)du règlement (UE) modifié n° 468/2014 de la Banque centrale européenne (« BCE ») du 16 avril 2014 (le « Règlement-cadre MSU »). 2 Règlement grand-ducal modifié du 30 mai 2018 relatif à la protection des instruments financiers et des fonds des clients, aux obligations applicables en matière de gouvernance des produits et aux règles régissant l'octroi ou la perception de droits, de commissions ou de tout autre avantage monétaire ou non monétaire. 3 Règlement CSSF modifié N° 12-02 du 14 décembre 2012 relatif à la lutte contre le blanchiment et contre le financement du terrorisme. CIRCULAIRE CSSF 22/821 telle que modifiée par les circulaires CSSF 23/845, 24/865 et 25/897 4/10
  1. Le questionnaire d’auto-évaluation Le questionnaire d’auto-évaluation couvre les domaines du champ d’application de la surveillance prudentielle pour lesquels la CSSF ou la Banque centrale européenne est compétente. Veuillez noter, cependant, que les modules du questionnaire d’auto-évaluation couvrant les sujets en relation avec la directive concernant les marchés d’instruments financiers (« directive MiFID »), la directive révisée sur les services de paiement (« directive PSD 2 »), les dépositaires d’organismes de placement collectif (« OPC ») et le règlement sur les infrastructures de marché européennes (« EMIR ») relèvent exclusivement de la compétence de la CSSF. Toutes les parties du questionnaire d’auto-évaluation ont été élaborées de manière proportionnée et visent tous les établissements concernés, afin de permettre à la CSSF de collecter les informations nécessaires pour mettre en œuvre une approche fondée sur les risques pour la surveillance et d’obtenir les informations et assurances concernant le respect par les établissements concernés des principales dispositions réglementaires dont le contrôle relève du mandat légal des autorités compétentes. Les informations communiquées dans le cadre du questionnaire d’auto-évaluation doivent être exactes et aussi concises que possible, tout en donnant une image fidèle et honnête, et se baser sur les chiffres du reporting prudentiel (FINREP/COREP/LAREX) en IFRS à la clôture de l’exercice financier. 4 Le questionnaire d’auto-évaluation est disponible en format numérique tel que décrit à la section 4.
  2. Son contenu est adapté de manière annuelle, s’il y a lieu, notamment en réponse aux évolutions du cadre légal et réglementaire. Les différents modules et leur niveau d’application ainsi que les exemptions applicables sont directement disponibles dans la solution numérique de la CSSF et consultables sur le site de la CSSF (www.cssf.lu/fr/reporting-prudentiel-etablissements-de-credit)
  3. La mission du REA 3.
  4. Le rapport concernant la protection des instruments financiers et des fonds des clients Le cas échéant, les établissements sont tenus de mandater leur REA pour établir, sur une base annuelle, un rapport séparé concernant la protection des instruments financiers et des fonds des clients. Ce rapport doit couvrir l’adéquation des dispositions visées à l’article 37-1, paragraphes 7 et 8, de la loi modifiée du 5 avril 1993 relative au secteur financier, à l’article 13, paragraphe 4, de la loi modifiée du 5 août 2005 sur les contrats de garantie financière et à la section 2 du règlement grand-ducal du 30 mai
  5. La direction autorisée de l’établissement est chargée de fournir au REA les informations nécessaires pour la rédaction des parties descriptives du rapport. Le REA peut inclure dans son rapport des 4 Pour les établissements dont la date de clôture de l’exercice financier n’est pas alignée sur la date de remise du reporting prudentiel, le questionnaire devrait se baser sur le dernier reporting prudentiel soumis avant la clôture de l’exercice financier. CIRCULAIRE CSSF 22/821 telle que modifiée par les circulaires CSSF 23/845, 24/865 et 25/897 5/10 éléments descriptifs fournis directement par la direction autorisée de l’établissement, mais il doit vérifier et s’assurer que ces éléments sont corrects et adéquats. Il peut, si nécessaire, avoir à procéder à des modifications. L’objet de ce rapport séparé, qui doit être téléchargé via une solution numérique de la CSSF, est notamment de veiller à la fiabilité des réponses données par un établissement dans le questionnaire d’auto-évaluation concernant la protection des instruments financiers et des fonds des clients. Cependant, cela n’empêche pas le REA d’effectuer des évaluations supplémentaires, au-delà de celles énoncées dans le questionnaire d’auto-évaluation. 3.
