Circular CSSF 25/870 amending Circular CSSF 24/853 on the revised long form report for investment firms The CSSF published today Circular CSSF 25/870 amending Circular CSSF 24/853 on the revised long form report (RLFR) (the Circular)
investment firms incorporated under Luxembourg law, including their branches. Whereas for the financial year ending 31 December 2023, the RLFR was applicable to a sample
investment firms only, the aim
the circular is to extend the scope
application
Circular CSSF 24/853 as from the financial year ending 31 December 2024. Consequently, all investment firms incorporated under Luxembourg law, including their branches, are required to prepare a RLFR as from said financial year. The CSSF recalls that the reporting framework implemented by Circular CSSF 24/853 comprises four dedicated reports. With reference to the principle
proportionality, the CSSF introduces a more proportionate approach for investment firms who are subjected to the RLFR for the first time as from the year ending 31 December 2024 and who, in consideration
their risk attributes, represent a comparably lesser risk. Those investment firms (the Partial Scope IF) are subject to a lighter RLFR framework and are required for the time being to submit 3 dedicated reports only. The circular reconfirms that Partial Scope IF must assess their compliance and the effectiveness
their internal organisational arrangements via the RLFR self-assessment questionnaire (the SAQ). Partial Scope IF must also mandate their réviseur d’entreprises agréé (REA) to prepare the report on the protection
financial instruments and funds belonging to clients in accordance with Article 7
the Grand-ducal Regulation
30 May 2018 (the MiFID report) and the report concerning anti-money laundering and countering the financing
terrorism in accordance with Articles 49
CSSF Regulation No 12-02
14 December 2012 (the AML/CFT report). Given their comparably lesser risk, the CSSF has decided, for the time being, to exempt Partial Scope IF from the requirement to have Agreed Upon Procedure (AUP) reports prepared by their REA. This exemption will result in lesser work to be performed by the REA in the context
the RLFR which in turn should result in reduced regulatory costs for the Partial Scope IF. Moreover, as a general principle, under the revised framework, the work to be performed by the REA is limited compared to the requirements
Circular CSSF 03/113 and shall now focus solely on certain MiFID and AML/CFT requirements. The SAQ for the financial year ending 31 December 2024 is overall consistent with the previous year version. Limited additions have been performed to provide more guidance to investment firms and integrate selected regulatory aspects with respect to e.g. MiFID requirements concerning the protection
financial instruments and funds belonging to clients and DORA preparedness. Amendments resulting in limited redrafting
some
the SAQ questions to clarify the CSSF’s expectations have also been performed. The CSSF plans to invite investment firms to a virtual information workshop on the RFLR in the coming weeks to further guide investment firms and notably Partial Scope IF. Submission process The CSSF reminds investment firms that the RLFR must be documented and uploaded via the CSSF eDesk platform. The RLFR can be submitted to the CSSF via the following channels: An online solution via eDesk procedure for manual input by the investment firms. The Application Programming Interface (API) solution based on the use
a structured exchange file (json format) to be transmitted to the CSSF via the S3 (“simple storage service”) protocol. This file will then pre-fill the questionnaire available on the CSSF eDesk platform. The investment firm will also be able to update directly in eDesk the data pre-filled through S3. The manual input
the responses directly in the eDesk online form remains possible. Investment firms can rely on the following user guides: A user guide “Authentication and user account management”, already available via the eDesk Portal
the CSSF: eDesk. The dedicated user guide for the “Long-Form Report” that will be available via the eDesk Portal
the CSSF. The portal
the RFLR for the financial year ending 31 December 2024 should be accessible in the following weeks. Any question relating to this communication, Circular CSSF 24/853 as amended, or the RLFR should be addressed to lfrei@cssf.lu by copying your usual point
contact at the CSSF. Any technical questions regarding the communication channels mentioned above should be addressed to eDesk@cssf.lu. 6 February 2024 - Updated on 9 January 2026 Circular CSSF 24/853 (as amended by Circulars CSSF 25/870 and 26/904) Long Form Report – Practical rules concerning the self-assessment questionnaire to be submitted by investment firms – Mission and related reports
the réviseurs d’entreprises agréés (approved statutory auditors) CSSF circular PDF (216.53Kb) 9 January 2025 Circular CSSF 25/870 amending Circular CSSF 24/853 on the revised long form report for investment firms Long Form Report – Practical rules concerning the self-assessment questionnaire to be submitted by investment firms – Mission and related reports
the réviseurs d’entreprises agréés (approved statutory auditors) CSSF circular PDF (242.42Kb) Main topic: Markets in Financial Instruments (MiFID II/MiFIR) Relevant for Investment firms Circular CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 LONG FORM REPORT – Practical rules concerning the self-assessment questionnaire to be submitted by investment firms Mission and related reports
the réviseurs d’entreprises agréés (approved statutory auditors) CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 1/13 Circular CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 LONG FORM REPORT – Practical rules concerning the selfassessment questionnaire to be submitted by investment firms Mission and related reports
the réviseurs d’entreprises agréés (approved statutory auditors) To investment firms and Luxembourg branches
non-EU investment firms Luxembourg, 30 January 2024 Ladies and Gentlemen, The purpose
this circular is to introduce the key aspects
the revised long form report (the revised LFR) that applies to all investment firms as from the financial year ending on 31 December 2024. The revision
the long form report is the result
a thorough reconsideration
its objective, scope and content in order to realign it with the supervisory and prudential points
focus
the CSSF. Accordingly, the revised LFR has been designed with a view to allowing the CSSF to obtain relevant information as regards investment firms’ compliance with key regulatory provisions. In this view, the revised LFR allows the CSSF to gather sufficient information all the while further facilitating the implementation
a risk-based approach to supervision. In the review process, due consideration has been given to the principle
proportionality, as investment firms will only be required to provide information that is both relevant against the background
their business model and incremental compared to information already provided by them to the CSSF via other reporting obligations and channels, thus reducing redundancies between existing reports. With respect to its form and in line with the CSSF’s digital strategy (CSSF 4.0), the revised LFR turns digital to allow a more efficient reporting processing and ease data analysis. Its completion and submission will be required through the dedicated channel via the online portal
the CSSF. CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 2/13 Table
Contents 1. Scope
application .................................................................................................... 4 2. Overview
the revised LFR ......................................................................................... 4
the REA ................................................................................................ 6 4.
