Luxembourg: the business registers are enforcing company and beneficial-owner filings, and regulators publish NIS2 incident rulebooks

Luxembourg: the business registers are enforcing company and beneficial-owner filings, and regulators publish NIS2 incident rulebooks

2 October 2026 — Two compliance changes in Luxembourg this autumn affect companies registered there, including the many holding and operating companies of international technology groups.

Not yet independently verified. The register enforcement rests on Silicon Luxembourg’s interview with a Luxembourg lawyer; the LBR’s own circulars 26/01 and 26/02 were not read. The rulebooks rest on the ILR’s own announcement. We will update this when it can be confirmed, and remove this note.

The business registers move to enforcement

Luxembourg Business Registers (LBR) has monitored company data in the Trade and Companies Register (RCS) and the Register of Beneficial Owners (RBE) since January 2026, and began rolling out an enforcement phase from 21 September 2026 under the Law of 23 January 2025. According to Silicon Luxembourg:

• when LBR finds missing, wrong or outdated information or overdue filings, it sends a registered letter;
• the entity has thirty days from the date the letter is sent to correct it, and not receiving the letter does not stop the clock;
• measures then escalate through formal notices, warnings on the public portal and daily penalties, ending in striking off companies that stay non-compliant; criminal fines remain possible under the beneficial-ownership law;
• non-profit associations and foundations are not yet in the enforcement phase.

LBR circular 26/01 of 19 August 2026 says that for a company held by a trust or foundation, the beneficial owners to report are those of the trust or foundation itself.

NIS2: joint incident-handling rulebooks

On 28 September 2026, the High Commission for National Protection (as national cybersecurity authority and GOVCERT.LU), CIRCL, the financial regulator CSSF and the ILR jointly published rulebooks for handling specific types of cybersecurity incident. They are written under the Law of 5 May 2026 on a high level of cybersecurity, Luxembourg's NIS2 law, and cover detection, containment, investigation, remediation, evidence, post-incident work and communication. They are aimed at the technical teams of entities in scope, and the authorities invite feedback.

What to do

• Every Luxembourg company: make sure the registered office can receive post, and check RCS and RBE entries now, including beneficial owners behind trusts and foundations. Domiciliation agents should check their whole client book.
• Groups with Luxembourg subsidiaries: ask your local administrator for a compliance confirmation before year end.
• NIS2 entities: map the rulebooks against your incident runbooks and evidence-keeping, and send gaps to the authorities while they are collecting feedback.

Sources

• Silicon Luxembourg: LBR compliance, RCS and RBE in Luxembourg in 2026 — 2 October 2026
• ILR: Operational guidance for incident handling — 28 September 2026