Luxembourg SARL reform: Draft law allows deferred payment of minimum share capital
On 16 December 2025, the Luxembourg government submitted draft law n°8669 to the Chamber of Deputies, proposing an amendment to the law of 10 August 1915 on commercial companies (the “1915 Law”). The draft law would allow Luxembourg private limited liability companies (sociétés à responsabilité limitée – SARLs) to defer payment of their statutory minimum share capital of EUR 12,000 for up to 12 months after incorporation.
If adopted, the reform would mark a significant evolution of the Luxembourg SARL regime, introducing greater flexibility in company formation while preserving core principles of creditor protection and legal certainty.
Modernisation of an outdated rule
Under the current Luxembourg company law framework, a Luxembourg SARL must have a minimum share capital of EUR 12,000, which must be fully paid up at the time of incorporation. This requirement, introduced by the law of 18 September 1933 and historically inspired by French company law, is increasingly viewed as rigid in light of modern corporate, investment and structuring practices.
In practice, the obligation to open a bank account and deposit the share capital prior to incorporation often delays the formation of new entities. These delays are frequently exacerbated by anti-money laundering and know-your-customer obligations imposed on financial institutions, which may require extensive due diligence before allowing capital payments.
By introducing a deferred payment mechanism, Luxembourg would align itself more closely with several other EU jurisdictions where full payment of share capital at incorporation is not always required and, in some cases, minimum capital requirements have been abolished altogether.
Key features of the proposed reform
Deferred payment of minimum share capital
Founders of a Luxembourg SARL would be permitted to defer payment of the statutory minimum share capital of EUR 12,000 for up to 12 months from the date of incorporation, unless the articles of association or the constitutive deed provide for a shorter period. This mechanism applies exclusively to contributions in cash.
Any capital subscribed in excess of the statutory minimum must, however, be fully paid at the time of incorporation.
Subscription requirement maintained
The reform does not affect the obligation to fully subscribe the share capital at incorporation. Full subscription remains a constitutive requirement for a SARL. The reform is limited to allowing a deferral of payment of the subscribed share capital and does not introduce any form of partial or progressive subscription.
No deferral for contributions in kind
Contributions in kind must continue to be fully paid at the time of incorporation, together with any issue premium (prime d’émission) relating to such contributions.
Issue premiums at incorporation
Where an issue premium is provided for in connection with the capital subscribed at incorporation and paid in cash, the draft law removes the obligation for immediate payment. Such issue premiums may be paid within the same 12-month period as the minimum share capital.
This flexibility does not apply to:
-
issue premiums linked to capital exceeding the statutory minimum; or
-
issue premiums related to capital increases after incorporation.
Capital increases excluded
Shares issued after incorporation, and any related issue premium, must continue to be fully paid at the time of issuance. The deferred payment regime is therefore strictly limited to the initial constitution of the SARL.
Suspension of voting rights
Where a shareholder fails to pay the amounts due following a valid and exigible call for funds, the voting rights attached to the unpaid shares are suspended until full payment is made.
Liability regime aligned with public limited companies
The draft law aligns the SARL regime with that applicable to public limited liability companies (sociétés anonymes – SAs), notably by:
-
extending founders’ liability to cover the effective payment of the capital, including where payment has not been made upon expiry of the 12-month period; and
-
limiting the liability of transferring shareholders in respect of post-transfer debts, subject to safeguards for liabilities accrued prior to publication of the transfer.
Disclosure of unpaid capital
To protect third parties, the identities of shareholders whose shares (or related issue premiums) have not been fully paid, together with the outstanding amounts, must be published alongside the annual accounts, in addition to existing disclosure requirements applicable where reference is made to the share capital in corporate documents.
Practical relevance for investors, entrepreneurs and other economic actors involved in structuring
The proposed reform is particularly relevant for:
-
private equity and real estate structures, where rapid incorporation is required ahead of transaction closings;
-
start-ups and SMEs, which may not have immediate access to the full amount of capital at incorporation; and
-
investment funds, which frequently use SARLs companies as holding or acquisition vehicles and may face timing mismatches between incorporation and funding.
By introducing additional flexibility while maintaining transparency and creditor protection, the reform is expected to further enhance Luxembourg’s attractiveness as a structuring jurisdiction.
Next steps
The draft law will now be subject to parliamentary debate and may be amended during the legislative process. If adopted, it would represent a significant evolution of the Luxembourg SARL regime.
At Chevalier & Sciales, we regularly advise clients on Luxembourg company formation, structuring and corporate governance matters. We are closely monitoring the legislative process and will provide updates as the draft law progresses.
If you are considering the incorporation of a Luxembourg SARL, or reviewing existing structures in light of this reform, our corporate team remains at your disposal to assess its practical implications.
