With some delay compared to our EU-neighbours, Luxembourg has adopted legislation to implement article 30 of Directive (EU) 2015/849 of the European Parliament and the Council of May 20, 2015, better known as the 4th AML Directive.

On January 13, 2019, the Luxembourg Parliament adopted a law creating a Register of Beneficial Owners (“Registre des bénéficiaires effectifs“ or “RBE”). An implementing Grand-Ducal Decree was adopted by the Government on February 15, 2019. The Law is for the most in line with the Bill of Law nr. 7217 that was filed on December 5, 2017, and with respect to which we reported in our NewsFlash of February 2018. However, in the course of the parliamentary proceedings, a major change was made with respect to the right of access to the RBE for persons other than national authorities, financial and credit institutions and regulated professions.

The Law creates a Register of Beneficial Owners which will be operated through the Luxembourg Register of Trade and Companies (“Registre de Commerce et des Sociétés” or “RCS”).

      A. Who is a “beneficial owner”?

The concept of “beneficial owner” is defined in the Law of November 12, 2004 on the fight against money laundering and the financing of terrorism, as subsequently (and frequently) amended, as “any natural person who, ultimately, owns or controls the [entity] and/or any natural person for whom a transaction is carried out or an activity is carried out”.

The 2004 law provides for the following thresholds to establish “control”:

• For companies: a 25% share ownership of 25% of voting rights; and
• For legal entities, such as foundations, and legal constructs, such as fiduciary arrangements, that manage and distribute funds: a 25% beneficiary interest or a 25% ownership interest in the underlying assets.

Note that the definition of the 2004 law allows for “control” to be demonstrated in other manners also, hence these thresholds are not exhaustive.

      B. What legal entities are concerned?

The law applies to all legal entities that are registered with the Luxembourg RCS.

      C. What information is to be disclosed?

The following information is to be disclosed to the RBE in respect of a beneficial owner of a registered legal entity: their given name(s) and surname, nationality, date and place of birth, country of residence, as well as the nature and extent of the interest they hold in the entity concerned. This information is generally available without restriction. Furthermore, the residential or professional address of a beneficial owner as well as their national identification number (or equivalent in another country) must also be disclosed; however, the latter information will only be available to national authorities and regulated professions, not to random third parties.

The information is to be provided to the RBE by the legal entity concerned and registration (initial registration and subsequent updates) can be affected either online or at the offices of the RCS.

The law states that information concerning beneficial owners must be “adequate, exact and current”, meaning the legal entity concerned has the obligation to update the information on record with the RBE whenever necessary. The time period for either an initial RBE-registration or the recording of an update is one month from the date of the relevant event. Beneficial owners have the statutory obligation to provide all relevant information to the legal entity so that the latter can fulfil its disclosure obligations.

      D. Who has access to the RBE?

On this specific point, the law as ultimately adopted differs from the bill of law filed in 2017.  In the initial bill, random third parties had to demonstrate a “legitimate interest” in order to receive access to the information on file with the RBE and needed to file a request with a commission. This requirement has been removed altogether.

Unlimited access to the RBE is available upon request to national authorities, while random third parties have access to most data but not to a beneficial owner’s address and national identification number.

Interestingly, the law provides that one the one hand all data pertaining a consultation of the RBE should be stored (including the precise reason for the consultation), but that no information whatsoever with regard to a consultation may be shared with the legal entity concerned nor with a beneficial owner.

      E. Carve-outs

First, the UBO-disclosure requirements of the law do not apply to legal entities the shares of which are traded on a regulated securities exchange; the only information that will appear in the RBE-register with respect to such entities shall be the name of the securities market where the entity is listed.

Secondly, a beneficial owner may ask the operator of the RBE that access to their data be restricted to national authorities, financial and credit institutions and bailiffs and notaries acting in their official capacities. To that end, the beneficial owner must demonstrate that making such information available to random third parties would expose the UBO to a disproportionate risk or a risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation. Where the beneficial owner is a minor or incapacitated, a request to that end can also be made. If granted, the restriction will be valid for a renewable period of three years.

      F. Criminal fines

The law provides for fines comprised between EUR 1.250 and EUR 1.250.000 for failure to provide or update information relating to a beneficial owner. We point out that this liability is not limited to the legal entity concerned, but also extends to their beneficial owner(s).

      G. Implementation

The law provides for a six-month transitional period for legal entities to comply with its requirements, starting March 1, 2019, the date on which the law is to take effect.

A fee schedule has been put in place for the obtaining of information from the RBE (electronically or in paper form), but the amounts are nominal.

It remains to be seen how quickly companies and beneficial owners will in fact comply with these new legal obligations and register with the newly created RBE. In neighbouring Belgium, where article 30 of the 4th Directive was implemented into law in the fall of 2018, a six-month transitional period had also been provided for. However, by the end thereof, it appeared that only 25.000 out of an estimated total of 1.000.000 “enterprises” had actually registered, which prompted the Belgian Government to extend the transition period by another six months.

It will also be interesting to see what policy rules the operator of the RBE will develop as regards the “exceptional circumstances” carve-out for random third-party access, and how many requests will be formulated for such an exception.