Documents – Page 4

Engagement of the réviseurs d’entreprises agréés (approved statutory auditors) of support PFS and practical rules concerning the management letter and the separate report to be drawn up on an annual basis.

Relevant for: Support PFS

Topics: AML/CFT Approved statutory auditor (réviseur d'entreprises agréé) Cabinet de révision agréé Cybersecurity Information and communications technology (ICT) Information security Internal governance Operational risk Outsourcing Risk management

List

Document date: 23 December 2025

Summary of expected documents

related to Circular CSSF 24/850

Relevant for: Support PFS

Topics: AML/CFT Approved statutory auditor (réviseur d'entreprises agréé) Cabinet de révision agréé Cybersecurity eDesk Information and communications technology (ICT) Information security Internal governance Risk management

CSSF guidance

Document date: 23 December 2025

Test rotation plans for the separate report of support PFS grouped by activities/authorisations and risk classification

Relevant for: Support PFS

Topics: AML/CFT Approved statutory auditor (réviseur d'entreprises agréé) Cabinet de révision agréé Cybersecurity eDesk Information and communications technology (ICT) Information security Internal governance Operational risk Outsourcing Risk management

CSSF circular

Document date: 23 December 2025

Circular CSSF 25/903

Update of Circular CSSF 24/850 on the practical rules concerning the descriptive report and the self-assessment questionnaire to be submitted on an annual basis by support PFS, as well as the engagement of the réviseurs d’entreprises agréés (approved statutory auditors) of support PFS and practical rules concerning the management letter and the separate report to be drawn up on an annual basis.

Relevant for: Support PFS

Topics: Approved statutory auditor (réviseur d'entreprises agréé) Cabinet de révision agréé Cybersecurity eDesk Information and communications technology (ICT) Information security Internal governance Operational risk Outsourcing Risk management

Name	Description	Duration
cssf_cookies	Saves information regarding the user's consent to the use of cookies for each optional category.	1 year
ROUTEID	Technical cookie allowing load distribution.	Deleted when the browsing session ends
TBMCookie*	Security: This cookies protects the website against automated attacks.	Deleted when the browsing session ends
__utmvc	These first party cookies are set by a third party service to filter out malicious requests.	Deleted when the browsing session ends
__utmvm*	These first party cookies are set by a third party service to filter out malicious requests.	15 minutes

Name	Description	Duration
cssf_profile	This cookie adapts the website pages to the profile chosen by the visitor (professionals, markets, consumers).	1 year
pll_language	This cookie saves the user’s language choice.	1 year

Name	Description	Duration
_pk_id.#	Collects anonymous statistical data on the website consultations, such as the number of visits or the average time spent on the website. The data is processed in-house and is not shared with a third party.	1 year
_pk_ses.#	Collects anonymous statistical data for the tracking of the pages consulted during the browsing session. The data is processed in-house and is not shared with a third party.	30 minutes

Archives: Documents