CSSF Circular Updates: ICT Risk Management and Use of ICT Third-Party Services Under DORA
On 9 April 2025, the Commission de Surveillance du Secteur Financier (“CSSF”) published a set of regulatory updates in response to the entry into application of the Digital Operational Resilience Act (“DORA”). These updates include two newly issued circulars and amendments to two existing ones. Together, they seek to clarify the interaction between Luxembourg’s domestic information and communication (“ICT”) related supervisory framework and the directly applicable DORA rules, while maintaining certain specific provisions relevant at national level.
The updates are relevant for both entities within the scope of DORA (“DORA entities”) and those that remain outside it (“non-DORA entities”). Entities falling under either classification are advised to reassess their regulatory position, notification obligations, and third-party contractual arrangements in light of the clarified framework.
Key Takeaways
- CSSF Circular 25/880 introduces a standalone regime applicable exclusively to Payment Service Providers (“PSPs”). It implements the revised EBA Guidelines on ICT and security risk management (EBA/GL/2025/02), which amend the earlier EBA/GL/2019/04, and consolidates the ICT risk and reporting framework applicable to PSPs in Luxembourg. The circular also integrates the reporting requirement set out in Article 105-1(2) of the Law of 10 November 2009 on payment services. The aim is to isolate PSP-specific rules from the broader framework applicable to non-PSP and non-DORA entities, while aligning national supervisory expectations with the latest EBA standards.
- CSSF Circular 25/881 amends Circular CSSF 20/750 by narrowing its scope of application. As of 9 April 2025, Circular 20/750 applies only to non-DORA entities, with PSP-related provisions removed in light of the creation of Circular 25/880. The result is a cleaner separation of regimes, non-DORA entities remain subject to the amended Circular 20/750, whereas PSPs and DORA entities are subject to their respective frameworks.
- In response to the harmonised rules introduced by DORA on ICT third-party risk management, the CSSF has issued CSSF Circular 25/882. This circular outlines supervisory expectations applicable to DORA entities when relying on external ICT service providers, including providers involved in the performance of critical or important functions. The circular defines the types of in-scope entities in line with DORA article 2(1), including credit institutions, investment firms, UCITS management companies (both Chapter 15 and Chapter 16), alternative investment fund managers authorised under Chapter 2 and internally managed alternative investment funds within the meaning of point (b) of Article 4(1) of the Law of 12 July 2013 on alternative investment fund managers, and investment companies without a designated management company. In particular, the CSSF reiterates the obligation for DORA entities to submit a notification in a timely manner for any planned ICT outsourcing arrangement that supports a critical or important function, or when a function subsequently becomes critical or important. Entities are also required to maintain a register of information, with the submission window for the 2025 reporting year set between 1 April and 15 April. Circular 25/882 also maintains certain provisions originally found in Circular 22/806 that are not addressed by DORA but which the CSSF considers necessary for local supervision. These include Luxembourg-specific expectations in areas such as data localisation, backup arrangements for (outsourced) accounting systems, and the appointment of a qualified cloud officer. Furthermore, the CSSF confirms it will continue to distinguish between cloud and non-cloud ICT services, notwithstanding the absence of such distinction in the DORA Regulation itself. The overall objective is to ensure continued supervisory visibility over critical ICT dependencies, while allowing the CSSF to rely on established national mechanisms that have proven effective in practice.
- CSSF Circular 25/883 amends Circular CSSF 22/806 in order to remove the ICT outsourcing provisions that have now been superseded by DORA and Circular 25/882, but only for entities that fall under the DORA regime. As a result, ICT outsourcing is no longer governed by Circular 22/806 for DORA entities, although business process outsourcing remains in scope. In contrast, non-DORA entities remain fully subject to Circular 22/806, including its ICT outsourcing requirements. Moreover, the circular remains applicable to Chapter 16 management companies for the purposes of ICT outsourcing, given their exclusion from the broader DORA regime. Finally, the CSSF has repealed the previous requirement for cloud service agreements to be subject to the law of an EEA Member State and for cloud resilience to be ensured within the EEA. This change introduces a degree of contractual flexibility across both DORA and non-DORA regimes.
Practical Considerations and Next Steps
As part of the update, the CSSF has released new standard forms for ICT third-party arrangement notifications. DORA entities are expected to use the new form as of 9 April 2025, although a transition period until 10 May 2025 has been granted, during which submissions using the previous template will still be accepted.
Entities are reminded that notification timelines remain unchanged. As a general rule, notifications must be made at least three months in advance, or one month for certain Luxembourg PFS entities.
