Governance

Sound and effective corporate governance arrangements are fundamental to the proper functioning of any financial institution and for the financial system they form as a whole.

A financial institution’s management body must have ultimate and overall responsibility for their financial institution and define, oversee and be accountable for the implementation of any governance arrangements within their institution that ensure effective and prudent management of the institution.

Considering the fundamental role and responsibilities of the management body in any financial institution and in view of ensuring sound and prudent management of any financial institution, members of the management body shall be of good repute, possess sufficient knowledge, skills and experience and commit sufficient time to the performance of their functions.

EU and national legislation require that financial institutions have robust governance arrangements, which include a clear organisational structure, well defined lines of responsibility, effective risk management processes, control mechanisms as well as all standards and principles concerned with setting an institution’s objectives, strategies and risk management framework; how its business is organised; how responsibilities and authority are defined and clearly allocated; how reporting lines are set up and what information they convey; and how the internal control framework is organised and implemented, including accounting procedures and remuneration policies. Internal governance also encompasses sound information technology systems, outsourcing arrangements and business continuity management.

These governance arrangements should in that respect be appropriate to the nature, scale and complexity of the financial institution.

While implementing robust internal governance arrangements, payment and e-money institutions shall comply with the legal provisions of the Law of 10 November 2009 on payment services (“PSL”) and in particular Articles 11, 13 for payment institutions (PI) respectively Articles 24-7 and 24-9 for e-money institutions (EMI).

Those legal requirements are completed by the following main CSSF circulars applicable to PI and EMI:

• Circular IML 95/120 on central administration
• Circular IML 96/126 related to the administrative and accounting organisation
• Circular IML 98/143 on internal control
• Circular CSSF 04/155 on the Compliance function
• Circulars CSSF 06/240, CSSF 22/806 on outsourcing
• Circular CSSF 18/692 related to product oversight and governance arrangements for retail banking products
• Circular CSSF 19/713 on security measures for operational and security risks of payment services under PSD2

In line with the legal requirements, members of a PI or EMI management body shall be authorised by the CSSF and produce evidence of adequate professional experience as well as of their professional standing.

Such professional standing shall be assessed on the basis of police records and of any evidence tending to show that the persons concerned are of good standing and are offering a guarantee of irreproachable conduct. Any proposed member of PI/EMI management body needs in that respect to provide the CSSF with the following information:

• an up-to-date and detailed curriculum vitae;
• a copy of an identification document;
• evidence of reputation, honesty and integrity which among others include criminal records and/or relevant equivalent information as well as the duly completed and signed declaration of honour

The persons to be appointed by a PI/EMI to be responsible for respectively managing the Compliance function (i.e. Compliance officer) or the internal audit function (i.e. internal auditor) shall be notified to the CSSF. The notification to the CSSF shall also encompass the same set of information as the one related to the appointment of members of the management body meaning:

• a detailed curriculum vitae;
• a copy of an identification document;
• evidence of reputation, honesty and integrity which among others include criminal records and/or relevant equivalent information as well as the duly completed and signed declaration of honour