application
this Circular and are therefore designated as Partial Scope IF. In accordance with the principle
proportionality, the CSSF may adapt the requirements with respect to a specific Partial Scope IF on a case-by-case basis if the CSSF concludes that the IF’s risk profile 5 has changed. 2. Overview
the revised LFR 1. The revised LFR comprises four parts that shall be produced on a yearly basis in principle: 1) a Self-Assessment Questionnaire (the SAQ) to be filled in on a yearly basis by the investment firms. The requirement to complete an SAQ is based on the powers
the CSSF to obtain information from investment firms in the context
its legal supervisory mandate and in particular Article 53
the Law
5 April 1993 on the financial sector, as amended (the LFS) and Article 45
the Law
30 May 2018 on markets in financial instruments, as amended (the MiFID Law); 2) an Agreed-Upon Procedures report to be prepared by the réviseurs d’entreprises agréés (approved statutory auditors, the REA)
the investment firms in accordance with the International Standard on Related Services (ISRS) 4400 (Revised), in application
the legal provisions which authorise the CSSF to request an REA to carry out an audit in relation to one or more specific aspects
the activities and operations
institutions (Article 54
the LFS and Article 45
the MiFID Law) (the AUP report 6). Each year, the annual AUP report shall cover a sub-set
relevant MiFID aspects, whereas the AUP three-year-cycle will ensure the coverage
all relevant MiFID areas over a period
three
the Law
5 April 1993 on the financial sector, as amended (the LFS). As
the date
issuance
this circular, there is no CRR investment firm as defined in point
the LFS being incorporated in Luxembourg nor are there Luxembourg branches
third-country investment firms. 3 The In-Scope Class 3 IF concerned have been selected by the CSSF using a risk-based approach, considering certain representative risk attributes (e.g. business model, size). They were informed bilaterally that they were required to submit the revised LFR for the financial year ending 31 December 2023. 4 Small and non-interconnected investment firms as set out in Article 12
Regulation (EU) 2019/2033. 5 For this reassessment the CSSF considers all information available and assesses in particular whether the nature, size and complexity including the risks
the entity as a whole or
a specific risk attribute have changed. 6 This report must also cover the branches that the investment firm incorporated under Luxembourg law has abroad. 1 2 CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 4/13 3) a separate report on the protection
financial instruments and funds belonging to clients as required by Article 7
the Grand-ducal Regulation
30 May 2018 7 (the MiFID GDR) to be prepared on a yearly basis by the REA (the MiFID report 8); and 4) a separate report on the procedures set up by the investment firm concerning antimoney laundering and countering the financing
terrorism based on Articles 49
CSSF Regulation No 12-02
14 December 2012 (the RCSSF 12-02) 9 to be prepared on a yearly basis by the REA (the AML/CFT report). Partial Scope IF subject to the revised LFR for the first time for the financial year ending 31 December 2024 are exempted from the submission
the AUP report for the AUP threeyear-cycle starting at the financial year ending 31 December
the revised LFR form a single document. The SAQ to be completed by the investment firms represents a key element for defining the contents
the mission
the REA. The REA’s mission is not to validate the SAQ. However, considering the interlinkages between the SAQ and the AUP and MIFID reports
the REA, the REA shall take contact with the CSSF 11 should material errors having an impact on the extent
their work required under section 4
this Circular be identified in the SAQ.
the SAQ is to receive relevant and precise information in digital form with respect to governance and MiFID topics. 2. The SAQ is composed
a “General information” section and several thematic sections. The individual modules
the SAQ and their level
application as well as the applicable exemptions are directly recorded in the CSSF’s digital solution and are also described on the CSSF website. 3. To give due consideration to the varying business models
investment firms, the purpose
the “General information” section is to activate, based on the answers provided by the investment firm, only those thematic sections that are actually relevant against the background
an investment firm’s given business model. 4. The information communicated by the investment firm via the SAQ shall be accurate and as concise as possible and be in line with the prudential reporting figures as at the end
the financial year, where applicable. 7 Grand-ducal Regulation
30 May 2018 on the protection
financial instruments and funds belonging to clients, product governance obligations and the rules applicable to the provision or reception
fees, commissions or any monetary or non-monetary benefits, as amended. 8 This report must also cover the branches that the investment firm incorporated under Luxembourg law has abroad. 9 CSSF Regulation No 12-02
14 December 2012 on the fight against money laundering and terrorist financing, as amended. 10 Except for Section 6
the SAQ “Recommendations or observations raised”. 11 In accordance with Article 54
the LFS. CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 5/13 5. The investment firm is required to upload specific supporting documents as attached documents in the SAQ (e.g. organisation chart, IT flowchart, outsourcing register, summary report
the internal audit function). 4. The mission
the REA 1. Investment firms shall mandate in writing their REA to prepare, on annual basis, the reports listed below. The REA shall be the REA appointed by the investment firm for the statutory audit
its annual accounts. 4.1. 2. The AUP report(
individual thematic sections. Depending on the individual business model
an investment firm, certain thematic sections or procedures
the AUP may not be (fully) applicable. In this case, the REA shall explicitly mention it.