Conclusion
Through these regulatory adjustments, the CSSF introduces a dual-track supervisory model: one aligned with DORA for entities falling within its scope, and one maintained under amended national rules for all other supervised entities. By preserving certain operational and reporting practices rooted in earlier CSSF circulars, the regulator ensures both continuity and coherence in the transition to the new European framework.
All affected entities should now assess their ICT and outsourcing frameworks in light of these developments. This includes reviewing existing and upcoming contracts, updating internal registers, and ensuring that applicable notification obligations are met in a timely manner.
For guidance on how these changes may affect your operations, including assistance with notification procedures or compliance assessments, our team remains at your disposal.
Chevalier & Sciales advises on the acquisition of Nobu Hotel in London
Chevalier & Sciales is pleased to have advised Limestone Capital AG, a private equity firm focused on the European hospitality sector, on the successful acquisition of Nobu Hotel London Shoreditch for an undisclosed sum. Located in one of London’s most dynamic districts, the property offers 164 guest rooms, a restaurant, fitness and wellness facilities, and over 3,000 square feet of event space while showcasing views of the City from their top suites.
The team at Chevalier & Sciales, led by Cécile Rechstein, provided comprehensive legal and regulatory guidance, covering tax and corporate matters.
Luxembourg’s Draft Law No. 8476: Implementing the EU AI Act
Summary/Abstract
On 23 December 2024, Luxembourg submitted Draft Law No. 8476 to support the implementation of the EU Artificial Intelligence Act (Regulation (EU) 2024/1689). The bill outlines the designation of national authorities responsible for market surveillance, conformity assessments, and cooperation with EU institutions. It also introduces regulatory sandboxes, clarifies enforcement mechanisms, and sets out applicable sanctions. Businesses developing or deploying AI systems in or from Luxembourg should assess their classification and compliance readiness, especially with the AI Act’s staged application beginning in February 2025.
Luxembourg advances implementation of the EU AI Act
On 23 December 2024, the Luxembourg government introduced Draft Law No. 8476 as part of its national strategy to implement the EU’s landmark Artificial Intelligence Act (AI Act). The bill is currently under review by the Chambre des Députés and focuses on setting up the legal and institutional mechanisms needed to enforce the EU regulation at national level.
The AI Act imposes harmonized rules for the development, marketing, and use of AI systems in the EU, relying heavily on Member States to appoint competent authorities and structure enforcement mechanisms. Draft Law No. 8476 fills this role in Luxembourg’s legal framework.
Scope and objectives
The draft law’s core objective is to provide a procedural and organizational foundation for Luxembourg’s enforcement of the AI Act. It addresses:
-
Designation of notifying authorities to accredit and monitor conformity assessment bodies (CABs);
-
Identification of market surveillance authorities based on sectoral competence;
-
Establishment of a cooperation framework for national and EU-level enforcement;
-
Creation of AI regulatory sandboxes for supervised innovation;
-
Specification of enforcement powers and sanctions.
Notifying authorities and conformity assessment
The draft law identifies the following bodies as notifying authorities:
-
Office luxembourgeois d’accréditation et de surveillance (OLAS) – general oversight and accreditation;
-
Agence luxembourgeoise des médicaments et produits de santé (ALMPS) – oversight in the medical and health sectors;
-
Commissariat du gouvernement à la protection des données (CGPD) – competent for AI systems involving personal data processed in state procedures.
These authorities are tasked with supervising conformity assessment bodies (CABs), which certify whether high-risk AI systems meet the requirements of the AI Act based on standards, documentation, and technical testing.
For high-risk systems used by law enforcement, immigration or asylum authorities, assessments will be carried out directly by the Commission nationale pour la protection des données (CNPD), reflecting the sensitivity of such use cases.
Market surveillance authorities
The bill adopts a sector-specific approach to enforcement by assigning market surveillance functions to a range of authorities based on their existing regulatory remit:
-
CNPD – Default horizontal surveillance authority and single contact point with the European Commission.
-
Commission de surveillance du secteur financier (CSSF) – Financial services and markets.
-
Commissariat aux assurances (CAA) – Insurance sector.
-
Autorité de contrôle judiciaire – Judiciary and prosecution bodies.
-
ILNAS – Products and services regulated under EU harmonisation legislation.
-
ILR – Critical infrastructure and digital services.
-
ALMPS – Healthcare and medical devices.
-
ALIA – Compliance with content transparency obligations, including AI-generated or manipulated media.
These authorities are granted investigatory and enforcement powers, including inspections, orders to correct or remove non-compliant AI systems, and—where necessary—application of penalties.
Regulatory sandboxes
The draft law introduces a legal basis for the establishment of AI regulatory sandboxes, a feature encouraged by the AI Act. These are supervised environments where businesses can test innovative AI systems in collaboration with regulators, promoting early-stage compliance and responsible development.