  6. Le rapport LBC/FT Les établissements sont également tenus de mandater leur REA pour établir, sur une base annuelle, un rapport séparé qui couvre le domaine LBC/FT en application du RCSSF 12-
  7. Le rapport LBC/FT décrit les procédures mises en place par l’établissement relatives à la prévention du blanchiment et du financement du terrorisme, telles que requises en vue de se conformer à ou telle que définies par : - la partie II, chapitre 5, de la loi modifiée du 5 avril 1993 relative au secteur financier ; - la loi modifiée du 12 novembre 2004 relative à la lutte contre le blanchiment et contre le financement du terrorisme ; - le règlement grand-ducal modifié du 1er février 2010 portant précision de certaines dispositions de la loi modifiée du 12 novembre 2004 relative à la lutte contre le blanchiment et contre le financement du terrorisme ; - le règlement (UE) modifié 2015/847 du Parlement européen et du Conseil du 20 mai 2015 sur les informations accompagnant les transferts de fonds ; - les actes internationaux en matière de lutte contre le financement du terrorisme portés à la connaissance des établissements par voie de circulaires CSSF ; - les règlements CSSF en matière de lutte contre le blanchiment et le financement du terrorisme ; - les circulaires CSSF relatives à la LBC/FT. Le rapport LBC/FT doit fournir en particulier les éléments suivants : • la description de la politique LBC/FT mise en place par l’établissement en vue de la prévention du blanchiment et du financement du terrorisme, la vérification de sa conformité avec les dispositions de la partie II, chapitre 5, de la loi modifiée 5 avril 1993 relative au secteur financier, de la loi modifiée du 12 novembre 2004 relative à la lutte contre le blanchiment et contre le financement du terrorisme, du règlement grand-ducal modifié du 1er février 2010, du règlement (UE) modifié 2015/847, des règlements CSSF et des circulaires CSSF en matière de LBC/FT, et le contrôle de leur bonne application ; • l’appréciation de l’analyse faite par l’établissement des risques de blanchiment et de financement du terrorisme auxquels il est exposé. Le REA doit vérifier si les procédures, infrastructures et contrôles mis en place, ainsi que l’étendue des mesures prises en matière de LBC/FT, sont appropriés face aux risques de BC/FT auxquels l’établissement est exposé, notamment par ses activités, la nature de sa clientèle et les produits et services proposés ; CIRCULAIRE CSSF 22/821 telle que modifiée par les circulaires CSSF 23/845, 24/865 et 25/897 6/10 • une déclaration indiquant si un audit du respect de la politique LBC/FT de l’établissement a été effectué par la fonction d’audit interne et le responsable du contrôle du respect des obligations professionnelles 5 ; • une brève description des mesures de formation et de sensibilisation des employés en matière de blanchiment et de financement du terrorisme, et en particulier en ce qui concerne la détection des opérations de blanchiment et de financement du terrorisme ; • les statistiques des transactions suspectes détectées, renseignant sur le nombre de déclarations de transactions suspectes faites par l’établissement à la CRF ainsi que le montant total des fonds impliqués au cours de l’exercice financier ; • le contrôle de l’application par l’établissement, dans son rôle respectif, des dispositions du règlement (UE) modifié 2015/847 et le pourcentage des transferts de fonds pour lesquels les données sur le donneur d’ordre ou le bénéficiaire ont été manquantes ou incomplètes et des mesures prises par l’établissement dans ce contexte. Le rapport LBC/FT doit également fournir les éléments suivants : • une description des rôles et responsabilités en matière de LBC/FT au sein de l’établissement, y compris les rôles et responsabilités de et les interactions entre la direction et les différents départements et services, renseignant l’effectif correspondant impliqué dans les questions de LBC/FT. Le rapport LBC/FT doit également inclure une description des comités et des structures hiérarchiques et fonctionnelles correspondantes, en renseignant les délégations générales et particulières des pouvoirs en matière de LBC/FT. Il doit également