Entities registered with the Luxembourg Trade and Companies Register that fall within the scope of the Act of 15 January 2019 establishing a Luxembourg register of ultimate beneficial owners (the "REBECO Act") must register their ultimate beneficial owner(s) ("UBO(s)") information via an online platform managed by the Luxembourg Business Registers (the "Manager"), in French, German or Luxembourgish. A substantiated request to restrict access to the UBO(s) information on file can be submitted at the same time or, under certain conditions, at a later stage.
The supporting documentation that must be filed for each UBO consists of a copy of the individual's national identity card or passport or, in the case of qualifying listed companies, a document certifying that the securities of the relevant company are admitted to trading on a qualifying regulated market.
Obliged entities are exempt from payment of the administrative fee to register their UBOs until 1 September 2019. After that date, UBO registration and any changes to the information on file shall be subject to a fee.
Access to information
Certain UBO information is accessible to the general public via the Manager’s website (e.g. name, shareholding, etc.).
Credit and financial institutions as well as notaries and bailiffs acting in their official capacity as public servants can request access to additional information (e.g. address, national registration number etc.).
National authorities, such as the Luxembourg tax administration, the public prosecutor's office, the customs authorities, etc., will have unlimited access to current and past information of UBO(s) including in relation to liquidated entities.
Data protection aspects
In addition to the data protection concerns raised by the European Data Protection Supervisor in relation to the 4th AML Directive, the Luxembourg data protection authority (CNPD) recently expressed some concerns regarding the necessity and proportionality of the measures introduced by the REBECO Act. The REBECO Regulation does not provide for specific safeguards to address these concerns. Therefore, the compliance of the REBECO framework with privacy law is debatable.