Company registers compared across the EU — a KYB guide

Eight company registers, one EU directive underneath them, and no two that you can read the same way. Every member state keeps a business register under the company-law directive now codified as Directive (EU) 2017/1132. The core disclosure and third-party effect rules are therefore harmonised. The parts a payments firm’s KYB process actually depends on are not: the identifier, the document that proves something, how signing authority is shown, and what the register does to a company that stops filing. This hub compares the registers of Belgium, France, Italy, the Netherlands, Germany, Spain, Ireland and Luxembourg, and links to a full article on each.

1. Why a single KYB rule fails across these registers

A group onboarding policy tends to say “obtain a register extract less than three months old and verify directors against it”. Every register on this page can meet that sentence. It still yields different evidence in each market, because the registers differ on five points:

• Keying. In some registers the number identifies the entity nationally. In others it only means something alongside a court or province.
• Evidence weight. Several registers issue an informative extract and a separate certifying product, and only the second proves anything to a third party.
• Timing. A change binds you from publication, not from the board decision, and each register publishes differently.
• Signing authority. Some registers show how directors sign. Others leave powers in deeds you have to request.
• Enforcement. Registers close, flag or strike off non-filers, and each state leaves a different trace on the extract.

2. The registers at a glance

None of these registers says whether a counterparty may provide regulated services. That is for the supervisor’s own register. A KYB file that stops at the company extract has checked existence, not permission.

3. Identifiers: design the field, not the lookup

Three identifier shapes run through the eight markets, and a data model needs to know which one it is holding.

National entity keys identify a legal person across the whole state and survive a move of registered office: the Belgian enterprise number, the French SIREN, the Italian codice fiscale, the Dutch KVK-nummer, the Spanish NIF, the Irish CRO number and the Luxembourg RCS number. Scoped keys mean nothing without their scope. The German register number is tied to its court and register type. The Italian REA is tied to a province, and the Spanish hoja to a provincial registry. Location keys identify an establishment, not a person: the Belgian establishment-unit number, the French SIRET and the Dutch vestigingsnummer.

A single “company number” field will eventually match nothing or the wrong company. Capture three things: the country, the identifier type and the value. Validate length and check digits at the form, because Belgian and French numbers can be checked arithmetically and Dutch ones by length. Where the entity has one, also store the EUID, the European unique identifier used by the business-registers interconnection system. It is the only key that joins a branch in one register to its parent in another.

4. Informative extracts and certifying products

The single most common file defect across these markets is a document that informs where the file needed one that proves. Several registers draw the distinction in law.

For most onboarding decisions the informative product is right. The certifying product is for files that must evidence a company’s status to someone else, such as a court, a supervisor or a correspondent.

5. When a change binds you: one rule, local clocks

The effect of register publication is the most harmonised part of the picture. Article 16 of Directive (EU) 2017/1132 makes documents and particulars opposable to third parties once disclosed. For transactions in the fifteen days after disclosure, a third party that proves it could not have known is protected. Each national rule on this page is that provision in local form: § 15 HGB in Germany, Article 21 of the Commercial Code in Spain with its BORME publication, and Article 19-3 of the 2002 Law in Luxembourg, which runs from RESA publication to the sixteenth day. Italy has Article 2193 of the Civil Code for the ordinary section.

The clocks before publication differ. A Spanish director must be presented for inscription within ten days of accepting. An Irish change of director goes to the CRO on Form B10 within 14 days. A Luxembourg change must be filed within a month, and LBR registers it within three working days. In the gap, the register and reality disagree. Every one of these rules protects only a third party that did not know. Once your customer tells you a director has gone, the register can no longer protect you.

6. Signing authority: on the register, or in a deed

The registers differ most on who can bind the company, and it is the question an account-opening file most often gets wrong.

• Luxembourg records the régime de signature with each manager’s mandate and expiry, so the extract tells you whether one signature is enough.
• Ireland registers “registered persons” under section 39. They are deemed to have authority, and they stay deemed until the company notifies a revocation.
• Germany shows representatives and their powers on the AD. Share ownership of a GmbH sits in the filed shareholder list, not the entry.
• Spain inscribes general powers but not powers for specific acts, so a valid account-opening power may exist only in a notarial deed.
• Italy gives full effect to ordinary-section entries only. For a società semplice, representation must come from the constitutive documents.

“Verify the signatory against the register” is a complete control in Luxembourg and Ireland, and only a first step in Spain and Italy.

7. What the register does to a non-filer

Each register punishes non-filing differently, and each leaves a different mark on the extract.

The key difference is between the Irish strike-off and the Luxembourg one. The first ends the legal person. The second only ends the register’s reliability. Treating both as “company closed” freezes a live customer or keeps paying a dissolved one.

8. Activity codes moved underneath all of them

The activity code on the extract is the field most likely to have changed without the business changing. The EU classification moved to NACE Rev. 2.1, and national versions followed on different dates: NACE-BEL 2025 from January 2025, ATECO 2025 from April 2025, SBI 2025 in the Dutch register in September 2025, and NAF 2025 across SIRENE from 1 January 2027. Conversions picked one successor where an old code split. Our NACE Rev. 2.1 migration guide sets out the dates and what to do with a stored code.

9. What changes next

Directive (EU) 2025/25, the second company-law digitalisation directive, amends Directive (EU) 2017/1132. It creates an EU Company Certificate, which all member states must accept as proof of a company’s incorporation and of its registered details, including who may represent it. It also creates a digital EU power of attorney for defined company-law procedures. Member states must transpose it by 31 July 2027. Design the evidence field now to hold a certificate type, not just “extract”.

10. Three scenarios from a cross-border onboarding queue

A German parent and its Spanish subsidiary. Facts: a group onboards a GmbH and its Spanish SL together. The German number was captured as “HRB 12345” and the Spanish one as a hoja number. Rule: the German number only identifies with its court, and the hoja is registry-scoped. What the team does: re-keys the GmbH on court, type and number, and the SL on its NIF. It keeps the hoja as provenance and records both EUIDs to link parent and subsidiary. Outcome: the group structure resolves automatically on the next periodic review instead of failing to match.

A director who resigned last week. Facts: a Luxembourg Sàrl customer emails that a manager has left. The RCS still shows the manager, with a joint signing regime. Rule: under Article 19-3, publication governs opposability only for a third party without knowledge, and you now have knowledge. What the analyst does: stops accepting instructions signed by the departed manager. They check whether the remaining manager can sign alone under the recorded regime, and diarise a check for the filing. Outcome: no payment goes out on a signature the firm knows is void.

A counterparty flagged in two registers. Facts: periodic review finds an Irish customer with a notice of intention to strike off, and a Luxembourg customer marked “not up to date”. Rule: sections 726 to 733 of the Companies Act 2014 lead to dissolution, while Article 19-6 of the Luxembourg law does not. What the analyst does: prepares restrictions for the Irish customer from the remedial deadline. For the Luxembourg customer, they request the missing filings and move to direct evidence. Outcome: two flags that look the same on a dashboard get two different treatments.

11. What to do, today

• Replace the single “company number” field with country, identifier type and value, plus the EUID where one exists.
• Write a per-market evidence matrix that says which document supports a risk decision and which proves status to a third party.
• Date register changes by publication, and treat any customer notice as knowledge from the day it arrives.
• Make signatory checks market-specific: read the regime in Luxembourg and registered persons in Ireland, and ask for the deed in Spain and Italy.
• Map each register’s enforcement flag to an account action, and keep “dissolved” separate from “unreliable”.
• Add a vintage to every stored activity code.

Related: UBO registers compared across the EU · Account registers compared across the EU · Remote onboarding compared across the EU