Each surveillance authority will be expected to administer sandboxes within its sector, enabling tailored support for participants.
Coordination and EU cooperation
To ensure alignment with EU enforcement, the CNPD is designated as the single national contact point under Article 70(2) of the AI Act. The CNPD will coordinate Luxembourg’s cooperation with the European Commission, other Member State authorities, and relevant EU bodies such as the AI Office.
The draft law also contains provisions for structured inter-agency cooperation at national level and anticipates Union safeguard mechanisms, which may be triggered for serious cross-border compliance issues. In such cases, enforcement measures taken in Luxembourg could be escalated to EU level, potentially resulting in coordinated market restrictions.
Sanctions and enforcement powers
In line with the AI Act, the bill outlines a graduated system of sanctions:
-
Up to €35 million or 7% of global turnover for prohibited AI practices (Article 5 AI Act);
-
Up to €15 million or 3% for violations involving high-risk AI systems;
-
Up to €7.5 million or 1% for providing false or misleading information.
Fines are subject to proportionality rules for SMEs and startups. Competent authorities may also issue warnings, orders, and public notices. Decisions may be appealed before the Administrative Court of Luxembourg.
Strategic implications for businesses
As implementation of the AI Act progresses, companies developing or deploying AI systems within Luxembourg or across borders should begin preparing for compliance. Immediate steps may include:
-
Classifying systems under the AI Act’s risk tiers (e.g. high-risk under Annex III);
-
Reviewing documentation and governance to ensure transparency, human oversight, and post-market monitoring;
-
Assessing contractual frameworks with deployers, importers, and distributors;
-
Engaging with potential CABs for early-stage guidance;
-
Preparing for sandbox participation in case of novel or complex AI applications;
-
Aligning GDPR compliance, particularly in cases involving personal data or AI-generated content.
Conclusion
Draft Law No. 8476 provides Luxembourg’s legal backbone for enforcing the AI Act. It takes a structured, competence-based approach, emphasizing coordination between national agencies and with the European Commission. The bill reflects Luxembourg’s dual commitment: encouraging trustworthy AI innovation while ensuring robust enforcement and protection of fundamental rights.
Businesses active in Luxembourg’s AI ecosystem should view this development as both a compliance imperative and a strategic opportunity to engage proactively with regulators. The first key provisions of the AI Act will begin to apply six months after entry into force—which may be as early as February 2025.
CSSF Updates AML/CFT blacklist with 4 countries
On October 28, 2024, Luxembourg’s financial sector regulator, the Commission de Surveillance du Secteur Financier (CSSF), updated its circular CSSF 22/822. This amendment added Algeria, Angola, Côte d’Ivoire, and Lebanon to the FATF’s list of jurisdictions under increased monitoring, while removing Senegal due to its progress in addressing anti-money laundering and counter-terrorism financing (AML/CFT) deficiencies.
In October 2024, Algeria, Angola, Côte d’Ivoire, and Lebanon each committed to collaborating with the FATF and their relevant regional bodies to strengthen their AML/CFT measures. These commitments include efforts to improve national cooperation, increase transparency on beneficial ownership, expand oversight of financial and non-financial sectors, and enhance investigations and sanctions related to money laundering and terrorism financing. Algeria and Angola have focused on strengthening supervision and financial intelligence, Côte d’Ivoire has reinforced its legal and asset management frameworks, and Lebanon has targeted anti-bribery measures, risk management, and unlicensed financial activities.
In contrast, Senegal, which has made significant strides since 2021, was removed from the list. The FATF recognized Senegal’s achievements in enhancing its understanding of AML/CFT risks, fostering international cooperation, improving financial institution supervision, expanding law enforcement capacity, implementing sanctions, and monitoring high-risk non-profits.
The Democratic People’s Republic of Korea (DPRK), Iran, and Myanmar are still listed as high-risk jurisdictions requiring enhanced due diligence and/or countermeasures due to significant strategic deficiencies in their regimes to counter money laundering, terrorist financing, and proliferation financing.
As of today, the following countries are identified as high-risk countries:
Get in touch with our Corporate team for advice and assistance on the latest developments.
New EU Commission study on areas most at risk of corruption
Corruption impacts every sector, but some areas are particularly vulnerable, especially those handling large public funds or delivering essential services like healthcare. To better understand these vulnerabilities, the European Commission released the study “High-risk Areas of Corruption in EU Member States: A Mapping and In-Depth Analysis” (https://op.europa.eu/fr/publication-detail/-/publication/5c0730b2-9769-11ef-a130-01aa75ed71a1/language-en) on November 4, 2024. Launched in 2023, the study highlights six key sectors facing high corruption risks, examining the reasons for these risks and offering insights into how corruption damages critical systems.
