On 15 January 2019, the law establishing a Luxembourg register of beneficial owners (the "REBECO Act"), transposing Article 30 of the 4th AML Directive (2015/849/EU), was published. The REBECO Act will enter into force on 1 March 2019. Entities that fall within its scope will have six months (i.e., until 1 September 2019) to comply with the act's provisions.
Entities to which the REBECO Act applies
The REBECO Act applies to entities registered with the Luxembourg Trade and Companies Register (Registre de Commerce et des Sociétés or "RCSL"), including civil and commercial companies, branches of foreign companies, Luxembourg common investment funds (F.C.P.) and other types of investment funds such as the UCITS, SICAR, RAIF and SIF (the "Entity(-ies)").
There is nevertheless an exception for companies whose securities are admitted to trading on a qualifying regulated market ("Qualifying Listed Entities").
Obligations to provide, update and keep information
Entities must keep at their offices and provide the Luxembourg Business Register (the "LBR"), which manages the RCSL, regularly updated information on their ultimate beneficial owner(s).
The information to be provided includes the ultimate beneficial owner 's first and last name, nationality, date and place of birth, country of residence and national identification/registration number, and the nature and scope of the interest held in the Entity. Qualifying Listed Entities are only required to provide the name of the market on which their securities are traded.
Rights and obligations of ultimate beneficial owners
Ultimate beneficial owners are obliged to provide the Entity with all information necessary for it to comply with its obligations under the REBECO Act.
Ultimate beneficial owners have a right, under Article 15 of the REBECO Act, to request that access to their information be limited, as indicated below.
Access to information relating to ultimate beneficial owners - general rule and exceptions
National authorities, such as the tax administration, the public prosecutor's office, the customs authorities, etc., shall have unlimited access to the information stored in the LBR. Furthermore, "any person" will be entitled to access certain information (including the scope of the beneficial interest). Relevant persons and authorities can also request an electronic or hard copy of the information to which they have access.
Article 15 of the REBECO Act allows an Entity or the relevant ultimate beneficial owner to submit, in exceptional circumstances and on a case-by-case basis, a reasoned request to limit access to the information on file to the national authorities, banking and financial institutions, bailiffs and notaries, to the exclusion of all other users. A limitation will be granted only if access to the information would expose the ultimate beneficial owner to a disproportionate risk of interference with his or her rights protected by relevant national legislation and international treaties or to the risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation or when the ultimate beneficial owner is a minor or is otherwise incapacitated. Upon receipt of a request for restricted access, the LBR will limit access to the information on file until notification of its decision. If a decision rejecting a limitation is appealed, access will remain restricted until the LBR's decision becomes final. In any case, if a limitation is granted, it is temporary and subject to renewal every three years.
Data protection aspects
For purposes of GDPR compliance, the REBECO Act states that the Ministry of Justice is considered the data controller and the LBR the data processor for the registration, storage, management and provision of ultimate beneficial owners' information. The Government IT Centre (CTIE) is the data processor responsible for the information technology aspects of the LBR.
Entities and the LBR shall communicate via secure electronic means of communication. The REBECO Act states that the LBR may file information on behalf of Entities but is not responsible for the accuracy of the information submitted.
In addition to the data protection concerns raised by the European Data Protection Supervisor in relation to the 4th AML Directive, the Luxembourg data protection authority (CNPD) also expressed some concerns in relation to the REBECO Act in December 2018. It remains to be seen to which extent these will be addressed in the future Grand-Ducal Regulation which will clarify, amongst other things, the conditions to access the LRB.
Sanctions
Ultimate beneficial owners and Entities are responsible for complying with their respective obligations under the REBECO Act.
Failure to file or late filing, the intentional provision of inaccurate, incomplete or out-of-date information by an Entity and failure by an Entity to obtain and maintain regularly updated information on ultimate beneficial owners can result in the imposition of fines ranging from EUR 1,250 to EUR 1,250,000. The same penalties apply to ultimate beneficial owners that do not comply with their obligation to provide the Entity with the information necessary for it to comply with its obligations under the REBECO Act.
Further clarification
A Grand-Ducal Regulation is expected to be adopted to provide additional information regarding, amongst other matters, the conditions and formalities to file and access information with the LBR.
