CSSF publishes Circular CSSF 24/850 defining the documents to be submitted annually by support PFS and their “réviseurs d’entreprises agréés” (approved statutory auditors)
Background
CSSF Circulars 12/544 and 19/727 have been the framework for support PFS in Luxembourg in the context of reporting to the CSSF for the past years. The pillars of this framework are the principle of proportionality according to the relevance of the activity exercised by the support PFS and the self-management and assessment. The support PFS were required to submit a Risk Analysis Report (“RAR”) and a Descriptive Report (“DR”).
What's new?
On 19 January 2024 the CSSF published Circular 24/850, repealing Circulars CSSF 12/544 and CSSF 19/727, introducing – as done before for the Credit Institutions, under CSSF Circular 22/821- the self-assessment questionaire (“SAQ”), to be completed by support PFSs and submitted to the CSSF instead of the RAR. The Circular also simplifies the DR to be provided, again, on annual basis.
In this sense, the support PFS must submit annually the following documents:
- The SAQ (including the regulatory developments and the main points that the CSSF intends to bring to support PSF’s attention)
- The simplified DR adapted to Annex 1 of the Circular
- All other expected documents listed in Annex 2 of the Circular
The SAQ is to be completed and submitted by every support PFS or each period subject to statutory audit with the main objective the institutions perform a self-assessment on certain risks and of their compliance with regards to legal and regulatory requirements. It represents the result of an in-depth review of the objective and content of the information the CSSF requests to receive on the support PFS’ self -assessment and management of the risks to that it may expose the financial sector. It considers the regulatory developments and the main points that the CSSF intends to bring to the support PFS’s attention.
The SAQ is split into four sections which the support PFSs will fill in accordance with the authorisation they held. The sections are the following:
- ICT-related aspects
- Operational aspects
- Transversal aspects (except “AML/CFT aspects”)
- Anti-money Laundering and counter-terrorist financing aspects
Please note, that the risk-based approach is still applicable. The extent of the SAQ and the of the procedures to be performed by the REA is linked to this approach, meaning that the number of questions to be filled in will depend on the risk the specific support PFS has according to a new rating system put in place by the CSSF, in order to determine the risk to which every support PFS is exposing the financial sector. In other words, a support PFS that is considered less risky will have to respond to a limited number of questions and will be subject to a smaller number of specific procedures to be performed by its REA. Support PSF will be informed about its risk category on annual basis and at the latest at the closing of its financial year with the possibility to request for details about the selected criteria to define the risk rating.The self-assessment questionnaire detailing the questions for each section and their allocation in accordance with the different support PFS risk categories is available here.
What's next?
The above-mentioned requirements and regulatory framework apply for the first time for financial years closing on December 31, 2023, or after December 31, 2023. For this first year of application, the in-scope entities will be informed about their risk categories at the latest on 19 February 2024.
The self-assessment questionnaire must be submitted to the CSSF by the persons responsible for the support PFS on an annual basis, within seven months of the closing of the support PFS’ financial year at the latest.
For the first exercise, the CSSF will communicate to the support PFS, through its online MFT system, the content of the self-assessment questionnaire and the tests of the separate report applicable to it based on its accreditations and the risk it poses to the financial sector.