The study’s findings highlight six specific areas—healthcare, finance, public procurement, defence and security, construction and infrastructure, and sports. Corruption in these areas not only undermines service quality and trust but also often involves cross-border elements that call for coordinated EU action. The findings of the study were a major point of discussion at the 2nd plenary meeting of the EU Network Against Corruption on October 3, 2024.
The study’s results also align with the EU’s 2023 Joint Communication on the fight against corruption, emphasizing that this research will inform the EU’s first full anti-corruption strategy. A follow-up study will investigate actions that mitigate corruption in these high-risk areas.
Which sectors are most at risk, and what are the specific threats?
The study outlines six high-risk sectors in detail, each facing unique challenges that require tailored anti-corruption strategies:
Public Procurement: Why is it so vulnerable?
Public procurement—where governments spend on goods and services—makes up around 14% of the EU’s gross domestic product (GDP), with expenditures of over EUR 2 trillion each year. The large amounts of money, combined with complex and often opaque processes, make this sector a prime target for corruption. Here, common forms of corruption include bribery, collusion, and embezzlement. Corruption in public procurement not only diverts funds from their intended uses but can also lead to inflated costs, poor service quality, and weakened public trust. Improving transparency and enhancing oversight mechanisms are vital to reducing corruption in this sector.
How does corruption affect healthcare in the EU?
Healthcare is a vital sector, and corruption here can have direct consequences on public health and safety. With significant budgets, multi-layered supply chains, and a mix of public and private players, the sector faces risks that include fraudulent billing, conflicts of interest, and favouritism. The financial impact of healthcare-related corruption in the EU is estimated at up to EUR 56 billion each year. As healthcare access is often a matter of life and death, these vulnerabilities create serious risks for patients. Tackling healthcare corruption requires strengthening regulatory frameworks and improving transparency to safeguard both resources and patient outcomes.
What makes the financial sector so attractive for corrupt practices?
The financial sector, encompassing banking, insurance, and investments, is a cornerstone of the EU’s economy. However, it also harbours considerable corruption risks, including money laundering, tax evasion, and links to organized crime. Corruption in this sector often crosses borders, as criminal groups exploit jurisdictional differences to launder money or evade taxes. Such activities are estimated to cost the EU up to EUR 1 trillion annually. Addressing corruption here calls for coordinated regulatory responses across Member States, with robust measures to counter tax fraud and financial crime.
Why is the defence and security sector at such high risk?
Increased defence spending in response to EU security demands has made the sector more vulnerable to corruption. The high level of secrecy, significant funding, and involvement of both national and international supply chains all contribute to risks such as bribery, arms sales corruption, and the misuse of procurement funds. Corruption within the defence sector affects national security, while the sector’s opacity makes tracing and combating corruption challenging. Addressing these issues requires establishing clearer accountability standards and promoting transparency in defence-related spending.
How does corruption impact construction and infrastructure?
The construction and infrastructure sector is essential to economic growth, but its projects are often susceptible to corruption due to high value, complex procurement processes, and extensive timelines. Common practices include bid-rigging, use of substandard materials, and bribery, leading to costly projects and compromised safety standards. Corruption in this area not only raises costs but can also jeopardize public safety when corners are cut on safety requirements or materials. With the sector contributing approximately 5% to the EU’s total gross value added, reforms to improve oversight and regulatory compliance are essential to safeguard public resources.
How widespread is corruption in sports, and what are its effects?
Sports corruption in the EU is particularly evident in betting and match-fixing schemes, with football and tennis being prime targets for illicit activities. Corruption in this area not only damages the integrity of sports but also exploits players, fans, and communities, particularly through illegal betting networks. Match-fixing and other corrupt practices not only erode public trust in sports but also involve complex international crime networks. Addressing these issues requires coordinated efforts across borders, with enhanced regulatory frameworks that address sports betting, match-fixing, and associated financial crimes.
What is the Path Forward for Tackling Corruption in High-Risk Sectors?
The study’s conclusions stress the need for a strategic, multifaceted approach to effectively address corruption in these six sectors. Suggested actions include enhancing transparency, improving regulatory collaboration across borders, and bolstering enforcement capabilities to counter complex, evolving corruption risks. By implementing a robust anti-corruption framework across the EU, Member States can work together to protect public resources, enhance service quality, and rebuild trust in public institutions.
These findings will inform the EU’s forthcoming anti-corruption strategy, which will focus on prevention, enforcement, and accountability. Prioritizing these high-risk sectors offers an opportunity to mitigate the extensive impacts of corruption, fostering a safer, more transparent, and fair society for all Europeans.
Get in touch with our Corporate team for advice and assistance on the latest developments.