fournir une description par l’établissement et l’évaluation par le REA du modèle des trois lignes de défense, tel que défini à l’article 39, paragraphe 7, du RCSSF 12-02 ; • la liste des personnes impliquées dans les questions de LBC/FT, telles que visées dans le RCSSF 12-02 et la circulaire CSSF 12/552, telle que modifiée, (le responsable de contrôle, le responsable du respect, le « Chief Compliance Officer », etc.). Il doit indiquer en outre tous les changements intervenus au cours de l’exercice financier concernant ces personnes. Étant donné que ces personnes peuvent déléguer certaines tâches opérationnelles en rapport avec ces fonctions à des membres du personnel, le rapport LBC/FT doit fournir, le cas échéant, une description du mécanisme de délégation ; • une description du réseau d’agences national, les filiales nationales et étrangères, les succursales à l’étranger, les bureaux de représentation à l’étranger et les agents liés, ainsi que les principaux risques BC/FT y associés. Le rapport LBC/FT doit également renseigner si l’établissement a recours aux services de gestionnaires externes concernant les actifs des clients et doit, le cas échéant, fournir une description de la façon dont les relations avec les gestionnaires externes sont gérées et documentées d’un point de vue LBC/FT ; • une description de la politique commerciale de l’établissement ainsi que la stratégie relative à la gestion des risques BC/FT y associés. Il doit inclure en outre une description de la façon dont l’établissement effectue le suivi et s’assure du respect de ses objectifs internes en matière de gestion des risques BC/FT. Le REA doit évaluer si l’établissement dispose de ressources financières suffisantes et de l’infrastructure appropriée pour le contrôle des risques BC/FT auxquels il est exposé. Le REA doit renseigner la façon dont l’échantillon des dossiers contrôlés a été sélectionné. Lors de la sélection de l’échantillon, la CSSF s’attend à ce que le REA applique une approche fondée sur les 5 Tel que défini à l’article 1, paragraphe 1, du RCSSF 12-
  8. CIRCULAIRE CSSF 22/821 telle que modifiée par les circulaires CSSF 23/845, 24/865 et 25/897 7/10 risques, en prenant en considération les différentes activités commerciales exercées. Le REA doit renseigner la date de référence des données de l’échantillon et fournir les informations pertinentes relatives à la méthodologie adoptée pour la sélection de l’échantillon (par exemple, le nombre de dossiers examinés par rapport au nombre total de clients ou le volume des dépôts contrôlés par rapport au volume total des dépôts). Lorsque le REA constate des cas de non-respect des dispositions légales ou réglementaires ou de lacunes, le REA doit donner des indications précises permettant à la CSSF d’évaluer la situation (nombre de dossiers non complets en suspens qui est à rapporter également au nombre total de dossiers contrôlés, détail des lacunes constatées, etc.). Le cas échéant, le rapport LBC/FT doit englober les succursales, les filiales majoritaires étrangères et les agents liés. Il doit couvrir, notamment, le respect par les succursales, filiales majoritaires et agents liés des dispositions applicables en matière de prévention du blanchiment et du financement du terrorisme et doit comporter, à cet égard : • une analyse des risques encourus par les succursales, filiales majoritaires et agents liés en matière de blanchiment et de financement du terrorisme ; • une description et une évaluation de la gestion du risque de blanchiment et de financement du terrorisme dans les succursales, filiales majoritaires et agents liés ; • la vérification de la mise en œuvre et du respect de la politique LBC/FT de l’établissement dans les succursales, filiales majoritaires et agents liés. Le rapport LBC/FT doit être suffisamment exhaustif et transparent, inclure des descriptions et évaluations détaillées afin de permettre un jugement précis et fondé sur les risques de blanchiment et de financement du terrorisme encourus par l’établissement. En ce qui concerne le langage utilisé dans les évaluations, le rapport LBC/FT ne doit pas contenir des formulations imprécises du type négatif (p.ex. « Nous n’avons pas