RBE Luxembourg — beneficial owners register
Luxembourg’s beneficial ownership register did not just close to the public — it grew teeth. The Registre des bénéficiaires effectifs (RBE) was rebuilt by the loi du 23 janvier 2025, in force since February 2025. Two things happened at once. Access became a permission, decided case by case on the opinion of an advisory commission. And the operator acquired an escalating ladder that ends, twelve months after an unanswered verification letter, in the entity being struck off. A €40-a-day astreinte and an administrative striking-off bite in a way the theoretical €1,250,000 criminal fine never did.
1. Four duties, and they are not the same duty
A payment or e-money institution established in Luxembourg — or doing due diligence on Luxembourg counterparties — carries four distinct RBE obligations, sitting in different articles and failing in different ways.
| Duty | What it requires | Article |
|---|---|---|
| File and update | Register beneficial-owner data within one month of the triggering event | Article 4(1) |
| Hold the file at your registered office | Obtain and keep the same information plus supporting documents at the seat | Article 17(2) |
| Answer requests | Give national authorities the data within three days; give AML professionals the reduced field set within three days of a reasoned request | Articles 18 and 19 |
| Consult and report | Consult the RBE in the exercise of your missions, and report erroneous or missing data within thirty days of noticing | Article 8(1) |
The fourth is new in substance. Article 8 previously bound those who noticed a problem; the 2025 law added a positive obligation to consult the register in the exercise of your missions — converting an incidental discovery duty into a step in the onboarding process. A file with no evidence of an RBE consultation now has a gap in it.
2. Filing: one month, three working days, fifteen days
The register sits under the authority of the Minister of Justice and is operated by Luxembourg Business Registers, designated in the law as the gestionnaire and as data controller. Three timing rules govern the cycle:
- One month to file. Article 4(1) requires registration of the data and of any change within one month from when the entity knew, or should have known, of the event making it necessary. The clock runs from constructive knowledge — not from the board minute recording it.
- Three working days to register. Article 6(2) obliges the operator to make the entry within three working days of the filing — your lead time when a counterparty asks for a current extract.
- Fifteen days to regularise. Article 7 lets the operator refuse a filing that is incomplete or does not match the supporting documents and ask for regularisation; the entity then has fifteen days. Miss it and the refusal is notified by registered letter, with an appeal to the president of the district court heard as in référé.
The declarable fields under article 3(1) are broader than the set most firms carry: identity and nationalities, day, month, year and place of birth, country of residence, the precise private or professional address, the Luxembourg national identification number — or a foreign one for non-residents — and the nature and extent of the interests held. Companies admitted to trading on an EEA or equivalent third-country regulated market record only the name of that market.
3. The enforcement ladder the 2025 law built
The rewritten article 9 is the most consequential change for a filer, and it is a calendar rather than a discretion. The operator monitors the data, may demand documents justifying an entry, and sends a verification request by registered letter where it finds errors, gaps or a missing entry. If the entity has not replied or regularised within thirty days, the measures fall due in sequence:
| From | Measure |
|---|---|
| 1st day of the 2nd month after the request | A note published on the entity’s own file on the operator’s website, stating that a verification procedure is pending |
| 1st day of the 3rd month | Issue of certificates attesting the breaches found |
| 1st day of the 7th to the last day of the 9th month | A daily astreinte of €40 |
| 1st day of the 12th month | Striking off ex officio — without dissolution and without loss of legal personality |
Two details decide how badly this lands. The note and the certificates arrive long before any money is due, and are visible to anyone pulling the entity’s file — in practice, to a counterparty’s onboarding team. And updating the data after the measures start removes the note, the certificates and the striking-off, but not the astreinte: the operator liquidates it at the moment of the update, payable within thirty days, after which the notification is itself an enforceable title.
An entity struck off that still does not regularise is denounced to the public prosecutor, and the criminal layer survives alongside all of this. Articles 20 and 21 provide fines of €1,250 to €1,250,000 for missing the filing deadlines, for filing inaccurate, incomplete or out-of-date information, for failing to hold the information at the registered office, and — separately — for a beneficial owner who does not supply what article 17(1) requires.
4. Access: five doors, and only one of them is self-service
The 2025 rewrite of article 11 replaced open public consultation, invalidated by the Court of Justice in November 2022, with five categories:
- National authorities in the exercise of their missions — article 1(5) lists them exhaustively, from the prosecution service, investigating judges and the financial intelligence unit through the CSSF, the insurance commission, the tax, VAT and customs administrations to the export control office.
- Professionals subject to the 2004 AML law, for customer due diligence — expressly including due diligence on entities with which their client may transact.
- National self-regulatory bodies in their AML supervisory role.
- Persons demonstrating a legitimate interest in the fight against money laundering.
- State services and public establishments where a law provides for access.
Article 11(2) lists, non-exhaustively, who has a legitimate interest: professional journalists, including those established in other member states; EU-established non-profits whose object is combating money laundering and terrorist financing; persons who may transact with an entity and want to avoid any link with money laundering; and national authorities fighting money-laundering offences that do not already have access.
Scope differs by category. Authorities, professionals, self-regulatory bodies, public bodies, journalists and qualifying non-profits search across all registered entities; prospective counterparties reach only the entities that are the immediate object of their research.