residence, date
account opening, MiFID categorisation, client risk profile), its transaction database (e.g., client reference, order reference, ISIN code
the financial instruments, type
financial instruments, nature
the order) and the nature
services effectively provided (discretionary asset management, advisory, execution only) to allow the REA to select a representative sample; b. the REA shall determine samples that are sufficiently diversified and representative in order to accurately reflect the composition
the Full-Scope IF’s client structure and the nature
the transactions performed. In this context, the REA shall notably provide an indication
the relative importance
the sample (for example, the number
the reviewed client files compared to the total number
client files
a specific nature) compared to the total population; c. the REA shall describe, if applicable, additional key elements taken into consideration for the composition
the sample. 7. The REA shall provide a detailed and meaningful description
the findings, if any, by type
clients, transactions and/or financial instruments. CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 6/13 4.2. 8. The MiFID report The MiFID report shall cover the adequacy
the arrangements under Article 37-1
the LFS, Article 13
the Law
5 August 2005 on financial collateral arrangements, as amended, and Section 2
the MiFID GDR. 9. The purpose
the MiFID report is to assess the reliability
the answers provided by an investment firm in the SAQ in relation to the protection
financial instruments and funds belonging to clients. 10. The authorised management
the investment firm is responsible for providing the REA with the required information in the SAQ for the drafting
the descriptive parts
the MiFID report. 11. The structure
the MiFID report shall follow the structure
the relevant section
the SAQ on the protection
financial instruments and funds belonging to clients.
financial instruments and funds belonging to clients): a. verify and ensure that these elements are correct and adequate; b. assess the appropriateness
the description provided by the investment firm; and c. perform appropriate control procedures to corroborate assertions set forth by the investment firm in the SAQ. Where applicable, the REA shall supplement the descriptive elements by items s/he deems appropriate. Where a specific item does not apply to the investment firm, the REA shall explicitly state it under the item concerned. 14. The REA shall describe the work performed and the findings, if any, and, where applicable, provide additional information on the aspects
the SAQ.
money laundering and terrorist financing as required for compliance with or as defined in: - Chapter 5
the LFS; - the Law
12 November 2004 on the fight against money laundering and terrorist financing, as amended (the AML/CFT Law); - the Grand-ducal Regulation
1 February 2010 providing details on certain provisions
the amended Law
12 November 2004 on the fight against money laundering and terrorist financing, as amended (the Grand-ducal Regulation 2010); - Regulation (EU) 2023/1113
the European Parliament and
the Council
31 May 2023 on information accompanying transfers
funds and certain crypto-assets and amending Directive (EU) 2015/849 (Regulation (EU) 2023/1113) CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 7/13 - international acts on the fight against terrorist financing brought to the attention
the investment firms through CSSF circulars; - CSSF regulations on the fight against money laundering and terrorist financing; - CSSF circulars relating to AML/CFT. 17. The AML/CFT report shall provide, in particular: - the description
the AML/CFT policy set up by the investment firm in order to prevent money laundering and terrorist financing, the verification
its compliance with the provisions
, Chapter 5
the LFS, the AML/CFT Law, the Grand-ducal Regulation 2010, the Regulation (EU) 2023/1113, the CSSF regulations and the CSSF circulars relating to AML/CFT and the control
their sound application; - the assessment
the investment firm’s analysis
money laundering and terrorist financing risks to which it is exposed. The REA must verify if the implemented procedures, infrastructures and controls, as well as the scope
the AML/CFT measures are appropriate considering the money laundering or terrorist financing (ML/TF) risks to which the investment firm is exposed, particularly through its activities, the nature
its customers and the provided products and services; - a declaration on whether an audit
compliance with the investment firm's AML/CFT policy has been performed by the internal audit function and the compliance
ficer in charge
the control
compliance with the professional obligations 12; - a short description
the training and awareness-raising measures for employees as regards money laundering and terrorist financing, and, in particular, with respect to the identification
money laundering and terrorist financing transactions; - statistics concerning the detected suspicious transactions which indicate the number
suspicious transaction cases reported to the FIU by the investment firm, as well as the total amount
funds involved during the financial year; - the control
the application
the provisions
Regulation (EU) 2023/1113 by the investment firm, in its respective role, and the percentage
the transfers
funds for which data on the payer or payee were missing or incomplete and the measures taken in this context by the investment firm. The AML/CFT report shall also provide: - a description
roles and responsibilities with regard to AML/CFT within the investment firm, including the roles and responsibilities
and the interactions between the management and the different departments and services, indicating the corresponding number
staff involved on AML/CFT matters. The AML/CFT report shall also include a description
the committees and the corresponding hierarchical and functional structures by indicating the general and particular delegations
power with respect to AML/CFT. It shall also provide a description by the investment firm and an assessment by the REA
the three-lines-
-defence model, as defined in Article 39
RCSSF 1202; - the list
persons involved in AML/CFT matters, as referred to in RCSSF 12-02 and Circular CSSF 20/758 on central administration, internal governance and risk management, as amended (compliance
ficer, person responsible for compliance, Chief 12 As defined in Article 1
RCSSF 12-02. CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 8/13 Compliance
ficer, etc.). It shall also state all the changes with regard to these persons which occurred during the financial year. Since these persons may delegate to members