New RCS Filing Requirements: Mandatory Luxembourg National Identification Numbers for Natural Persons
Starting on 12 November 2024, the Luxembourg Business Registers (LBR) will introduce new filing requirements for natural persons associated with entities registered in the Luxembourg Trade and Companies Register (RCS). These changes are aimed at enhancing the accuracy of records and aligning with the National Register of Natural Persons, thereby improving the quality of official information.
Who Will Be Impacted?
The new obligations will apply to all natural persons associated with entities registered in the RCS, including individuals acting in roles such as managers, directors, shareholders, auditors, and legal representatives. This requirement applies regardless of whether the individuals are resident or non-resident in Luxembourg.
Exemptions: Certain categories of individuals are exempt from this obligation, such as judicial representatives in legal matters and agents of foreign entities with branches in Luxembourg.
Key Updates and Required Information
The most notable change is the requirement for entities to submit the Luxembourg National Identification Number (LNIN)—often referred to as the Matricule or CNS number—for each natural person affiliated with an entity.
- For those already holding a LNIN: Entities simply need to input the LNIN in the appropriate field during the next filing or update. No additional documentation will be necessary.
- For those without a LNIN: An application for a new LNIN will need to be submitted. The application must include personal information such as full name, date and place of birth, nationality, gender, and private home address. In addition, proof of identity and residence documents will be required, with translations accepted in either Luxembourg’s official languages or English (non-certified translations are sufficient).
Confidentiality: While the LNIN will be mandatory, it will not be made public in the RCS. Other personal details, such as gender, nationality, and residence information, will similarly remain confidential. These details will be shared with the State Information Technology Centre (Centre des technologies de l’information de l’Etat) for entry into the National Register of Natural Persons.
Transition Period and Compliance
A transition period starting from 12 November 2024 will be granted, during which entities will be able to update their records free of charge. The duration of this transition has not yet been officially determined. During this phase, filings can proceed even without providing the LNIN, but all entities must ensure they have completed the updates before the end of this period.
Once the transition period closes, filings involving natural persons—whether new registrations, modifications, or annual updates—must include the LNIN. Failure to comply may result in the rejection of filings by the RCS.
Effects on the Register of Beneficial Owners (RBE)
For those listed in the Register of Beneficial Owners (RBE), these changes will also require updates to the RBE records, ensuring that the LNIN is included in line with RCS filings. Keeping these records synchronized is crucial to prevent inconsistencies.
What Steps Should Entities Take?
Entities are encouraged to begin gathering LNINs for all relevant individuals as soon as possible. For those who do not yet have a LNIN, it is advisable to start the application process to avoid delays.
If you require assistance in navigating the registration or updating process, we are here to help. We can provide guidance on both the application for new LNINs and compliance with the updated RCS filing requirements.
For further details, you can consult the LBR FAQ regarding these new requirements, available in French FAQ – Identifiant National (lbr.lu).
Should you have any questions or need further support for the registration, feel free to reach out to our Corporate team.
EU finalizes AI Act: A landmark regulation for Artificial Intelligence
On 21 May 2024, the European Council gave its final approval to the much-anticipated Artificial Intelligence regulation (the “AI Act”), establishing harmonized rules for AI development, placement on the market, and usage within the European Union (EU). This marks the EU’s first significant effort to regulate AI technologies, reflecting their increasing importance in modern economies.
What is the AI Act?
The AI Act provides a comprehensive legal framework for the regulation of AI systems, based on the risks they pose to fundamental rights, safety, and public health. It aims to strike a balance between fostering innovation and ensuring adequate oversight.
After nearly three years of legislative negotiations, the Act has substantially expanded from its original proposal. One of the most notable additions is the inclusion of general-purpose AI models as a newly regulated category—underlining the EU’s focus on AI as a strategic area of concern.
Highlights of the AI Act
Risk-based categorization of AI systems
The AI Act introduces a tiered framework, categorizing AI systems into four groups based on the risks they present:
-
Prohibited AI practices (Art. 5)
These include systems using manipulative or exploitative techniques that could lead to harm or discrimination. Such practices are strictly banned across the EU with no exceptions. Examples include social scoring and certain types of biometric surveillance. -
High-risk AI systems (Chapter III, incl. Articles 9 and 25)
High-risk AI covers applications in regulated sectors such as medical devices, civil aviation, vehicles, biometry, and critical infrastructure. These systems are identified through Annex I and Annex III, and are subject to strict compliance obligations for providers, importers, distributors, and deployers.-
Under Article 9, a risk management system must be established, implemented, documented, and maintained.
-
Article 25 outlines detailed responsibilities for providers, including risk assessments, technical documentation, and ongoing monitoring throughout the system’s lifecycle.
-
If any actor in the value chain has reason to believe the system is non-compliant, deployment must be suspended.