trouvé de faiblesses graves ») ou encore des évaluations globales et approximatives (p.ex. « Nous avons constaté que la plupart des points sont conformes à la réglementation »). Le rapport LBC/FT doit plutôt donner, pour chaque domaine et chaque sujet, une évaluation positive en fournissant un aperçu de la méthodologie adoptée (p.ex. recours à la technique d’échantillonnage, méthode de sélection de l’échantillon, etc.) et, le cas échéant, inclure une description des observations, ceci afin de permettre à la CSSF de mieux comprendre et juger la portée des irrégularités et des faiblesses notées. Le REA doit également effectuer le suivi des constatations observées durant les audits précédents et détaillées dans le rapport LBC/FT précédent. Le REA doit fournir une description des problèmes potentiels en matière de LBC/FT que l’établissement peut rencontrer avec les autorités compétentes étrangères. La direction autorisée de l’établissement est chargée de fournir au REA les informations nécessaires pour la rédaction des parties descriptives du rapport LBC/FT. Le REA peut inclure dans son rapport des éléments descriptifs fournis directement par la direction autorisée de l’établissement, mais il doit vérifier et s’assurer que ces éléments sont corrects et adéquats. Il peut, si nécessaire, avoir à procéder à des modifications. Outre les parties descriptives, le REA doit effectuer de manière indépendante une évaluation détaillée des risques BC/FT auxquels l’établissement est exposé ainsi que des aspects organisationnels. Cette évaluation doit être dûment documentée. Il est souligné que le REA doit également avertir la CSSF de tous les cas de transactions suspectes déclarées conformément à l’article 5 de la loi modifiée du 12 novembre 2004 relative à la lutte contre le blanchiment et contre le financement du terrorisme et qui concernent les établissements. De même, le REA doit informer la CSSF s’il estime que l’établissement aurait dû déclarer une transaction CIRCULAIRE CSSF 22/821 telle que modifiée par les circulaires CSSF 23/845, 24/865 et 25/897 8/10 suspecte mais ne l’a pas fait, en expliquant son raisonnement et en prenant en considération la justification de l’établissement. Lors des discussions avec l’établissement concernant ces cas, le REA doit tenir compte des obligations professionnelles applicables.
  9. Procédure de soumission 4.
  10. Le questionnaire d’auto-évaluation Le questionnaire d’auto-évaluation sera accessible à chaque établissement via une solution numérique de la CSSF endéans trois mois avant la clôture de l’exercice financier de l’établissement. Le questionnaire d’auto-évaluation doit être revu et signé électroniquement par la direction autorisée avant d’être soumis à la CSSF. Le questionnaire d’auto-évaluation doit être transmis annuellement à la CSSF sous forme électronique via une solution numérique de la CSSF, endéans trois mois suivant la clôture de l’exercice financier, conformément à la procédure décrite à la section 4.
  11. 4.
  12. Rapports établis par le REA Le rapport séparé concernant la protection des instruments financiers et des fonds des clients et le rapport LBC/FT doivent comporter la signature numérique de l’associé chargé du mandat auprès du cabinet d’audit. Le REA soumet les rapports à l’établissement qui les soumet ensuite à la CSSF. Les rapports établis par le REA doivent être transmis par l’établissement à la CSSF sous forme électronique via une solution numérique de la CSSF, endéans cinq mois suivant la clôture de l’exercice financier, conformément à la procédure décrite à la section 4.
  13. 4.
  14. Règles pratiques Les procédures et les explications concernant les modalités pratiques pour la préparation et la transmission du questionnaire d’auto-évaluation, du rapport séparé concernant la protection des instruments financiers et des fonds des clients et du rapport LBC/FT sont mises à la disposition des établissements et de leur REA sur le site Internet de la CSSF à l’adresse https://edesk.apps.cssf.lu/edesk-dashboard/api/v1/documentation/LFRB_GU/en. Un guide utilisateur Authentication and user account management est disponible pour les établissements sur le portail eDesk de la CSSF.