staff certain operational tasks in relation to these functions, the AML/CFT report shall provide, where appropriate, a description
the delegation mechanism; a description
the network
national agencies, national and foreign subsidiaries, the - branches abroad, the foreign representative
fices and the tied agents, as well as the main related ML/FT risks. The AML/CFT report shall also indicate if the investment firm uses the services
external managers as regards the clients' assets and shall, where appropriate, provide a description
the manner in which the relationships with external managers are managed and documented from an AML/CFT perspective; a description
the investment firm’s commercial policy as well as the strategy regarding - the management
the related ML/FT risks. It shall also include a description
how the investment firm monitors and ensures compliance with its internal objectives with regard to ML/FT risk management. The REA shall assess if the investment firm has sufficient financial resources and the appropriate infrastructure to control ML/FT risks to which it is exposed. 18. When determining the sample, the CSSF expects the REA to apply a risk-based approach, taking into account the different business activities performed. The REA shall state the reference date
the sample data and provide relevant information on the methodology adopted for determining the sample (for example, the number
files reviewed compared to the total number
clients). Where the REA identifies cases
non-compliance with the legal or regulatory provisions or deficiencies, the REA shall give detailed indications enabling the CSSF to assess the situation (number
pending incomplete files as a percentage
the total number
reviewed files, details
the deficiencies identified, etc.). 19. Where applicable, the AML/CFT report must encompass the investment firm's branches, majority-owned subsidiaries abroad and tied agents. It must cover, in particular, the branches', majority-owned subsidiaries' and tied agents’ compliance with the applicable provisions as regards the prevention
money laundering and terrorist financing and it must include, in that respect: • an analysis
money laundering and terrorist financing risks incurred by the branches, majority-owned subsidiaries and tied agents; • a description and assessment
the money laundering and terrorist financing risk management in the branches, majority-owned subsidiaries and tied agents; • the verification
the implementation
, and compliance with, the investment firm's AML/CFT policy in the branches, majority-owned subsidiaries and tied agents. CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 9/13 20. The AML/CFT report must be sufficiently exhaustive and transparent, providing detailed descriptions and assessments, in order to allow a precise and informed judgement on the risks incurred by the investment firm with respect to money laundering and terrorist financing. With regard to the language used for the assessments, the AML/CFT report shall not include imprecise negative formulations (e.g. “We did not encounter serious weaknesses”) or global and approximative assessments (e.g. “We noted that most
the points comply with the laws and regulations”). The AML/CFT report shall rather provide a positive assessment for each area and subject by providing an overview
the adopted methodology (e.g. use
the sample technique, method for selecting the sample, etc.) and, where applicable, provide a description
the identified findings in order to allow the CSSF to better understand and judge the extent
the noticed irregularities and weaknesses.
any potential issues in relation to AML/CFT the investment firm may have with foreign competent authorities. 23. The authorised management
the investment firm is responsible for providing the REA with the required information for the drafting
the descriptive parts
the AML/CFT report. The REA may include in its report descriptive elements directly provided by the investment firm’s authorised management, but s/he shall verify and ensure that these elements are correct and adequate. If needed, s/he may have to perform some amendments. 24. In addition to the descriptive parts, the REA shall perform independently a detailed assessment
the ML/FT risks to which the investment firm is exposed as well as
the organisational aspects. This assessment shall be duly documented. 25. It should be noted that the REA must also inform the CSSF
all the suspicious transactions reported pursuant to Article 5
the AML/CFT Law, and which concern the investment firm. Similarly, the REA must inform the CSSF in case they deem that the investment firm should have reported a suspicious transaction but has not, explaining their reasoning and having regard to the investment firm’s rationale. When discussing the cases with the investment firm, the REA needs to be mindful
applicable professional obligations.
the financial year, in accordance with the procedure described in Section 5.
the partner in charge
the mandate with the audit firm s/he represents. 4. The REA submits the AUP report(s) to the investment firm, which can provide comments on the findings identified by the REA. These comments do not form part
the AUP report(s). The AUP report(s) must be submitted subsequently by the investment firm to the CSSF.
the financial year, in accordance with the procedure described in Section 5.
(
the CSSF. 8. A user guide “Authentication and user account management” is available to investment firms via the eDesk portal
the CSSF. 13 The CSSF will only have access to the answers
the investment firm once the SAQ is approved and uploaded (i.e. the CSSF has no access to preliminary answers provided in the draft SAQ by the investment firm). 14 It has to be noted that the CSSF digital solution includes a roll-forward functionality that will allow investment firm to update the SAQ
year N+1 based on the answers provided in the SAQ
year N. CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 11/13
the scope
application
Circular CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 12/13 Annex I: Overview
the scope
application
Circular CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 Questionnaire / Report Full Scope IF Partial Scope IF SAQ Required Required AUP report Required Exempted MiFID report Required Required AML/CFT report Required Required required CIRCULAR CSSF 24/853 as amended by Circulars CSSF 25/870 and 26/904 13/13 Circular CSSF 25/870 Update
Circular CSSF 24/853 on the Long Form Report Practical rules concerning the self-assessment questionnaire to be submitted by investment firms Mission and related reports
the réviseurs d’entreprises agréés (approved statutory auditors) CIRCULAR CSSF 25/870 1/17 Circular CSSF 25/870 Update