-
-
Other AI systems
These are AI systems that interact with individuals, such as chatbots or AI-generated content tools. The Act imposes transparency obligations, including Article 50, which requires users to be informed that content is AI-generated or manipulated. -
General-purpose AI models (GPAI)
GPAI refers to models capable of powering a broad range of applications. These are subject to lighter obligations unless they qualify as general-purpose AI models with systemic risks—i.e., models with high-impact capabilities, often trained using exceptionally large computational resources.
When systemic risk applies, additional requirements include risk mitigation policies, adversarial testing, and model evaluation obligations
Governance and Enforcement (Chapter VII)
The Act establishes a multi-level governance structure:
-
At European level:
-
An AI Office within the European Commission to oversee enforcement.
-
The European Artificial Intelligence Board, with representatives from each Member State, to advise and coordinate.
-
An Advisory Forum offering technical expertise.
-
A scientific panel of independent experts to support enforcement.
-
-
At national level:
Each Member State must designate at least one notifying authority and one market surveillance authority to oversee and enforce compliance at the domestic level.
Luxembourg’s Regulatory Sandbox
On 14 June 2024, Luxembourg’s CNPD (Commission Nationale pour la Protection des Données) officially launched a Regulatory Sandbox for AI. This initiative allows companies registered in Luxembourg to test their AI systems in a collaborative and supervised environment, with a focus on GDPR compliance.
Upcoming Steps
The AI Act was published in the Official Journal of the EU on 1 August 2024 and entered into force on 21 August 2024, in accordance with Article 113. Its provisions will be implemented in three stages:
-
Six months after entry into force:
The rules on prohibited AI practices will apply. -
Twelve months after entry into force:
Obligations related to general-purpose AI and the establishment of new EU and national governance bodies will become applicable. -
Thirty-six months after entry into force:
The more complex requirements concerning high-risk AI systems will come into effect.
While full applicability generally begins 24 months after entry into force, these staged measures allow for a phased rollout based on risk levels and preparedness.
Further Developments
The AI Act is part of a broader legislative framework that also includes the forthcoming:
-
AI Liability Directive, which will address civil liability for harm caused by AI systems, and
-
Product Liability Directive, which will update EU product safety laws to reflect the use of AI.
Together, these instruments will define the EU’s comprehensive regulatory approach to artificial intelligence in the years ahead.
EU updates AML/CFT blacklist and adds five countries
The European Commission has issued a new regulation to amend Delegated Regulation (EU) 2016/1675 by adding the Democratic Republic of the Congo, Gibraltar, Mozambique, Tanzania and the United Arab Emirates to Table I of the Annex and deleting Nicaragua, Pakistan, and Zimbabwe from that table. The regulation is aimed at ensuring the effective protection of the integrity and proper functioning of the financial system and the internal market of the Union from money laundering and terrorist financing.
The European Union has been identifying countries with strategic deficiencies in their regimes on Anti-Money Laundering and Countering Financing of Terrorism (AML/CFT) that pose significant threats to the financial system of the Union. In line with Article 9(4) of Directive (EU) 2015/849, the Commission takes the recent available information into account, in particular recent Financial Action Task Force (FATF) Public Statements, the FATF list of ‘Jurisdictions under Increased Monitoring’, and FATF reports of the International Cooperation Review Group in relation to the risks posed by individual third countries.
Since the latest amendments to Regulation (EU) 2016/1675, the FATF has significantly updated its list of ‘Jurisdictions under Increased Monitoring’. At its plenary meeting in March 2022, the FATF added the United Arab Emirates (UAE) to its list and deleted Zimbabwe from its list. At its plenary meeting in June 2022, the FATF added Gibraltar to its list. At its plenary meeting in October 2022, the FATF added the Democratic Republic of the Congo (DRC), Mozambique and Tanzania to its list and deleted Nicaragua and Pakistan from its list. All those changes were assessed by the Commission in line with Article 9 of Directive (EU) 2015/849.
The UAE made a high-level political commitment in February 2022 to work with the FATF and the Middle East and North Africa Financial Action Task Force to strengthen the effectiveness of its AML/CFT regime. Since then, the UAE demonstrated positive progress, including by providing additional resources to the Financial Intelligence Unit (FIU) to strengthen the FIU analysis and providing financial intelligence to Law Enforcement Authorities and the Public Prosecutors for combating high-risk ML threats. The UAE should continue to work to implement its FATF action plan.
Despite that commitment and progress, the concerns that led to the listing of the UAE by the FATF have not yet been fully addressed. The UAE should therefore be considered as a country that has strategic deficiencies in its AML/CFT regime under Article 9 of Directive (EU) 2015/849.
