Governance
CSSF update regarding internal governance and risk management
On 29 August 2024, the CSSF issued Circular CSSF 24/860, which updates the Circular CSSF 12/552 (the “Circular”). This Circular introduces numerous amendments to governance, risk management, and internal control practices within Luxembourg’s institutions, in alignment with European regulatory developments. The Circular also incorporates amendments made by several prior circulars, including those issued in 2013, 2016, 2020, and 2022.
The Circular is aimed to enhance clarity about certain governance aspects, introduce definitions for newly recognised regulatory concepts, and ensure alignment with international guidelines from the European Banking Authority (EBA). For instance, the Circular specifies the criteria for determining “significant institutions” with objective elements, notably their size, complexity or activity scope.
The Circular further introduces the concept of "transactions with related parties", which includes a broad array of credit exposures, service contracts, and asset dealings involving institutions and their associated entities.
In addition, the veto rights of the head of risk management are more important under the Circular, enabling them to challenge management decisions more effectively. This aligns with the European Banking Authority’s Guidelines on Internal Governance (EBA/GL/2021/05), ensuring that risk managers play a more authoritative role in governance.
Moreover, the Circular adapts provisions regarding outsourcing arrangements to be consistent with Circular CSSF 22/806. In Part III, dealing with credit risk, the Circular establishes direct connections with the EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), as well as credit risk management practices (EBA/GL/2017/06). It also develops more detailed requirements for mortgage-backed exposures and real estate developments.
The term "risk control function" has been replaced by "risk management function" throughout the document. Additionally, legal references have been updated to reflect the current regulatory environment, particularly in light of Directive 2013/36/EU.
The Circular is applicable since 30 September 2024.