Circular CSSF 24/853 on the Long Form Report Practical rules concerning the self-assessment questionnaire to be submitted by investment firms Mission and related reports
the réviseurs d’entreprises agréés (approved statutory auditors) To investment firms and Luxembourg branches
non-EU investment firms Luxembourg, 9 January 2025 Ladies and Gentlemen, The purpose
this circular is to amend Circular CSSF 24/853 on the revised long form report (revised LFR) by enlarging its scope
application for the financial year ending 31 December 2024 compared to 31 December 2023. Whereas, for the financial year ending 31 December 2023, the revised LFR was applicable only to a sample
investment firms, namely (
proportionality, the CSSF introduces a reduced scope
the requirements for the investment firms that are subject to the provisions
Circular CSSF 24/853 for the first time as from the year ending 31 December 2024, as regards the reports to be prepared by their réviseur d’entreprises agréé. These investment firms5 (the Partial Scope IF) are exempted from the requirement to submit the Agreed Upon Procedure (AUP) reports as part
their revised LFR. However, the report on the protection
financial instruments and funds belonging to clients to be produced in accordance with the Grand-ducal Regulation
30 May 2018 and the report on anti-money laundering and countering the financing
terrorism (AML/CFT) based on Articles 49
CSSF Regulation No 12-02
14 December 2012 are mandatory for all investment firms and shall therefore also be submitted by these investment firms. Finally, certain investment firms may be exempted by the CSSF from this Circular notably where the requirements would represent an undue burden, in consideration
their specific and exceptional situation (e.g. investment firms that have announced the winding down
their operations). These investment firms remain subject to Circular CSSF 03/113. As defined in point (9a-2)
the Law
5 April 1993 on the financial sector, as amended (the LFS). As
the date
issuance
this circular, there is no CRR investment firm as defined in point
the LFS being incorporated in Luxembourg nor are there Luxembourg branches
third-country investment firms. 3 The In-Scope Class 3 IF concerned have been selected by the CSSF using a risk-based approach, considering certain representative risk attributes (e.g. business model, size). They were informed bilaterally that they are required to submit the revised LFR for the financial year ending 31 December 2023. 4 Small and non-interconnected investment firms as set out in Article 12
Regulation (EU) 2019/2033. 5 Certain SNI IFR investment firms incorporated under Luxembourg law, including their branches which, by reference to their risk attributes, represent a comparably lesser risk. 1 2 CIRCULAR CSSF 25/870 2/17 Please refer to Annex 1 for the details
the amendments to Circular CSSF 24/853. Claude WAMPACH Director Françoise KAUTHEN Director Marco ZWICK Director Jean-Pierre FABER Director Claude MARX Director General Annex 1: Circular CSSF 24/853, as amended by Circular CSSF 25/870 CIRCULAR CSSF 25/870 3/17 Annex 1: Circular CSSF 24/853 as amended by Circular CSSF 25/870 LONG FORM REPORT – Practical rules concerning the selfassessment questionnaire to be submitted by investment firms Mission and related reports
the réviseurs d’entreprises agréés (approved statutory auditors) To investment firms and Luxembourg branches
non-EU investment firms Luxembourg, 30 January 2024 Ladies and Gentlemen, The purpose
this circular is to introduce the key aspects
the revised long form report (the revised LFR) that will applyies to all investment firms as from the financial year ending on 31 December 2024. for the financial year ending 31 December 2023 for the first time for a sample
investment firms, namely all non-SNI IFR investment firms6 incorporated under Luxembourg law, including their branches (the In-Scope Class 2 IF)7 and certain8 SNI IFR investment firms9 incorporated under Luxembourg law, including their branches (the In-Scope Class 3 IF), (hereafter collectively the In-Scope IF). Class 3 IF that are out
scope
the revised LFR are required to submit the long form report drawn up in accordance with Circular CSSF 03/113 for the financial year ending 31 December 2023. As from the financial year ending after 31 December 2023, all investment firms will be subject to the revised LFR. The revision
the long form report is the result
a thorough reconsideration
its objective, scope and content in order to realign it with the supervisory and prudential points
focus
the CSSF. Accordingly, the revised LFR has been designed with a view to allowing the CSSF to obtain relevant information as regards investment firms’ compliance with key regulatory provisions. In this view, the revised LFR allows the CSSF to gather sufficient information all the while further facilitating the implementation
a risk-based approach to supervision. In the review process, due consideration has been given to the principle
proportionality, as investment firms will only be required to provide information that is both relevant against the background
their business model and incremental compared to information already provided by them to the CSSF via other reporting obligations and channels, thus reducing redundancies between existing reports. With respect to its form and in line with the CSSF’s digital strategy (CSSF 4.0), the revised LFR turns digital to allow a more efficient reporting processing and ease data analysis. Its completion and submission will be are required through the dedicated channel via the online portal
the CSSF. As defined in point (9a-2)
the Law
5 April 1993 on the financial sector, as amended (the LFS). As
the date
issuance
this circular, there is no CRR investment firm as defined in point
the LFS being incorporated in Luxembourg nor are there Luxembourg branches
third-country investment firms. 8 The In-Scope Class 3 IF concerned have been selected by the CSSF using a risk-based approach, considering certain representative risk attributes (e.g. business model, size). They were informed bilaterally that they are required to submit the revised LFR for the financial year ending 31 December 2023. 9 Small and non-interconnected investment firms as set out in Article 12
Regulation (EU) 2019/2033. 6 7 CIRCULAR CSSF 25/870 4/17 . Table
Contents 1. Scope
application ....................................................................................................... 6 2. Overview
the revised LFR............................................................................................ 6
the REA .................................................................................................. 8 4.