In June 2022, Gibraltar made a high-level political commitment to work with the FATF and MONEYVAL, the Committee of Experts on the Evaluation of Anti-Money Laundering Measures and the Financing of Terrorism of the Council of Europe, to strengthen the effectiveness of its AML/CFT regime. Gibraltar has made progress on a significant number of its MER’s recommended actions since the adoption of its MER in December 2019, such as completing a new national risk assessment, addressing the technical deficiencies in relation to Beneficial Owner-related recordkeeping, introducing transparency requirements for nominee shareholders and directors, strengthening the financial intelligence unit, and refining its ML investigation policy in line with risks.
The DRC, Mozambique and Tanzania have been identified as countries that have strategic deficiencies in their AML/CFT regimes. The FATF identified significant strategic deficiencies in their AML/CFT regimes, resulting in the countries being listed as ‘Jurisdictions under Increased Monitoring’. The Commission has considered the recent available information, including FATF reports of the International Cooperation Review Group in relation to the risks posed by the three countries.
The European Commission has reviewed the progress made by Nicaragua, Pakistan, and Zimbabwe in addressing strategic deficiencies in their AML/CFT regimes, which led to their delisting by the FATF in 2022. The FATF has welcomed the significant progress made by these countries, noting that they have established legal and regulatory frameworks to meet their commitments in their respective action plans. The Commission’s assessment concludes that Nicaragua, Pakistan, and Zimbabwe no longer have strategic deficiencies in their AML/CFT regimes and have addressed related technical deficiencies to meet their commitments. These countries will continue to work with regional bodies to further improve their AML/CFT systems, including oversight of non-profit organizations in line with FATF standards.
As of today the following countries are identified as high-risk third countries:
- Afghanistan
- Barbados
- Burkina Faso
- Cambodia
- Cayman Islands
- Democratic Republic of the Congo
- Gibraltar
- Haiti
- Jamaica
- Jordan
- Mali
- Morocco
- Mozambique
- Myanmar
- Panama
- Philippines
- Senegal
- South Sudan
- Syria
- Tanzania
- Trinidad and Tobago
- Uganda
- United Arab Emirates
- Vanuatu
- Yemen
The Commission Delegated Regulation EU) 2023/410 of 19 December 2022 amending Delegated Regulation (EU) 2016/1675 as regards adding the Democratic Republic of the Congo, Gibraltar, Mozambique, Tanzania and the United Arab Emirates to Table I of the Annex to Delegated Regulation (EU) 2016/1675 and deleting Nicaragua, Pakistan and Zimbabwe from that table is available here.
Get in touch with our team for expert advice and assistance on the latest developments.
New law simplifies administrative dissolution for empty shell companies in Luxembourg
The new Law of 28 October 2022 creating the procedure for administrative dissolution without liquidation entered into force on February 1, 2023. It provides a simplified dissolution process for “empty shell” commercial companies, which is carried out at the request of the Public Prosecutor in collaboration with the managing entity of the Luxembourg Register of Commerce and Companies (RCS) and the Luxembourg Business Register (LBR).
To initiate the administrative dissolution process, a commercial company must meet three cumulative conditions: (1) an infringement of criminal law or a material breach of commercial law committed by the company, (2) the absence of employees, and (3) the absence of assets.
The administrative dissolution process in Luxembourg is carried out through an exchange of information between the LBR and the Public Prosecutor. The LBR conducts necessary checks, collects financial, administrative, and tax data, and provides the information to the Public Prosecutor. Based on the findings, the Public Prosecutor will determine whether to request the LBR to initiate the dissolution procedure. The procedure is then initiated, and the company is notified and the information is published in the Recueil électronique des sociétés et associations (RESA). The company is unable to manage its assets from the date of publication of the opening decision in the RESA. Afterwards, the LBR obtains evidence regarding the presence of employees or assets from financial institutions, insurance companies, and other relevant authorities, and the results are then presented to the Public Prosecutor who will decide whether to continue or discontinue the procedure. If all the required conditions are met, the administrative dissolution process will be concluded within six months and the company will be dissolved and removed from the RCS.
The Public Prosecutor spearheads the administrative dissolution procedure, with the District Court handling commercial matters having oversight. If a company or any third party wishes to challenge the procedure, they must submit their grievances to the President of the District Court within a month of the publication of the opening decision on the RESA.
Some entities, such as regulated UCIs (UCITS, Parts II Funds, SIFs, SICARs), RAIFs, insurance and reinsurance companies, credit institutions, and law firms, are excluded from the scope of the Law. Non-supervised investment funds and their alternative investment fund managers could be eligible for such administrative dissolution if they meet the criteria of an empty shell.
Get in touch with our Restructuring and Insolvency team for an in-depth discussion about the above! Our experts are here to help and provide you with the information you need to make informed decisions.