  15. Dispositions finales La circulaire CSSF 22/821, telle que publiée le 25 octobre 2022, a abrogé la circulaire CSSF 01/27, telle que modifiée par les circulaires CSSF 08/340, CSSF 10/484, CSSF 11/521 et CSSF 21/765, ainsi que la circulaire IML 96/
  16. Elle était d’application à partir du 31 décembre
  17. La version révisée actuelle s’applique à compter du 31 décembre
  18. CIRCULAIRE CSSF 22/821 telle que modifiée par les circulaires CSSF 23/845, 24/865 et 25/897 9/10 Claude WAMPACH Directeur Françoise KAUTHEN Directeur Marco ZWICK Directeur Jean-Pierre FABER Directeur Claude MARX Directeur général CIRCULAIRE CSSF 22/821 telle que modifiée par les circulaires CSSF 23/845, 24/865 et 25/897 10/10 Circular CSSF 22/821 as amended by Circulars CSSF 23/845, 24/865 and 25/897 Long Form Report Practical rules concerning the self-assessment questionnaire to be submitted by institutions. Mission and related reports of the approved statutory auditors (réviseurs d’entreprises agréés). Circular CSSF 22/821 as amended by Circulars CSSF 23/845, 24/865 and 25/897 Long Form Report Practical rules concerning the self-assessment questionnaire to be submitted by institutions. Mission and related reports of the approved statutory auditors (réviseurs d’entreprises agréés). To all Luxembourg credit institutions and Luxembourg branches of non-EU credit institutions Luxembourg, 25 October 2022 Ladies and Gentlemen, Circular 22/821 published on 25 October 2022 introduced a revised version of the long form report following on from the regulatory developments and the evolving supervisory practices since
  19. The revision of the long form report as contemplated under Circular CSSF 01/27 was the result of a thorough reconsideration of its objective, scope and content in order to realign it with supervisory and prudential points of focus as well as to suppress redundancies between existing reporting requirements. The circular introduced a self-assessment questionnaire to be filled in on an annual basis by the institutions. It also introduced Agreed Upon Procedure report(s) and an annual separate report on the protection of financial instruments and funds belonging to clients as required under Article 7 of the Grand-ducal Regulation of 30 May 2018 to be established by the réviseurs d’entreprises agréés (REA) of the institutions. The self-assessment questionnaire and the Agreed Upon Procedure report(s) did not include matters relating to anti-money laundering and countering the financing of terrorism (AML/CFT) that have to be covered by the REA in its annual, separate report further to CSSF Regulation No 12-
  20. Following the revision of Circular 22/821 as amended by Circular CSSF 23/845, no more Agreed Upon Procedure reports are foreseen. As a result, the REA would only have to provide the annual separate report on the protection of financial instruments and funds belonging to clients as required under Article 7 of the Grand-ducal Regulation of 30 May 2018 as well as the annual separate AML/CFT report further to CSSF Regulation No 12-
  21. CIRCULAR CSSF 22/821 as amended by Circulars CSSF 23/845, 24/865 and 25/897 2/9 TABLE OF CONTENTS
  22. Scope of application and legal basis ................................................................................. 4
  23. The self-assessment questionnaire .................................................................................. 4
  24. The mission of the REA .................................................................................................. 5 3.
  25. The report on the protection of financial instruments and funds belonging to clients ......... 5 3.
  26. The AML/CFT report ................................................................................................. 6
  27. Submission procedures .................................................................................................. 8 4.
  28. Self-assessment questionnaire .................................................................................. 8 4.
  29. Reports prepared by the REA..................................................................................... 8 4.
  30. Practical rules .......................................................................................................... 9
  31. Final provisions ............................................................................................................. 9 CIRCULAR CSSF 22/821 as amended by Circulars CSSF 23/845, 24/865 and 25/897 3/9
  32. Scope of application and legal basis The provisions of this circular are applicable to credit institutions 1 incorporated under Luxembourg law, including their branches, as well as Luxembourg branches of third-country credit institutions (institution). This circular does not apply to Luxembourg branches of EU credit institutions. The framework for the revised long form report consists of three parts: - a self-assessment questionnaire to be completed by institutions; - a separate report to be prepared by the REA on the protection of financial instruments and funds belonging to clients; - a separate report to be prepared by the REA on the procedures set up by institutions concerning the prevention of money laundering and terrorist financing (AML/CFT report). The self-assessment questionnaire introduced by this circular is based on the following powers of the CSSF to obtain information from institutions in the context of its legal supervisory mandate: - Article 53
