How to Verify a UBO in Luxembourg (2026): RBE & RCS Explained

Luxembourg has the most professionally-administered UBO register in the EU and one of the strictest access regimes. Both at once.

Two parallel registers (RCS and RBE), administered by a single body (the LBR), with a 2025 reform that closed public access while creating one of the cleanest legitimate-interest pathways in Europe. Penalties go up to €1.25 million. The data is verified against the national identity register. And from July 2026, the rules change again under the EU AML Package.

This guide cuts through it. What each register holds, who can access what in 2026, what it actually costs, and how to verify a UBO when you're outside the country.

RCS and RBE: Two Registers, One Manager

Luxembourg operates two separate registers, both administered by the Luxembourg Business Registers (LBR), an economic interest grouping under the authority of the Ministry of Justice.

The RCS holds the publicly available company data: legal name, registration number, registered office, articles of association, financial statements, directors. Most of this is free to download as PDF. The RBE holds the beneficial ownership declarations and is access-restricted.

Both connect to a single online portal at lbr.lu. As of August 2025, the LBR completed a redesign of the portal, and from 28 January 2026 announced a sustained programme of automated checks, manual reviews, and cross-checking against the national register of natural persons (RNPP) to improve data quality.

Where the Data Actually Comes From

Before going deeper into how each register works, it matters where the data originates. In Luxembourg, both registers are government sources operated by the LBR under the Ministry of Justice.

What "government source" means in Luxembourg

A government source is a register operated by a state authority where filings are made directly by the entity (or its agent) under a legal obligation. In Luxembourg:

• The RCS — companies file under the Law of 19 December 2002 on the trade and companies register. Filings are submitted electronically through the LBR portal using a LuxTrust certificate.
• The RBE — companies file beneficial ownership under the Law of 13 January 2019 (amended 27 January 2025). Filings are made within one month of the triggering event. As of 2026, data is automatically cross-checked against the national register of natural persons.

Third-party aggregators repackage this data, sometimes with added intelligence layers, but the original source is always one of these two. When a regulator audits your KYC file, they trace the data back to its origin. A clean audit trail starts with the LBR.

What you can pull, what's free, what's paid

Two practical points for cross-border obliged entities:

• The RCS is the realistic public source. Documents are free to view and download. Articles of association often disclose initial shareholders. Annual accounts and ownership disclosures filed by the entity itself are searchable.
• The RBE requires either professional access or a legitimate interest application. Filing fees are nominal (€15), but access is gated by LuxTrust credentials and a signed agreement with the LBR.

The RBE: What It Holds and Who Can Access It

The RBE was established by the Law of 13 January 2019, transposing Articles 30 of the EU's 4th and 5th Anti-Money Laundering Directives. It became operational on 1 March 2019, with a six-month transitional period. By 1 September 2019, all in-scope entities were required to have filed their UBO data.

For each beneficial owner, an entity must file:

• First name(s) and surname
• Date and place of birth
• Nationality
• Country of residence
• Private or professional address
• National identification number (or foreign equivalent)
• Nature and extent of the beneficial interest held

A beneficial owner is any natural person who ultimately owns or controls more than 25% of shares, voting rights, or capital, or who exercises control through other means. Where no natural person meets the threshold, the senior managing official is filed as the UBO.

Who can access the RBE in 2026

Until November 2022, the RBE was open to anyone in the public, free of charge. After the Court of Justice of the European Union ruled that unrestricted public access to UBO registers breached EU data protection law, the LBR suspended all access on the same day.

The Law of 27 January 2025 (in force from 1 February 2025) restored a tiered access model that has been operational throughout 2026.

The LuxTrust requirement

Tier 2 access is the route for most regulated obliged entities. To access the RBE as an AML/CFT professional, you need three things:

• A digital ID product issued by LuxTrust S.A. (or an eIDAS-compliant electronic certificate, or a Luxembourg eID card)
• A signed agreement with the LBR governing access to RBE consultation
• A registered account with the LBR identifying you as an AML/CFT professional

Every consultation is logged. Logs are retained for five years. Use of the RBE outside the framework of customer due diligence obligations is a violation of the access agreement.

The legitimate interest pathway

The Law of 27 January 2025 explicitly defines who qualifies for legitimate-interest access:

• Professional journalists as defined under the Law of 8 June 2004 on freedom of expression in the media, including those established in any EU Member State
• Non-profit organisations — associations and foundations established within the EU whose activities focus on AML/CFT
• Individuals seeking to identify beneficial owners of entities they may transact with, in order to avoid links to ML/TF

Approved applicants receive an extract within three working days containing names, nationalities, date and place of birth, country of residence, and nature/extent of beneficial interest. Sensitive data (full address, ID numbers) is not released.

This pathway is real but operationally narrow. It works for journalists and NGOs investigating specific entities. It does not scale to onboarding hundreds of counterparties. For commercial KYC at volume, Tier 2 (LuxTrust + AML/CFT agreement) is the only practical route.

