Thank you for agreeing to answer questions about regulatory and compliance issues with our readers!
Amcham: When did you start to become aware of the Covid 19 medical situation which has impacted Luxembourg and what were your first observations about this challenge?
Claude Marx: Like everyone else, I followed the press and knew that a pandemic was all the rage in China. I was worried because I remembered a speech by Bill Gates predicting the potential damage that a global pandemic could cause. But at the CSSF we really took the measure of the scale of the problem at the end of February 2020, so two weeks before the lockdown, when we decided to offer our cross-border commuters the possibility of working remotely if they so wished. The idea was to avoid them taking the risks of infection linked to the use of public transport.
Amcham: How has the situation impacted the CSSF, what steps did you initially take to protect your employees and how have these steps evolved over time?
Claude Marx: We were fortunate to have invested heavily in computer equipment over the past two years. All our agents were equipped with laptops and some with smartphones or tablets. Of course, these investments were not made with a view to a pandemic and generalized teleworking, but with a view to greater flexibility in our surveillance work. Of course, we, like many others, also had to supplement our system by acquiring VPN licenses and additional video conferencing capabilities. But in the end, this enabled us to be very responsive to the evolution of the pandemic, with the main objective of protecting the health of our agents. On day 1 of the lockdown, more than 50% were working from home, at the end of week 1, 99% were in home office.
Amcham: What has been your observation about the impact of the Covid 19 developments on the organizations which you regulate: what steps have they tried which have worked and which have not?
Claude Marx: First of all, it can be observed that the business continuity plans put in place by the players in the financial sector have proven their effectiveness. With hindsight, this makes me smile slightly, because it is partly thanks to the insistence of the supervisory authorities over the years that this type of plans was implemented. Of course, some of them had to urgently proceed with the purchase of certain equipment. Others found that some vital systems were not operational remotely. But all in all, we have not seen any major disruptions in the sector.
As for the future: everyone realizes that there will be no return to the pre-pandemic phase. Distance working will become generalized. I’m not talking about a situation in which employees will mostly work from home, but certainly one or two days a week. This naturally raises a number of questions in terms of human resources management.
Amcham: How have you changed the internal management of the CSSF in response to this medical emergency to keep your employees safe, while still performing their mission?
Claude Marx: The most profound change was that previously we organized our work around the entities to be monitored and that in the context of the pandemic, we organized our work around the health of our employees. I am proud to say that we have been able to guarantee the continuation of our monitoring missions. We made a point in cancelling no interviews or meetings. They were all held solely by videoconference. And this even applies to our on-site inspections where most of the work is carried on albeit remotely!
Amcham: In what way have digital activities become more important and more dominant for the operations within the Luxembourg financial sector, how has this increased the level of risk for clients and companies and what steps should be taken to deal with these evolving concerns?
Claude Marx: The pandemic has certainly given a boost to and accelerated digitalization. For us, the greatest risk lies in securing data access in remote working situations. The implementation of remote working was done in an emergency, a situation that was not ideal for testing the impermeability of the processes and systems put in place. But the good news is that we did not find any major breaches. Another problem, but one that is related to e-commerce and e-banking in general, is that the risk of fraud is increasing with the development of remote and online financial services. We are seeing more and more fake sites and fraudulent proposals. A final risk is that of the multiplication of cyber-attacks in a context where everyone’s attention is primarily focused on health issues.
Amcham: What are the biggest regulatory risk factors facing the Financial sector both now and, in the future, what steps do you recommend companies undertake and how is the CSSF managing those risk factors now and in the future?
Claude Marx: The Luxembourg financial sector is very international. The greatest risk for the Luxembourg financial sector is linked to financial crime and more particularly to that linked to money laundering and terrorist financing, as highlighted by the recent National Risk Assessment. The CSSF applies no tolerance in this respect, as it is a systemic reputational risk, not only for the financial center, but for the whole country. It should also be remembered that the entities that would engage in this type of fraud are playing with fire. The recent past has seen a number of players no longer recover from the discovery of shortcomings in their internal supervisory procedures or deliberate malicious acts.
I would also like to come back to regulation in general. Post financial crisis, it has become more complex and comprehensive, which implies challenges not only for supervised entities but also for supervisors. I am thinking here of the costs involved in implementing supervision, particularly in terms of human resources, which are real. The CSSF applies a proportional approach to the implementation of regulation, where the regulatory framework allows it to do so. The CSSF also applies a risk-based approach across the various businesses it supervises. In the coming months and years, we will endeavor to automate to the extent possible reporting and the analysis of the reports, focusing more on exceptions. We will discuss this with the industry, this topic should be in everybody’s interest.
Amcham: How are the circumstances of the risks facing regulated Luxembourg entities similar and different than for other global competitive locations?
Claude Marx: I have cited the risk of money laundering and terrorist financing as the major risk for the Luxembourg financial center. I believe that the same applies to all financial centers.
Other risks high on our agenda are cyber-crime, embracing digitalization and the need to contribute to a more sustainable world. Those who will underestimate those risks will not survive, neither here nor in other finance centers.
Amcham: What is your point of view concerning the evolution of risks and opportunities for the Luxembourg financial sector and what steps do you think should be undertaken to mitigate these risks and enhance these opportunities?
Claude Marx: Digitalization opens up a wide range of opportunities for many companies. But there are also some that risk missing the train by not making the necessary investments. The same goes for sustainable finance, which some see more as a constraint than an opportunity, or at best concede to greenwashing. But these are mistaken in making short-term calculations and failing to adapt to profound societal change. In fact, they are jeopardizing their own sustainability, because soon nobody will want to be a customer or work for a company that does not have a virtuous approach. Sustainable finance is not ”not for profit”. It is about saving the planet, but equally about huge business opportunities.
Amcham: What additional information would you like to share with our audience?
Claude Marx: I would like to come back to the challenge of digitalization. Let there be no mistake: the advent of the digital revolution is slower than expected, but it will come and it will be massive. But the players in the Luxembourg financial center who have taken up the challenge in time will come out of it stronger. Experience has shown that it is easier to digitize recognized financial know- how than the other way round.