(1), points
(2)and
(8), of the Law of 5 April 1993 on the financial sector, as amended; - Article 45
(2)of the Law of 30 May 2018 on markets in financial instruments, as amended; - Article 58-5 of the Law of 10 November 2009 on payment services, on the activity of electronic money institution and settlement finality in payment and securities settlement systems, as amended; - Article 147
(2)of the Law of 17 December 2010 relating to undertakings for collective investment, as amended and Article 50
(2)of the Law of 12 July 2013 on alternative investment fund managers, as amended; - Article 62
(1)of the Law of 13 July 2005 on institutions for occupational retirement provision in the form of pension savings companies with variable capital (SEPCAVs) and pension savings associations (ASSEPs), as amended. The separate report prepared by the REA on the protection of financial instruments and funds belonging to clients is required under Article 7 of the Grand-ducal Regulation of 30 May 2018. 2 The separate report prepared by the REA on AML/CFT is based on the application of Articles 49
(2)and
(3)of CSSF Regulation No 12-02 of 14 December 2012 (RCSSF 12-02). 3 2. The self-assessment questionnaire The self-assessment questionnaire covers domains in scope of the prudential supervision for which the CSSF or the European Central Bank are competent. Please note however that the modules of the self-assessment questionnaire covering matters relating to the Market in Financial Instruments 1 This circular applies to both significant supervised entities and less significant supervised entities as defined in Article 2, points
(16)and
(7)of Regulation (EU) No 468/2014 of the European Central Bank (ECB) of 16 April 2014, as amended (the SSM Framework Regulation) respectively. 2 Grand-ducal Regulation of 30 May 2018 on the protection of financial instruments and funds belonging to clients, product governance obligations and the rules applicable to the provision or reception of fees, commissions or any monetary or non-monetary benefits, as amended. 3 CSSF Regulation No 12-02 of 14 December 2012 on the fight against money laundering and terrorist financing, as amended. CIRCULAR CSSF 22/821 as amended by Circulars CSSF 23/845, 24/865 and 25/897 4/9 Directive (MiFID), the Payment Services Directive (PSD 2) and undertaking for collective investments (UCI) depositaries and the European Market Infrastructure Regulation (EMIR) are under the exclusive competence of the CSSF. All parts of the self-assessment questionnaire have been designed in a proportionate way and target in-scope institutions with a view to allowing the CSSF to gather sufficient information to implement risk-based approaches to supervision and to obtain information and assurances as regards in-scope institutions’ compliance with key regulatory provisions the control of which falls within the competent authorities’ legal mandate. The information communicated as part of the self-assessment questionnaire shall be accurate and as concise as possible, while providing a true and fair view, and be based on the prudential reporting figures (FINREP/COREP/LAREX) under IFRS as at the closure of the financial year. 4 The self-assessment questionnaire is available in digital form as described in section 4.1. Its content is adapted on a yearly basis as required, including in response to developments of the legal and regulatory framework. The individual modules of the self-assessment questionnaire and their level of application as well as the applicable exemptions are directly recorded in the CSSF’s digital solution and are also reflected on the CSSF website (www.cssf.lu/en/prudential-reporting-credit-institutions). 3. The mission of the REA 3.1. The report on the protection of financial instruments and funds belonging to clients If applicable, institutions are required to mandate their REA to prepare, on an annual basis, a separate report on the protection of financial instruments and funds belonging to clients. This report shall cover the adequacy of the arrangements under Article 37-1
(7)and
(8)of the Law of 5 April 1993 on the financial sector, as amended, Article 13
(4)of the Law of 5 August 2005 on financial collateral arrangements, as amended, and Section 2 of the Grand-ducal Regulation of 30 May
  1. The authorised management of the institution is responsible for providing the REA with the required information for the drafting of the descriptive parts of the report. The REA may include in its report descriptive elements directly provided by the institution’s authorised management, but s/he shall verify and ensure that these elements are correct and adequate. If needed, s/he may have to perform some amendments. The purpose of this separate report, which must be uploaded through a CSSF digital solution, is notably to ensure the reliability of the answers provided by an institution in the self-assessment questionnaire in relation to the protection of financial instruments and funds belonging to clients. However, this does not preclude the REA to perform further assessments beyond those set forth in the self-assessment questionnaire. 4 For institutions for which the date of the closure of the financial year is not aligned with the remittance date of the prudential reporting, the questionnaire should be based on the last prudential reporting submitted before the closure of the financial year. CIRCULAR CSSF 22/821 as amended by Circulars CSSF 23/845, 24/865 and 25/897 5/9 3.