application
this Circular and are therefore designated as Partial Scope IF. In accordance with the principle
proportionality, the CSSF may adapt the requirements with respect to a specific Partial Scope IF on a case-by-case basis if the CSSF concludes that the IF’s risk profile5 has changed. 1.2. Overview
the revised LFR 1. The revised LFR comprises four parts that shall be produced on a yearly basis in principle: 1) a Self-Assessment Questionnaire (the SAQ) to be filled in on a yearly basis by the investment firms. The requirement to complete an SAQ is based on the powers
the CSSF to obtain information from investment firms in the context
its legal supervisory mandate and in particular Article 53
the Law
5 April 1993 on the financial sector, as amended (the LFS) and Article 45
the Law
30 May 2018 on markets in financial instruments, as amended (the MiFID Law); 2) an Agreed-Upon Procedures report to be prepared by the réviseurs d’entreprises agréés (approved statutory auditors, the REA)
the investment firms in accordance with the International Standard on Related Services (ISRS) 4400 (Revised), in application
the legal provisions which authorise the CSSF to request an REA to carry out an audit in relation to one or more specific aspects
the activities and operations
institutions (Article 54
the LFS and Article 45
the MiFID Law) (the AUP report6). Each year, the annual AUP report shall cover a sub-set
relevant MiFID aspects, whereas the AUP three-year-cycle will ensure the coverage
all relevant MiFID areas over a period
three
the Law
5 April 1993 on the financial sector, as amended (the LFS). As
the date
issuance
this circular, there is no CRR investment firm as defined in point
the LFS being incorporated in Luxembourg nor are there Luxembourg branches
third-country investment firms. 3 The In-Scope Class 3 IF concerned have been selected by the CSSF using a risk-based approach, considering certain representative risk attributes (e.g. business model, size). They were informed bilaterally that they were required to submit the revised LFR for the financial year ending 31 December 2023. 4 Small and non-interconnected investment firms as set out in Article 12
Regulation (EU) 2019/2033. 5 For this reassessment the CSSF considers all information available and assesses in particular whether the nature, size and complexity including the risks
the entity as a whole or
a specific risk attribute have changed. 6 This report must also cover the branches that the investment firm incorporated under Luxembourg law has abroad. 1 2 CIRCULAR CSSF 25/870 6/17 3) a separate report on the protection
financial instruments and funds belonging to clients as required by Article 7
the Grand-ducal Regulation
30 May 20187 (the MiFID GDR) to be prepared on a yearly basis by the REA (the MiFID report8); and 4) a separate report on the procedures set up by the investment firm concerning antimoney laundering and countering the financing
terrorism based on Articles 49
CSSF Regulation No 12-02
14 December 2012 (the RCSSF 12-02)9 to be prepared on a yearly basis by the REA (the AML/CFT report). Partial Scope IF subject to the revised LFR for the first time for the financial year ending 31 December 2024 are exempted from the submission
the AUP report for the AUP threeyear-cycle starting at the financial year ending 31 December
the revised LFR form a single document. The SAQ to be completed by the investment firms represents a key element for defining the contents
the mission
the REA. The REA’s mission is not to validate the SAQ. However, considering the interlinkages between the SAQ and the AUP and MIFID reports
the REA, the REA shall take contact with the CSSF11 should material errors having an impact on the extent
their work required under section 4
this Circular be identified in the SAQ. 2.
the SAQ is to receive relevant and precise information in digital form with respect to governance and MiFID topics. 2. The SAQ is composed
a “General information” section and 6 thematic sections. For more detailed information, please refer to Annex I. 3. To give due consideration to the varying business models
investment firms, the purpose
the “General information” section is to activate, based on the answers provided by the investment firmIn-Scope IF, only those thematic sections that are actually relevant against the background
an investment firm’s given business model. 4. The information communicated by the In-Scope IFinvestment firm via the SAQ shall be accurate and as concise as possible and be in line with the prudential reporting figures as at the end
the financial year, where applicable. 5. The In-Scope IFinvestment firm is required to upload specific supporting documents as attached documents in the SAQ (e.g. organisation chart, IT flowchart, outsourcing register, summary report
the internal audit function). Grand-ducal Regulation
30 May 2018 on the protection
financial instruments and funds belonging to clients, product governance obligations and the rules applicable to the provision or reception
fees, commissions or any monetary or non-monetary benefits, as amended. 8 This report must also cover the branches that the investment firm incorporated under Luxembourg law has abroad. 9 CSSF Regulation No 12-02
14 December 2012 on the fight against money laundering and terrorist financing, as amended. 10 Except for Section 6
the SAQ “Recommendations or observations raised”. 11 In accordance with Article 54
the LFS. 7 CIRCULAR CSSF 25/870 7/17 3.4. The mission
the REA 1. Investment firms shall mandate in writing their REA to prepare, on annual basis, the reports listed below. The REA shall be the REA appointed by the investment firm for the statutory audit
its annual accounts. 3.1.4.1. The AUP report(
individual thematic sections. Depending on the individual business model
an investment firm, certain thematic sections or procedures
the AUP may not be (fully) applicable. In this case, the REA shall explicitly mention it.
residence, date
account opening, MiFID categorisation, client risk profile), its transaction database (e.g., client reference, order reference, ISIN code
the financial instruments, type
financial instruments, nature
the order) and the nature
services effectively provided (discretionary asset management, advisory, execution only) to allow the REA to select a representative sample; b. the REA shall determine samples that are sufficiently diversified and representative in order to accurately reflect the composition
the In-ScopeFull-Scope IF’s client structure and the nature
the transactions performed. In this context, the REA shall notably provide an indication
the relative importance
the sample (for example, the number
the reviewed client files compared to the total number
client files
a specific nature) compared to the total population; c. the REA shall describe, if applicable, additional key elements taken into consideration for the composition
the sample. 7. The REA shall provide a detailed and meaningful description
the findings, if any, by type
clients, transactions and/or financial instruments. CIRCULAR CSSF 25/870 8/17 3.2.4.
the arrangements under Article 37-1
the LFS, Article 13
the Law
5 August 2005 on financial collateral arrangements, as amended, and Section 2
the MiFID GDR. 9. The purpose
the MiFID report is to assess the reliability
the answers provided by an investment firm in the SAQ in relation to the protection
financial instruments and funds belonging to clients. 10. The authorised management
the investment firm is responsible for providing the REA with the required information in the SAQ for the drafting
the descriptive parts
the MiFID report. 11. The structure
the MiFID report shall follow the structure
the relevant section
the SAQ on the protection
financial instruments and funds belonging to clients.
financial instruments and funds belonging to clients): a. verify and ensure that these elements are correct and adequate; b. assess the appropriateness
the description provided by the investment firm; and c. perform appropriate control procedures to corroborate assertions set forth by the investment firm in the SAQ. Where applicable, the REA shall supplement the descriptive elements by items s/he deems appropriate. Where a specific item does not apply to the investment firm, the REA shall explicitly state it under the item concerned. 14. The REA shall describe the work performed and the findings, if any, and, where applicable, provide additional information on the aspects
the SAQ., in accordance with point 16
this section.
