New Circular CSSF 26/906 “Central administration, internal governance and risk management” applicable to payment and electronic money institutions

What Changed

• The circular consolidates and updates governance rules, focusing on:
• Management bodies: Responsibilities, composition, qualifications, organization, and functioning, including CSSF authorization of members based on professional experience, standing (e.g., police records), and irreproachable conduct.
• Internal control functions: Responsibilities, characteristics, organization, and execution of work for compliance officers and internal auditors, with notifications to CSSF including detailed personal and professional information.
• Conflicts of interest: Key requirements for a management policy applicable to all staff and management body members. (https://elvingerhoss.lu/insights/publications/circular-cssf-26906-central-administration-internal-governance-and-risk-0)
• New product approval: Defined key steps in the process.
• Safeguarding funds: Common sense rules for compliance. It aligns with EU/national laws requiring clear structures, risk processes, and controls proportional to institution size/complexity, including IT systems, outsourcing, and business continuity.

Suggested Considerations

• Gap analysis: Assess current frameworks against circular requirements on management bodies, internal controls, conflicts of interest, product approval, and fund safeguarding.
• Updates and notifications: Review/revise governance arrangements (e.g., policies, structures); notify CSSF of management body members, compliance officers, and internal auditors with required documentation (professional experience, police records, etc.).
• Implementation: Establish robust risk identification/management/monitoring/reporting processes, internal controls, and proportional arrangements (e.g., IT, outsourcing).
• Documentation: Develop conflicts policy, new product approval procedures, and safeguarding rules; ensure management body authorization.
• Ongoing: Maintain sound/prudent management amid growth; integrate with Law of 10 November 2009 requirements.

Key Dates

Who is Affected