  2. The AML/CFT report Institutions are also required to mandate their REA to prepare, on an annual basis, a separate report covering AML/CFT further to RCSSF 12-
  3. The AML/CFT report describes the procedures set up by the institution concerning the prevention of money laundering and terrorist financing as required for compliance with or as defined in: - Chapter 5 of Part II of the Law of 5 April 1993 on the financial sector, as amended; - the Law of 12 November 2004 on the fight against money laundering and terrorist - the Grand-ducal Regulation of 1 February 2010 providing details on certain provisions of financing, as amended; the amended Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended; - Regulation (EU) 2015/847 of the European Parliament and of the Council of 20 May 2015 on information accompanying transfers of funds, as amended; - international acts on the fight against terrorist financing brought to the attention of the institutions through CSSF circulars; - CSSF regulations on the fight against money laundering and terrorist financing; - CSSF circulars with regard to AML/CFT. The AML/CFT report shall provide, in particular: • the description of the AML/CFT policy set up by the institution in order to prevent money laundering and terrorist financing, the verification of its compliance with the provisions of Part II, Chapter 5 of the Law of 5 April 1993 on the financial sector, as amended, the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended, the Grand-ducal Regulation of 1 February 2010, as amended, Regulation (EU) 2015/847, as amended, CSSF regulations and CSSF circulars relating to AML/CFT and the control of their sound application; • the assessment of the institution's analysis of money laundering and terrorist financing risks to which it is exposed. The REA must verify if the implemented procedures, infrastructures and controls, as well as the scope of the AML/CFT measures are appropriate considering the ML/FT risks to which the institution is exposed, particularly through its activities, the nature of its customers and the provided products and services; • a declaration on whether an audit of compliance with the institution's AML/CFT policy has been performed by the internal audit function and the compliance officer in charge of the control of compliance with the professional obligations 5; • a short description of the training and awareness-raising measures for employees as regards money laundering and terrorist financing, and, in particular, with respect to the identification of money laundering and terrorist financing transactions; • statistics concerning the detected suspicious transactions which indicate the number of suspicious transaction cases reported to the FIU by the institution, as well as the total amount of funds involved during the financial year; • the control of the application of the provisions of Regulation (EU) 2015/847, as amended by the institution, in its respective role, and the percentage of transfers of funds for which data on the payer or payee were missing or incomplete and the measures taken in this context by the institution. The AML/CFT report shall also provide: 5 As defined in Article 1
(1)of RCSSF 12-02. CIRCULAR CSSF 22/821 as amended by Circulars CSSF 23/845, 24/865 and 25/897 6/9 • a description of roles and responsibilities with regard to AML/CFT within the institution, including the roles and responsibilities of and the interactions between the management and the different departments and services, indicating the corresponding number of staff involved on AML/CFT matters. The AML/CFT report shall also include a description of the committees and the corresponding hierarchical and functional structures by indicating the general and particular delegations of power with respect to AML/CFT. It shall also provide a description by the institution and an assessment by the REA of the three-lines-ofdefence model, as defined in Article 39
(7)of the RCSSF 12-02; • the list of persons involved in AML/CFT matters, as referred to in the RCSSF 12-02 and Circular CSSF 12/552, as amended (compliance officer, person responsible for compliance, Chief Compliance Officer, etc.). It shall also state all the changes with regard to these persons which occurred during the financial year. Since these persons may delegate to members of staff certain operational tasks in relation to these functions, the AML/CFT report shall provide, where appropriate, a description of the delegation mechanism; • a description of the network of national agencies, national and foreign subsidiaries, the branches abroad, the foreign representative offices and the tied agents, as well as the main related ML/FT risks. The AML/CFT report shall also indicate if the institution uses the services of external managers as regards the clients' assets and shall, where appropriate, provide a description of the manner in which the relationships with external managers are managed and documented from an AML/CFT perspective; • a description of the institution’s commercial policy as well as the strategy regarding the management of the related ML/FT risks. It shall also include a description of how the institution monitors and ensures compliance with its internal objectives with regard to ML/FT risks management. The REA shall assess if the institution has sufficient financial resources and the appropriate infrastructure to control ML/FT risks to which it is exposed. The REA shall state how the sample of reviewed files was selected. When determining the sample, the CSSF expects the REA to apply a risk-based approach, taking into account the different business activities performed. The REA shall state the reference date of the sample data and provide relevant information on the methodology adopted for determining the sample (for example, the number of files reviewed compared to the total number of clients or the volume of deposits reviewed compared to the total volume of deposits). Where the REA identifies cases of non-compliance with the legal or regulatory provisions or deficiencies, the REA shall