What and when?

An important update of Circular 12/552 on central administration, internal governance and risk management has been published by the Luxembourg regulator, Commission de Surveillance du Secteur Financier (CSSF). 

Swift action in order to align internal governance procedures with the new requirements is advisable as the updated Circular 12/552 (the Circular) is in force as of January 1, 2021. It is applicable to credit institutions and to some extent to professionals performing lending operations. The CSSF also issued a separate Circular 20/758 applicable to investment firms.

Many changes introduced to Circular 12/552 by Circular 20/759 are linked to the transposition of the rules set out by Guidelines on internal governance under Directive 2013/36/EU (EBA/GL/2017/11) (Guidelines on Internal Governance) and Joint ESMA and EBA Guidelines on the assessment of the suitability of members of the management body and key function holders (Guidelines on Suitability).

Potential impact and required actions

The changes introduced by the Circular may require an update of numerous internal governance documents and policies, such as e.g.:

• risk management policy, 

• appointment and remuneration policy,

• documents relating to the decision-making process, board proceedings, minute-taking practices, etc.

Key changes

Proportionality principle

The Circular explains that the application of the proportionality principle needs to take into account, among others, the following elements:

• the legal form of the institution,

• its ownership and funding structure,

• business model and risk strategy,

• size of the institution, nature and complexity of its activities (including the type of clients and the complexity of the products or contracts),

• nature and complexity of its organizational and operational structure, as well as information technology (IT) systems and continuity systems.

It is required that the proportionality analysis be documented in writing and its conclusions adopted by the management body.

The Circular also confirms that, when in line with the proportionality principle, it is not necessary to create a separate function of risk control and compliance or to appoint two full-time employees to head those functions. In such cases, prior approval of the competent authority based on a written application is indispensable to be able to create a combined function or position with combined responsibilities. A written request and prior approval is likewise necessary to outsource the tasks of internal audit.

Risk management

Risk culture is placed by the Circular at the very heart of decision-making. This must not only be reflected in internal policies and procedures but also in training programs and in the example and message spread from the top of the structure, including the management, down to the personnel.

As part of internal governance, credit institutions should have a clear and rigorous risk-taking procedure. Such a procedure should include formally and precisely setting the risk appetite for all business lines and should foresee not only quantitative but also qualitative assessments.

Furthermore, the Circular contains the list of matters that have to be regularly deliberated in a critical manner by the risk committee (or the management body when no such committee was established). It also provides that the Chief Risk Officer may be granted a veto right against the decisions of the authorized management.

Suitability assessment

Principles concerning the appointment and replacement of the members of the management body must guarantee that they are and remain qualified throughout the time of holding the function. The measures to ensure such suitability should comprise, among other things, specific initiation programmes allowing the members of the supervisory body to understand the structure, business model, risk profile and governing systems, and later on professional training programmes permitting them to understand the institution’s operations and keep their competences up-to-date.

In line with updated principles of the Circular, a new version of the Prudential procedure of appointment of members of the institutions’ management body and key function holders was published by the CSSF. It is applicable starting from January 1, 2021. The CSSF may request that the files which are in the course of being processed be completed to fulfil the requirements of this new procedure.

Diversity objectives

The Circular foresees that the management body sets our written rules concerning appointment and composition procedures of the management body, which should include diversity in such aspects as e.g. age, sex, geographic origin as well as educational and professional background. It is also required that the president of the management body ensures its well-balanced composition.

Independent directors

It also should be remembered that every institution other than a significant institution has to have at least one independent member of the management body. With respect to significant institutions or institutions whose shares are admitted to trading on a regulated market, the number of independent directors has to be sufficient, taking into account the organisation and nature, scale and complexity of its activities.

For an appreciation of independence, the Circular refers to section 9.3. of the Guidelines on Suitability.

Management procedures and decision taking

The updated Circular expressly requires a written document concerning the organization and functioning of the management body. Written mandates should also be in place to define the objectives and responsibilities of the management members.

The importance of minute-taking is reinstated. The Circular explains that minutes concerning important points of the meetings of the management body (and of the authorized management) need to allow the reader to follow the discussions and understand the positions of the participants. Minutes of the management body meetings shall also document the follow-up actions of the decisions taken.

Similarly to both sets of the Guidelines mentioned above, the Circular provides that significant institutions must establish committees of audit, risk, nomination and remuneration. Moreover, for significant institutions the CSSF recommends that the risk committee is composed of a majority of independent members, including its president. Other institutions may put in place different committees to assist the management body (no delegation of tasks to the committees is possible). If no committees are established, the tasks of those committees set out in the Circular remain the responsibility of the management body.

Other documents and procedures

The Circular reinforces in general the role of written procedures and internal documents. It requires, for instance, that those documents comprise the descriptions of:

• all the steps of the workflow, starting with the initiation, until the filing of the documentation;
• all the checks and controls to be made and the measures to taken in order to make sure that they have been made.

Subsidiaries/branch offices

Certain aspects of the organization of internal control functions in the case of subsidiaries and branch offices have also been clarified. It is expressly provided that in the case of subsidiaries/branches, the person responsible for internal control functions on the level of the group has to give his/her approval for any recruitment, dismissal or important decisions concerning the remuneration of heads of control functions on the level of the subsidiaries/branches.

Outsourcing

Last but not least, the Circular updated some rules concerning outsourcing arrangements, but publication of a separate Circular in this respect is foreseen at a later date.