3 minute read 15 Feb 2022
CSSF reinforces requirements to counter financial crime

CSSF reinforces requirements to counter financial crime

Authors
Christophe Wintgens

EY Luxembourg Assurance Partner, Wealth and Asset Management Leader

Pragmatism is my essence. Results are key. Internal audit and Anti-Money Laundering are my playing fields. Storing exclusive cars is my passion.

Christine Frentz

EY Luxembourg Partner, Extended Assurance

AML / KYC expert with over 16 years within audit and financial services including more than 10 years within regulatory and compliance engagements. Market focused. Ability to manage large engagements.

3 minute read 15 Feb 2022

Since the dawn of the COVID-19 pandemic, perpetrators of financial crime have taken advantage of the resulting economic instability and uncertainty. An increase in the use of digital payments, the rising popularity of virtual currencies, and the accelerated rate of technological advancement have all aided criminals in finding new opportunities to launder money at greater speeds and larger volumes.

To counter this risk, the Luxembourg regulator CSSF, issued Circular 21/788 in December 2021 which, alongside Circulars 21/789 and 21/790, reinforces the regulatory requirements for investment fund managers (IFMs), as well as investment funds under the supervision of the CSSF. The three respective Circulars cover topics relating to anti-money laundering and counter-terrorist financing (AML/CTF), as well as governance and internal controls.

These Circulars reforming the Long-Form Report have a significant impact on IFMs as well as their réviseurs d’entreprises agréés (REAs) or ‘independent auditors’. Focusing specifically on Circular 21/788, the REAs will now be required to verify the responses given by the fund managers in their annual CSSF AML/CFT survey. Further, sample testing or specific procedures will need to be performed by the REA – the sample size of which will be determined by the methodology set of the CSSF using a risk-based approach.

The Circular follows the changes to the CSSF Regulation 12-02 published in August 2020. The amendments include the new Article 49, which pertains to external reports on AML/CFT compliance.

Why now?

Luxembourg’s existing AML and CTF regulations for investment funds are extensive and apply to both regulated and unregulated funds.

According Luxembourg Financial Intelligence Report (2020), there has been an decrease in total number of suspicious reports, however fraud, tax evasion and corruption continue to be areas of concern to banks, asset managers, insurers and the regulators. Examples of financial crime include simple, traditional phishing emails duping investors to hand over funds to fraudsters, but also span to the creation of complex, multifaceted networks and structures which are difficult to detect.

To protect themselves and their investors from financial crime, IFMs must comply with the regulations and take appropriate steps to ensure that serious financial risks are mitigated. Implementing robust, secure and advanced technological solutions that help automate manual tasks can reduce the opportunities for financial crime to occur. Adopting sustainable and compliant frameworks as regards to AML/CTF and tax can also safeguard against the risks.

One such approach to help supervise the effectiveness of an entity’s processes to protect against financial crime is the annual CSSF AML/CFT survey. This cross-sector survey aims to collect key information relating to the risks of money laundering and terrorist financing, as well as the measures taken by IFMs to mitigate these risks. The survey must be completed by the compliance officer managing control of compliance with professional obligations (responsable du contrôle du respect des obligations professionnelles (RC)) or the individual responsible for compliance with professional obligations (responsable du respect des obligations professionnelles (RR)).

To date, this survey has been purely self-reflexive. Now, in an effort to further combat financial crime, the CSSF is adding an additional layer of governance by requiring the REAs to draw up an AML/CFT report to validate the responses submitted by the IFMs.

The new process

Circular 21/788, effective 31 December 2021, is applicable to all Luxembourg IFMs, including registered AIFMs and all Luxembourg investment funds supervised by the CSSF for AML/CFT purposes.

Luxembourg investment funds managed by a Luxembourg IFM or a foreign IFM are excluded from the scope of the Circular, however the CSSF expects that the REA of such funds will perform AML procedures set out in CSSF Regulation 12-02, as amended.

Any significant deficiencies resulting from the independent auditor’s procedures should be reported in the fund’s management letter.

As previously mentioned, the external AML report will comprise two sections, containing a corroboration of the responses provided by the entity in the form of a yes/no format to questions asked by the CSSF, as well as sample testing or specific procedures.

The report will cover a range of AML/CFT topics, including but not limited to the entity’s risk-based approach, due diligence on funds, investment assets and channels of distribution, delegation and branch oversight and name screening. Where applicable, the report also covers discretionary portfolio management and transfer agent activities conducted by the IFM. The report must be submitted via the CSSF eDesk by an RR, RC or a Board Member/Manager within six months of the financial entity year-end. However, considering the burden of the first implementation of this exercise, the deadline has been extended to nine months for those entities with a year-end of 31 December 2021.

Practical considerations

The new regulation has been in effect for just shy of two months. As more and more entities approach their financial year-end, now is a good time for IFMs to ask themselves how comfortable they are with the changes stipulated in Circular 21/788. In addition, entities that are in scope of the Circular while not subject to the legal obligation to appoint an REA to audit its annual accounts, will still be required to appoint an independent auditor for the specific purpose of preparing the report. Impacted entities will need to take the time to select an audit partner they can trust and rely on to assist with this task.

Further, while the scope of the survey and its report is backward-looking, it may also be appropriate for IFMs to take proactive steps to evaluate processes and operational factors which are critical for their AML/CTF activities moving forward. There may be benefit in reviewing existing processes for KYC/KYD/KYI, AML onboarding and remediation, due diligence and AML tax. It may also be a suitable time to refresh any outdated data collection and analysis methods, IT tools, automation processes, AML/CTF frameworks and policies.

“While we have witnessed much change over the past decade, we expect the next ten years to be even more transformative. The CSSF AML/CFT survey acts as a great starting point for IFMs across Luxembourg – and Europe – to holistically consider both their approach to protecting their investors’ assets as well as their contribution to promoting and protecting the financial market”, concludes Christophe Wintgens, Wealth & Asset Manager Leader at EY Luxembourg.

Summary

Since the dawn of the COVID-19 pandemic, perpetrators of financial crime have taken advantage of the resulting economic instability and uncertainty. An increase in the use of digital payments, the rising popularity of virtual currencies, and the accelerated rate of technological advancement have all aided criminals in finding new opportunities to launder money at greater speeds and larger volumes. 

About this article

Authors
Christophe Wintgens

EY Luxembourg Assurance Partner, Wealth and Asset Management Leader

Pragmatism is my essence. Results are key. Internal audit and Anti-Money Laundering are my playing fields. Storing exclusive cars is my passion.

Christine Frentz

EY Luxembourg Partner, Extended Assurance

AML / KYC expert with over 16 years within audit and financial services including more than 10 years within regulatory and compliance engagements. Market focused. Ability to manage large engagements.