In Luxembourg, the major EU reforms get all the attention: DORA for the financial centre, the CSRD for large groups. Meanwhile, three much simpler obligations of Luxembourg law apply to a far wider range of companies, and their penalties are anything but symbolic.
The register of beneficial owners, always up to date
Any entity registered with the Trade and Companies Register must enter its beneficial owners in the RBE, then declare each change within one month. The law of 13 January 2019, amended in 2025, punishes knowingly failing to register or a knowingly inaccurate registration with a fine of €1,250 to €1,250,000. The classic trap: a share transfer or a change of manager, properly handled at the Trade and Companies Register, and forgotten in the RBE.
The whistleblowing channel, from 50 workers
Since the law of 16 May 2023, any private-law entity with 50 or more workers must have a confidential internal reporting channel: acknowledgement of receipt within 7 days, feedback to the whistleblower within 3 months, an impartial person designated for follow-up. Failing to set up a channel is liable to an administrative fine of €1,500 to €250,000, doubled for a repeat offence within five years.
NIS2: the Luxembourg law has been in force since May
The law of 5 May 2026 transposes the NIS2 directive. Essential and important entities had to submit their information to the competent authority (the ILR, or the CSSF for the financial sector) before 10 July 2026, and must now manage their cybersecurity risks and notify any significant incident within 24 hours. Fines can reach €10,000,000 or 2% of worldwide turnover for an essential entity.
These three obligations, AML/CFT, e-invoicing to public bodies and the CSSF circulars are now assessed by Normivia for any Luxembourg company, in French or English, with the official source of each verdict. The details are on our Luxembourg page, and the free diagnostic now accepts a head office in Luxembourg.
Source: Law of 13 January 2019 (RBE), art. 3, 4, 20 and 21; law of 16 May 2023 (whistleblowers), art. 6, 7 and 18; law of 5 May 2026 (NIS2), art. 11, 14 and 26 — Legilux, verified on 26/10/2026.