give detailed indications enabling the CSSF to assess the situation (number of pending incomplete files as a percentage of the total number of reviewed files, details of the deficiencies identified, etc.). Where applicable, the AML/CFT report must encompass the institution's branches, majority-owned subsidiaries abroad and the tied agents. It must cover, in particular, the branches', majority-owned subsidiaries' and the tied agents’ compliance with the applicable provisions as regards the prevention of money laundering and terrorist financing and it must include, in that respect: • an analysis of money laundering and terrorist financing risks incurred by the branches, majority-owned subsidiaries and the tied agents; • a description and assessment of the money laundering and terrorist financing risk management in the branches, majority-owned subsidiaries and the tied agents; • the verification of the implementation of and compliance with the institution's AML/CFT policy in the branches, majority-owned subsidiaries and the tied agents. The AML/CFT report must be sufficiently exhaustive and transparent, providing detailed descriptions and assessments, in order to allow a precise and informed judgement on the risks incurred by the CIRCULAR CSSF 22/821 as amended by Circulars CSSF 23/845, 24/865 and 25/897 7/9 institution with respect to money laundering and terrorist financing. With regard to the language used for the assessments, the AML/CFT report shall not include imprecise negative formulations (e.g. “We did not encounter serious weaknesses”) or global and approximative assessments (e.g. “We noted that most of the points comply with the laws and regulations”). The AML/CFT report shall rather provide a positive assessment for each area and subject by providing an overview of the methodology adopted (e.g. use of the sample technique, method for selecting the sample, etc.) and, where applicable, provide a description of the identified findings in order to allow the CSSF to better understand and judge the extent of the noticed irregularities and weaknesses. The REA shall also perform the follow-up of findings observed during the previous audits and described in detail in the previous AML/CFT report. The REA shall provide a description of any potential issues in relation to AML/CFT the institution may have with foreign competent authorities. The authorised management of the institution is responsible for providing the REA with the required information for the drafting of the descriptive parts of the AML/CFT report. The REA may include in its report descriptive elements directly provided by the institution’s authorised management, but s/he shall verify and ensure that these elements are correct and adequate. If needed, s/he may have to perform some amendments. In addition to the descriptive parts, the REA shall perform independently a detailed assessment of the ML/FT risks to which the institution is exposed as well as organisational aspects. This assessment shall be duly documented. It should be noted that the REA shall also inform the CSSF of all the suspicious transactions reported pursuant to Article 5 of the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended, and which concern the institutions. Similarly, the REA must inform the CSSF in case they deem that the institution should have reported a suspicious transaction but has not, explaining their reasoning and having regard to the institution’s rationale. When discussing the cases with the institution, the REA need to be mindful of applicable professional obligations. 4. Submission procedures 4.1. Self-assessment questionnaire The self-assessment questionnaire will be accessible through a CSSF digital solution for each institution within three months before the closure of the institution’s financial year. The self-assessment questionnaire must be reviewed and electronically signed by the authorised management before submitting it to the CSSF. The self-assessment questionnaire must be transmitted on an annual basis to the CSSF in an electronic form via a CSSF digital solution within three months after the closure of the financial year,

the procedure described in section 4.

  1. 4.
  2. Reports prepared by the REA The separate report on the protection of financial instruments and funds belonging to clients and the AML/CFT report shall include the digital signature of the partner in charge of the mandate with the CIRCULAR CSSF 22/821 as amended by Circulars CSSF 23/845, 24/865 and 25/897 8/9 audit firm s/he represents. The REA submits the reports to the institution, which submits them subsequently to the CSSF. The reports prepared by the REA must be transmitted by the institution to the CSSF in electronic form via a CSSF digital solution within five months after the closure of the financial year,

the procedure described in section 4.

  1. 4.
  2. Practical rules Procedures and explanations on the practical modalities regarding the preparation and transmission of the self-assessment questionnaire, the separate report on the protection of financial instruments and funds belonging to clients and the AML/CFT report are made available to institutions and their REA, on the website of the CSSF under the following link: https://edesk.apps.cssf.lu/edeskdashboard/api/v1/documentation/LFRB_GU/en. A user guide “Authentication and user account management” is available to institutions via the eDesk portal of the CSSF.
  3. Final provisions Circular CSSF 22/821, as published on 25 October 2022, repealed Circular CSSF 01/27, as amended by Circulars CSSF 08/340, CSSF 10/484, CSSF 11/521 and CSSF 21/765, as well as Circular IML 96/
  4. It applied from 31 December
  5. The current revised version shall apply as from 31 December
  6. Claude WAMPACH Director Marco ZWICK Director Françoise KAUTHEN Director CIRCULAR CSSF 22/821 as amended by Circulars CSSF 23/845, 24/865 and 25/897 Jean-Pierre FABER Director Claude MARX Director General 9/9

🔗 Vers la source officielle

AI explanation based on the official legal text. Indicative, not a substitute for legal advice.