On 27 January 2025, the law deriving from draft Bill No. 7961 (“Law“) introducing significant changes to the laws governing the Register of Beneficial Owners (Registre des Bénéficiaires Effectifs (RBE)) and the Trade and Companies Register (Registre de Commerce et des Sociétés) was published in the Luxembourg official journal.
These changes align with the ruling of the Court of Justice of the European Union (CJEU) of 22 November 2022, aiming to balance transparency for anti-money laundering and countering the financing of terrorism (AML/CFT) purposes with enhanced privacy protections.
The Law entered into force on 1 February 2025 and incorporates new access rules, compliance measures and interconnectivity between the Luxembourg registers. It aims to position Luxembourg at the forefront of regulatory compliance and stakeholder confidentiality.
For further information on what these developments mean for your organization, please get in touch with your usual Baker McKenzie contact.
Background: from public access to restricted access
Before the CJEU ruling, Directive (EU) 2018/843 of 30 May 2018, amending Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, allowed full public access to RBE data. The Luxembourg law governing the RBE introduced into national law the provision of the directive debated by the CJEU.
The CJEU ruling invalidated the provision of the directive, citing privacy infringements under the EU Charter of Fundamental Rights. On the date of the CJEU ruling, Luxembourg authorities suspended online public access to the information on beneficial owners collected by the RBE.
Luxembourg authorities promptly restored access to the RBE data but under stricter conditions:
In December 2022, online access to the RBE was reestablished for professionals subject to the Luxembourg amended law of 12 November 2004 relating to AML/CFT (such as professionals from the financial and insurance sectors, auditors, real estate agents and developers, persons carrying out a family office activity, notaries and lawyers) and to press representatives who have a legitimate interest in consulting the RBE for their journalistic research.
In February 2023, the Luxembourg Business Registers (LBR) introduced a confidential access procedure for entities to retrieve their own RBE data using a code sent to their registered office.
Throughout this period, national competent authorities have continued to benefit from dedicated access through an intranet portal, allowing them to carry on their work in the fight against money laundering and terrorist financing.
Key benefits for businesses and professionals
Legal and financial professionals now have explicit rights to access RBE data for client due diligence, which facilitates compliance with evolving AML/CFT regulations.
Additionally, potential transaction parties benefit from enhanced transparency, enabling them to make informed decisions and mitigate the risk of association with illicit activities.
Key practicalities
A. Restricted access to protect confidentiality
The Law has been supplemented by a redefinition of the list of entities and individuals who can access the RBE data.
Who has access to which information?
National authorities
Who
Attorneys general, state prosecutors, investigating judges
Financial Intelligence Unit
Approved judicial police officers
Commission de Surveillance du Secteur Financier (Financial Sector Supervisory Commission), Commissariat aux Assurances (Insurance Commission), Customs and Excise Administration, Registration Duties, Estates, and VAT Authority, Direct Taxation Administration, State Intelligence Service, etc.
Accessible information and access modality
All information listed in Article 3 relating to the beneficial owners is accessible by the national authorities: full names, nationalities, date and place of birth, country of residence, accurate private or professional address, national/foreign identification number, and nature and extent of beneficial interests held.
Access is made via secure electronic systems.
Information on national authorities accessing the data is not communicated to the concerned registered entities or beneficial owners.
Professionals subject to AML/CFT law
Who
Credit and financial institutions
Notaries
Lawyers
Accountants
Other professionals required to apply customer due diligence measures
Accessible information and access modality
The professionals subject to AML/CFT law can only access the following information in relation to the beneficial owners: full names, nationalities, date and place of birth, country of residence, and nature and extent of beneficial interests held.
Access is made via secure electronic platforms with strong authentication. Access must be logged, including the user’s identity, information consulted, date, time and reason for consultation. Logs are retained for five years and are inaccessible to the registered entity or beneficial owners concerned.
Self-regulatory organizations and public services and administrative bodies
Who
National self-regulatory organizations responsible for supervising compliance with AML/CFT obligations
State services, public administrations and public establishments, where access is provided by law as part of their legally defined missions
Accessible information and access modality
These entities can only access the following information in relation to the beneficial owners: full names, nationalities, date and place of birth, country of residence, and nature and extent of beneficial interests held.
Access is made via secure electronic platforms with strong authentication. Access must be logged, including the user’s identity, information consulted, date, time and reason for consultation. Logs are retained for five years.
Persons demonstrating legitimate interest
Who
Persons deemed to have a legitimate interest according to the Law include:
Professional journalists established in the EU
Nonprofit organizations focused on combating money laundering and terrorist financing
Individuals seeking to verify the identity of beneficial owners of entities in the context of potential transactions
Persons who are likely to enter into a transaction with a legal entity or legal arrangement and who wish to prevent any link between such a transaction and money laundering, its predicate offenses or terrorist financing have been included in the list of persons who will be deemed to have a legitimate interest. By doing so, the Law has preemptively aligned the Luxembourg legislation with Article 12(2)(c) of Directive (EU) 2024/1640, the so-called sixth Anti-Money Laundering Directive.
National authorities and administrations involved in combating money laundering or terrorist financing offenses, insofar as they do not already have access to this information
Other persons justifying a legitimate interest
Accessible information and access modality
The persons demonstrating legitimate interest can only access the following information in relation to the beneficial owners: full names, nationalities, date and place of birth, country of residence, and nature and extent of beneficial interests held.
For persons wishing to identify the beneficial owners in the context of a transaction, access to information is further limited to the persons with whom they are likely to enter into transactions.
Access is made via secure electronic platforms with strong authentication for the persons deemed to have a legitimate access.
A justified request must be submitted to the LBR for the other persons justifying a legitimate interest. Requests must detail the entity being investigated, the legitimate interest related to AML/CFT efforts and the intended use of the information.
The LBR reviews and validates or rejects the request, possibly consulting an advisory commission.
If the LBR issues a favorable decision, an extract containing the following information in relation to the beneficial owners is sent to the applicant within three working days of the LBR’s decision: full names, nationalities, date and place of birth, country of residence, and nature and extent of beneficial interests held. The LBR will only process the entities determined by name or registration number that are the immediate subject of the applicant’s research and investigations.
B. Stronger compliance measures for registered entities
The Law grants the LBR expanded enforcement powers to ensure the reliability of the RBE data, including the following:
Administrative measures include reminders, notices and coercive actions.
Severe cases of noncompliance or deliberate breaches may be referred to the public prosecutor.
Criminal sanctions remain available for the most egregious violations.
The Council of the European Union on 11 March 2025 adopted 3-pillar ViDA reforms’ legislative measures, and it entered into force 14th April. Read more details of each of the pillars: Jul 2030 Digital
Luxembourg is preparing to shut down a scheme which grants non-EU nationals a residence permit in exchange for investing €500,000 in a business in the country. A draft law, submitted to parliament
EU leaders intend to take an important step towards confiscating €27 billion in profits from Russia’s sovereign assets frozen in Europe to provide military aid to Ukraine. The Guardian’s
Vanuatu’s government has announced a suspension of new applications for its Citizenship For Investment Program. Commonly known as Vanuatu’s Golden Passport, the scheme offers, citizenship