New CSSF circular simplifying reporting linked to the long-form report and new submission deadline for management letter

This newsflash highlights the features of the new Circular CSSF 23/845 that is relevant for credit institutions incorporated under Luxembourg law,¹ including their branches, and Luxembourg branches of third-country credit institutions (Institutions). It significantly simplifies the reports that approved statutory auditors provide according to Circular CSSF 22/821 and Circular CSSF 22/826.

On 15 November 2023, the CSSF² published Circular 23/845³ applying to the Institutions as from 31 December 2023. It amends Circular CSSF 22/821 on the long-form report (LFR)⁴ by incorporating important industry feedback. The amendments include:

• aligning the self-assessment questionnaire (Self-Assessment Questionnaire or SAQ) Institutions submit with supervisory focus; and
• adapting the reports on the protection of financial instruments and funds belonging to clients (Financial Instruments and Funds Report), and the report on the procedures set up by Institutions concerning the prevention of money laundering and terrorist financing (AML/CFT Report), to be established by the approved statutory auditors (réviseurs d’entreprises agréés or REA).

Provisions regarding the statutory audit mandate in Circular CSSF 22/826 have also been modified, matching the submission deadline for the management letter to the other reporting deadlines.

 

Amendments to Circular CSSF 22/821

New framework for the revised LFR

Circular CSSF 23/845 will no longer require Institutions to prepare and submit the Agreed Upon Procedures Report⁵ (AUP Report) within the revised LFR. Instead, they will only have to submit these reports:

• The Self-Assessment Questionnaire – it covers domains in scope of the prudential supervision for which the CSSF or the European Central Bank are competent, except for the sections of the self-assessment questionnaire covering matters relating to the Market in Financial Instruments Directive (MiFID),⁶ the Payment Services Directive (PSD2)⁷ and undertaking for collective investments (UCI) depositaries, which are the exclusive competence of the CSSF.
• Circular CSSF 23/845 will increase the volume of information to be assessed and communicated by the Institutions, by including the following five thematic sections:
• credit and counterparty risk
• interest rate risk in the banking book and credit spread risk arising from non-trading book activities
• liquidity risk
• strong customer authentication and secure communication following PSD2
• climate-related and environmental risks

• Two separate reports to be provided by the REA under the exclusive competence of the CSSF are:
• the Financial Instruments and Funds Report, to be prepared according to the provisions of the law of 5 April 1993 on the financial sector, as amended (LFS), with views to ensuring the reliability of the answers provided by Institutions in the SAQ; and
• the AML/CTF Report (together with the Financial Instruments and Funds Report, the REA Reports) describing the procedures set up by Institutions in a comprehensive and transparent way, ensuring a precise and informed evaluation of the Institution's risks concerning money laundering and terrorist financing.

Circular CSSF 23/845 retains the general regulatory framework, removing references to the AUP Report. While the authorised management of the Institutions are responsible for providing the required information for the drafting of REA Reports, the REA will always perform a detailed assessment to verify and ensure these elements are precise and appropriate.

Submission procedures

Maintaining the original deadlines, the Self-Assessment Questionnaire must be transmitted on an annual basis to the CSSF within three months after the closure of the financial year. The Institutions have a submission deadline for the REA Reports of five months after the closure of the financial year.

 

Amendments to Circular CSSF 22/826

Covering the same scope of application as Circular CSSF 22/821, Circular CSSF 22/826, as amended by Circular CSSF 23/845, defines the statutory audit mandate and the content of the reports and written comments issued by the REA, in the context of its audit of the annual accounting documents and its reporting obligations under the LFS.

According to the amendments, the CSSF will require Institutions to submit the management letter⁸ of the REA (on a statutory or consolidated basis) within six months after the closure of the financial year, as from the entry into force of the new circular.

This new submission deadline has been set to enhance a better alignment with the deadline for the REA Reports in Circular CSSF 22/821, as amended.

 

Contact information

If you have any questions or requests on this topic, or if you require further clarification or legal advice, please do not hesitate to contact our regulatory team in Luxembourg.

---

¹This circular applies to significant supervised entities and less significant supervised entities as defined in Article 2, points (16) and (7) of Regulation (EU) No 468/2014 of the European Central Bank (ECB) of 16 April 2014, as amended (SSM Framework Regulation) respectively.
² The Commission de Surveillance du Secteur Financier (CSSF).
³ Circular CSSF 23/845: Update of Circular CSSF 22/821 on the long form report and Circular CSSF 22/826 on the statutory audit mandate (Circular 23/845).
⁴ As defined by Circular 22/821, as amended.
⁵ Prepared by the REA under ISRS 4400 (revised) Standard.
⁶ Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments.
⁷ Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC.
⁸ The management letter through which the REA must report, in accordance with the applicable auditing standards, the weaknesses and points needing improvement that s/he observed during their statutory audit of annual accounts of an Institution, according to Circular 22/826 as amended.