5. The legitimate-interest application, in operational terms
Article 15bis, also new in 2025, is where a firm without professional status ends up, and it is deliberately narrow. The request may only concern entities directly linked to the applicant’s research, may not cover all registered entities, and may only search by RCS registration number or entity name — there is no search by individual, which forecloses using the RBE to find out what a person owns.
On pain of nullity the request must state the applicant’s identity in full, the registration number or name of each entity, and the basis of the request and the uses for which access is sought, with documents evidencing the legitimate interest. The operator decides on the opinion of an advisory commission created by article 15ter, weighing privacy and data-protection rights. A favourable decision produces an extract within three working days, and use is restricted to the purposes accepted. A refusal is appealable by recours en réformation to the administrative tribunal within one month; no extract issues while an appeal is pending.
Two mechanics matter when explaining the system to a data-protection officer. Article 13(2bis) requires strong authentication for all non-authority access plus logging of who consulted, what, when, the file reference and the precise reason, retained five years. Article 13(3) then forbids telling an entity or its beneficial owners that any of those categories consulted the file, and article 19quater limits the GDPR article 15 right accordingly, channelling it through the national data protection commission.
6. Three situations, and what the practitioner does
Scenario 1 — a verification letter arrives while the responsible person is on leave.
Facts: the operator writes asking a Luxembourg entity to justify a beneficial-owner entry. The registered letter reaches a corporate services address; nobody actions it for six weeks.
What the rule says: the thirty-day reply window under article 9(3) has expired, so from the second month a note appears on the entity’s public file, and from the third the operator may issue certificates attesting the breaches.
What the practitioner does: regularises immediately — which removes the note and the certificates — and fixes the receipt path. The measures that hurt commercially arrive in months two and three, long before the €40 astreinte in month seven. An RBE verification letter needs what a supervisory letter gets: a named owner and a diarised acknowledgement.
Scenario 2 — an onboarding file with no RBE consultation.
Facts: an institution onboards a Luxembourg holding company. The analyst takes the ownership chart from the customer and closes the file, with no RBE extract on it.
What the rule says: article 8(1) as amended requires professionals to consult the RBE in the exercise of their missions and to notify erroneous or missing data within thirty days of noticing. Article 19 separately lets you demand the reduced field set from the entity, on a reasoned request, within three days.
What the practitioner does: makes the consultation an evidenced step — the extract or a dated consultation record goes on the file — and gives the thirty-day discrepancy clock a start field. If no system records the moment of comparison, the deadline cannot be evidenced either way.
Scenario 3 — a group restructuring crosses the 25% line.
Facts: an intermediate holding is reorganised on the 5th. A previously non-declarable individual now holds 28% indirectly. Group legal learns of it seven weeks later.
What the rule says: the one-month clock in article 4(1) runs from when the entity knew or should have known. Article 20(2) also makes filing inaccurate or out-of-date information an offence in its own right — the entry still showing the old ownership is itself the breach.
What the practitioner does: files immediately, then makes the RBE update a consequence of the share-register change rather than a checklist task, and updates the copy held at the registered office under article 17(2) — a second, independently sanctioned obligation that a filing does not discharge.
FAQ
Is the Luxembourg RBE publicly searchable?
No. Since the law of 23 January 2025 access is limited to national authorities, AML professionals doing due diligence, self-regulatory bodies, persons demonstrating a legitimate interest, and public bodies where a law provides for it. Everything else goes through an application under article 15bis.
How long do we have to file a change?
One month from when the entity knew or should have known of the event requiring the entry or its modification, under article 4(1). The operator then has three working days to make the entry.
What happens if we ignore a verification letter?
Article 9(3) sets an escalating sequence after thirty days: a public note on the entity’s file from the second month, certificates attesting the breaches from the third, a €40 daily astreinte from the seventh to the end of the ninth, and striking off ex officio from the twelfth — without dissolution or loss of legal personality.
Does updating the register stop the astreinte?
It stops it running and removes the note, the certificates and the striking-off, but the operator liquidates the accrued amount at the moment of the update. It is payable within thirty days, after which the notification is an enforceable title.
What data do we see as an obliged entity?
Under article 12(2), fields 1° to 8°, 12° and 13° of article 3 — identity, birth data, country of residence, and the nature and extent of the interest held. The precise address and the identification number go only to national authorities.
Can we search the RBE by person?
Not through the legitimate-interest route. Article 15bis limits those requests to a search by RCS registration number or by entity name.
Will the entity know we consulted its file?
No. Article 13(3) requires the operator to ensure consultation happens without alerting the entity or its beneficial owners, and article 19quater channels the corresponding GDPR access right through the national data protection commission.
7. What to do, today
- Give RBE verification letters a named owner and a two-week internal deadline. The commercially visible measures land in months two and three, not month seven.
- Check the registered-office copy exists. Article 17(2) is a separate offence, and it is the obligation nobody audits.
- Make the RBE update a consequence of the share register. The one-month clock runs from constructive knowledge, so a quarterly review cycle is already late.
- Evidence the consultation, not just the conclusion. Article 8(1) now requires professionals to consult; an ownership chart with no consultation record does not show that you did.
- Decide which access door you are using before you need it. Professional status under article 11(1)(2°) and a legitimate-interest authorisation under article 15bis are different instruments with different scope, and only the second involves an application and an appeal window.
Related: Beneficial ownership registers — filing and discrepancies · CRBA — Luxembourg’s central register of bank accounts · CSSF Regulation 12-02 · What is a beneficial owner