The RCS: Public Data You Can Pull Today

While the RBE is restricted, the RCS remains publicly accessible. Most foreign obliged entities use it as the primary public-source touchpoint for Luxembourg companies.

What you can pull from the RCS

The limits of the RCS route

Luxembourg's RCS is more permissive than most EU member registers — documents are free to download and most filings are searchable. But it has a structural limitation for UBO verification: shareholder data is only consistently disclosed in articles of association at incorporation. Subsequent share transfers between private entities may not be filed publicly unless the company files an updated coordinated version of its articles.

Many Luxembourg holding structures use bearer shares (now restricted but historically prevalent) or share classes that complicate ownership calculation. For a five-layer cross-border structure, the RCS gets you part of the way but rarely all the way to the natural-person UBO.

What This Means for Cross-Border UBO Verification

For a foreign obliged entity verifying a Luxembourg counterparty in 2026, the practical position is:

1. The RBE is closed unless you have LuxTrust credentials. Foreign obliged entities can apply for legitimate-interest access on a case-by-case basis, but this is slow and not designed for volume KYC.
2. The RCS is open and free. You can pull articles of association, annual accounts, and director filings without an account. This is the primary route to surface ownership data.
3. Sensitive UBO data (full address, ID numbers) is unavailable to anyone except national authorities. Even AML/CFT professionals with full Tier 2 access see redacted data on these fields.
4. Most cross-border structures end in Luxembourg holding companies that themselves resolve to other jurisdictions. Luxembourg is rarely the end of the chain. It is usually a midpoint.

How to Approach UBO Verification in Luxembourg

Here is a practical workflow for verifying a UBO on a Luxembourg entity from outside Luxembourg.

Step 1: Identify the entity type

Search the LBR portal at lbr.lu. Confirm the company name, RCS number, status (active, in liquidation, dissolved), and legal form. Common forms: SARL (private limited), SA (public), SOPARFI (financial holding), SCSp (special limited partnership), SICAV (investment fund).

Step 2: Pull the RCS extract

The RCS extract is free to download as PDF. It shows the registered office, capital, directors, authorised signatories, and legal status. This is your starting point.

Step 3: Pull the articles of association

Articles of association are filed publicly and disclose initial shareholders, share classes, capital structure, and voting arrangements. For SARLs and SAs, this is the primary public source for ownership at incorporation.

Step 4: Check RESA for amendments

The RESA platform publishes statutory amendments — share transfers, director changes, capital increases. For ongoing entities, RESA filings reveal how the original shareholding has changed.

Step 5: Resolve corporate shareholders

Most Luxembourg holdings have corporate shareholders, often other Luxembourg holdings or entities in the Netherlands, Switzerland, Jersey, or offshore jurisdictions. For each corporate shareholder, repeat steps 1–4 in the relevant jurisdiction.

Step 6: Calculate effective ownership

Multiply percentages through each layer. Watch for share classes with disproportionate voting rights — common in Luxembourg holding structures.

Step 7: Apply for RBE access if needed

If the RCS data is insufficient and you cannot obtain LuxTrust Tier 2 access, consider a legitimate-interest application for the specific entity. This is slow and case-by-case.

Step 8: Screen the identified UBOs

Run sanctions, PEP, and adverse media screening on every natural person identified.

The 2027 Reset: AMLR and AMLD6

Luxembourg's 2025 reform was a major piece of work, but the EU AML Package will require further changes. Two key dates apply:

• 10 July 2026 — Member States must transpose Articles 11–13 and 15 of the 6th Anti-Money Laundering Directive (AMLD6), covering the further development of beneficial ownership registers
• 10 July 2027 — The Anti-Money Laundering Regulation (AMLR) becomes directly applicable in all EU member states, replacing national transpositions

For Luxembourg specifically, the practical consequences are:

Common Failure Points in Luxembourg RBE Filings

For internal compliance teams reviewing whether a Luxembourg entity has filed correctly, these are the most common reasons RBE submissions are rejected or flagged. They are also red flags when reviewing third-party RBE outputs:

• Inconsistency with RCS data. The 2025 reform introduced automated cross-checking between RCS and RBE filings. Mismatches in director names, registered office addresses, or entity status trigger administrative review.
• Failed identity verification against the RNPP. From 2026, RBE filings are cross-checked against Luxembourg's national register of natural persons. Filings with mismatched identification details are flagged.
• Late filing. The one-month filing window from the triggering event is strict. Late filings risk fines from €1,250 to €1,250,000 for entities and responsible officers.
• Senior managing official used as default. When no natural person meets the 25% threshold, the SMO is filed. Permitted but a red flag — it means the search for a true beneficial owner has not produced a result.
• Confidentiality restrictions. An entity or beneficial owner can apply to restrict access on grounds of fraud, kidnapping, blackmail, or violence risk, or where the BO is a minor. Restrictions are time-limited (max 3 years, renewable). A restricted record signals a higher-risk relationship.
• Failure to update within one month of change. Any change in beneficial ownership must be filed within one month. Stale data is a compliance failure for both the entity and any obliged entity relying on it.