Internal governance

Sound and effective corporate governance arrangements are fundamental to the proper functioning of any financial institution and for the financial system they form as a whole.

A financial institution’s management body must have ultimate and overall responsibility for their financial institution and define, oversee and be accountable for the implementation of any governance arrangements within their institution that ensure effective and prudent management of the institution.

Considering the fundamental role and responsibilities of the management body in any financial institution and in view of ensuring sound and prudent management of any financial institution, members of the management body shall be of good repute, possess sufficient knowledge, skills and experience and commit sufficient time to the performance of their functions.

EU and national legislation require that financial institutions have robust governance arrangements, which include a clear organisational structure, well defined lines of responsibility, effective risk management processes, control mechanisms as well as all standards and principles concerned with setting an institution’s objectives, strategies and risk management framework; how its business is organised; how responsibilities and authority are defined and clearly allocated; how reporting lines are set up and what information they convey; and how the internal control framework is organised and implemented, including accounting procedures and remuneration policies. Internal governance also encompasses sound information technology systems, outsourcing arrangements and business continuity management.

These governance arrangements should in that respect be appropriate to the nature, scale and complexity of the financial institution.

While implementing robust internal governance arrangements, support PFS shall comply with the legal provisions of the Law of 5 April 1993 on the financial sector and in particular Article 17(2).

Those legal requirements are completed by the following main CSSF circulars applicable to support PFS:

• Circular IML 95/120 on central administration
• Circular IML 96/126 related to the administrative and accounting organisation
• Circular IML 98/143 on internal control
• Circular CSSF 20/750 on the requirements regarding information and communication technology (ICT) and security risk management;
• Circular CSSF 22/806 on outsourcing arrangements;
• Circular CSSF 24/847 on ICT-related incident reporting framework;
• Circular CSSF 24/850 on the practical rules concerning the descriptive report and the self-assessment questionnaire to be submitted on an annual basis by support PFS and the engagement of the réviseurs d’entreprises agréés (approved statutory auditors) of support PFS and practical rules concerning the management letter and the separate report to be drawn up on an annual basis.

In line with the legal requirements, members of a support PFS management body shall be authorised by the CSSF and produce evidence of adequate professional experience as well as of their professional standing.

Such professional standing shall be assessed on the basis of police records and of any evidence tending to show that the persons concerned are of good standing and are offering a guarantee of irreproachable conduct. Any proposed member of support PFS management body needs in that respect to provide the CSSF with the following information:

• an up-to-date and detailed curriculum vitae;
• a copy of an identification document;
• evidence of reputation, honesty and integrity which among others include criminal records and/or relevant equivalent information, issued less than 3 months ago, as well as the duly completed and signed declaration of honour.

The persons to be appointed by a support PFS to be responsible for managing the internal audit function (i.e. internal auditor) shall be notified to the CSSF. This notification to the CSSF must include an up-to-date and detailed curriculum vitae of the person appointed to be responsible for the management of the internal audit function.