money laundering and terrorist financing as required for compliance with or as defined in: - Chapter 5
the LFS; - the Law
12 November 2004 on the fight against money laundering and terrorist financing, as amended (the AML/CFT Law); - the Grand-ducal Regulation
1 February 2010 providing details on certain provisions
the amended Law
12 November 2004 on the fight against money laundering and terrorist financing, as amended (the Grand-ducal Regulation 2010); CIRCULAR CSSF 25/870 9/17 - Regulation (EU) 2015/847
the European Parliament and
the Council
20 May 2015 on information accompanying transfers
funds, as amended (the Regulation (EU) 2015/84712); - international acts on the fight against terrorist financing brought to the attention
the investment firms through CSSF circulars; - CSSF regulations on the fight against money laundering and terrorist financing; - CSSF circulars relating to AML/CFT. 17. The AML/CFT report shall provide, in particular: - the description
the AML/CFT policy set up by the investment firm in order to prevent money laundering and terrorist financing, the verification
its compliance with the provisions
, Chapter 5
the LFS, the AML/CFT Law, the Grand-ducal Regulation 2010, the Regulation (EU) 2015/847, the CSSF regulations and the CSSF circulars relating to AML/CFT and the control
their sound application; - the assessment
the investment firm’s analysis
money laundering and terrorist financing risks to which it is exposed. The REA must verify if the implemented procedures, infrastructures and controls, as well as the scope
the AML/CFT measures are appropriate considering the money laundering or terrorist financing (ML/FTF) risks to which the investment firm is exposed, particularly through its activities, the nature
its customers and the provided products and services; - a declaration on whether an audit
compliance with the investment firm's AML/CFT policy has been performed by the internal audit function and the compliance
ficer in charge
the control
compliance with the professional obligations13; - a short description
the training and awareness-raising measures for employees as regards money laundering and terrorist financing, and, in particular, with respect to the identification
money laundering and terrorist financing transactions; - statistics concerning the detected suspicious transactions which indicate the number
suspicious transaction cases reported to the FIU by the investment firm, as well as the total amount
funds involved during the financial year; - the control
the application
the provisions
Regulation (EU) 2015/847 by the investment firm, in its respective role, and the percentage
the transfers
funds for which data on the payer or payee were missing or incomplete and the measures taken in this context by the investment firm. The AML/CFT report shall also provide: - a description
roles and responsibilities with regard to AML/CFT within the investment firm, including the roles and responsibilities
and the interactions between the management and the different departments and services, indicating the corresponding number
staff involved on AML/CFT matters. The AML/CFT report shall also include a description
the committees and the corresponding hierarchical and functional structures by indicating the general and particular delegations
power with respect to AML/CFT. It shall also provide a description by the investment firm and an assessment which has been replaced by the Regulation (EU) 2023/1113 which applies as
30 December 2024. Please refer to draft bill 8387 which will operationalise said regulation. 13 As defined in Article 1
RCSSF 12-02. 12 CIRCULAR CSSF 25/870 10/17 by the REA
the three-lines-
-defence model, as defined in Article 39
RCSSF 1202; the list
persons involved in AML/CFT matters, as referred to in RCSSF 12-02 and - Circular CSSF 20/758 on central administration, internal governance and risk management, as amended (compliance
ficer, person responsible for compliance, Chief Compliance
ficer, etc.). It shall also state all the changes with regard to these persons which occurred during the financial year. Since these persons may delegate to members
staff certain operational tasks in relation to these functions, the AML/CFT report shall provide, where appropriate, a description
the delegation mechanism; a description
the network
national agencies, national and foreign subsidiaries, the - branches abroad, the foreign representative
fices and the tied agents, as well as the main related ML/FT risks. The AML/CFT report shall also indicate if the investment firm uses the services
external managers as regards the clients' assets and shall, where appropriate, provide a description
the manner in which the relationships with external managers are managed and documented from an AML/CFT perspective; a description
the investment firm’s commercial policy as well as the strategy regarding - the management
the related ML/FT risks. It shall also include a description
how the investment firm monitors and ensures compliance with its internal objectives with regard to ML/FT risk management. The REA shall assess if the investment firm has sufficient financial resources and the appropriate infrastructure to control ML/FT risks to which it is exposed. 18. When determining the sample, the CSSF expects the REA to apply a risk-based approach, taking into account the different business activities performed. The REA shall state the reference date
the sample data and provide relevant information on the methodology adopted for determining the sample (for example, the number
files reviewed compared to the total number
clients). Where the REA identifies cases
non-compliance with the legal or regulatory provisions or deficiencies, the REA shall give detailed indications enabling the CSSF to assess the situation (number
pending incomplete files as a percentage
the total number
reviewed files, details
the deficiencies identified, etc.). 19. Where applicable, the AML/CFT report must encompass the investment firm's branches, majority-owned subsidiaries abroad and tied agents. It must cover, in particular, the branches', majority-owned subsidiaries' and tied agents’ compliance with the applicable provisions as regards the prevention
money laundering and terrorist financing and it must include, in that respect: • an analysis
money laundering and terrorist financing risks incurred by the branches, majority-owned subsidiaries and tied agents; • a description and assessment
the money laundering and terrorist financing risk management in the branches, majority-owned subsidiaries and tied agents; • the verification
the implementation
, and compliance with, the investment firm's AML/CFT policy in the branches, majority-owned subsidiaries and tied agents. CIRCULAR CSSF 25/870 11/17 20. The AML/CFT report must be sufficiently exhaustive and transparent, providing detailed descriptions and assessments, in order to allow a precise and informed judgement on the risks incurred by the investment firm with respect to money laundering and terrorist financing. With regard to the language used for the assessments, the AML/CFT report shall not include imprecise negative formulations (e.g. “We did not encounter serious weaknesses”) or global and approximative assessments (e.g. “We noted that most
the points comply with the laws and regulations”). The AML/CFT report shall rather provide a positive assessment for each area and subject by providing an overview
the adopted methodology (e.g. use
the sample technique, method for selecting the sample, etc.) and, where applicable, provide a description
the identified findings in order to allow the CSSF to better understand and judge the extent
the noticed irregularities and weaknesses.
any potential issues in relation to AML/CFT the investment firm may have with foreign competent authorities. 23. The authorised management
the investment firm is responsible for providing the REA with the required information for the drafting
the descriptive parts
the AML/CFT report. The REA may include in its report descriptive elements directly provided by the investment firm’s authorised management, but s/he shall verify and ensure that these elements are correct and adequate. If needed, s/he may have to perform some amendments. 24. In addition to the descriptive parts, the REA shall perform independently a detailed assessment
the ML/FT risks to which the investment firm is exposed as well as
the organisational aspects. This assessment shall be duly documented. 25. It should be noted that the REA must also inform the CSSF
all the suspicious transactions reported pursuant to Article 5
the AML/CFT Law, and which concern the investment firms. Similarly, the REA must inform the CSSF in case they deem that the investment firm should have reported a suspicious transaction but has not, explaining his/hertheir reasoning and having regard to the investment firm’s rationale. When discussing the cases with the investment firm, the REA needs to be mindful
applicable professional obligations.
the financial year, in accordance with the procedure described in Section 54.
the financial year. 4.2.5.
the partner in charge
the mandate with the audit firm s/he represents. 4.5. The REA submits the AUP report(s) to the investment firm, which can provide comments on the findings identified by the REA. These comments do not form part
the AUP report(s). The AUP report(s) must be submitted subsequently by the investment firm to the CSSF. 5.
the financial year, in accordance with the procedure described in Section 54.
the financial year. 4.3.5.
(
the CSSF. 9. A user guide “Authentication and user account management” will beis available to investment firms via the eDesk portal
the CSSF. The CSSF will only have access to the answers
the investment firm once the SAQ is approved and uploaded (i.e. the CSSF has no access to preliminary answers provided in the draft SAQ by the investment firm). 15 It has to be noted that the CSSF digital solution includes a roll-forward functionality that will allow investment firm to update the SAQ
year N+1 based on the answers provided in the SAQ
year N. 14 CIRCULAR CSSF 25/870 13/17 5.
Circular CSSF 03/113, as amended by Circulars CSSF 10/486 and CSSF 21/768, related to practical rules concerning the role
the réviseurs d’entreprises agréés (approved statutory auditors) in investment firms no longer apply from the respective dates
entry into force
this circular, as provided for in paragraphs 1 and 2
this section. Claude WAMPACH Director Françoise KAUTHEN Director Marco ZWICK Director Jean-Pierre FABER Director Claude MARX Director General Annex I Overview
the SAQ sections and the level
application
each section Annex II Overview
the scope
application
Circular CSSF 24/853 as amended by Circular CSSF 25/870 CIRCULAR CSSF 25/870 14/17 Annex 1I: Overview
the SAQ sections and the level
application
each section Section Description Level
application Internal governance 1.a. Governance - Management body and key function holders Overview
the composition
the management body and key function holders and
the allocation
role and responsibilities within the investment firm. Overview
the organisation and functioning
on an individual basis, excluding branches, if any. the management body,
the internal control functions,
the 1.b. Governance - Internal governance financial and accounting function and IT function as well as on an individual basis, excluding branches, if arrangements internal governance arrangements pertaining to the code
any. conduct, the management
conflicts
interest, the remuneration policy
the investment firm. MiFID Overview
internal control framework regarding MiFID 2.a. MiFID internal control framework implemented by the investment firm, taking into account the on an individual basis, excluding branches, if MiFID investment activities effectively carried out and MiFID any. service effectively provided by the investment firm. 2.b. MiFID Overview
the arrangements put in place by the investment Protection
financial instruments and firm to ensure the safeguarding
client financial instruments funds belonging to clients and funds. 2.c. MiFID - Portfolio managers, tied agents, business providers, representation
fices and free provision
services. CIRCULAR CSSF 25/870 on an individual basis, including branches, if any. Overview
the portfolio managers, tied agents, business providers, representation
fices as well as
the free on an individual basis, excluding branches, if provision
services by the investment firm within the any. territory
another member country
the EEA. 15/17 Section Description Level
application Other topics Overview
the claims registered by the investment firm 3. Table listing the claims during the financial year in accordance with CSSF Regulation on an individual basis, including branches, No 16-07 relating to out-
-court complaint resolution and if any. Circular CSSF 17/671. Overview
the foreign branches, including a description
4. Foreign branches how corporate, commercial and risk group policies are applied Foreign branches located in another Member in the foreign branches, as well as an overview
the controls State or in a third country. in place.
the internal control framework in place in on an individual basis, including branches, connection with related parties. if any. Overview
the recommendations and/or observations raised by the REA or internal control functions, if any. on an individual basis, including branches, if any and subsidiaries (in case
prudential consolidation) if any. 16/17 Annex II: Overview
the scope
application
Circular CSSF 24/853 as amended by Circular CSSF 25/870 Questionnaire / Report Full Scope IF Partial Scope IF SAQ Required Required AUP report Required Exempted MiFID report Required Required AML/CFT report Required Required required CIRCULAR CSSF 25/870
AI explanation based on the official legal text. Indicative, not a substitute for legal advice.