Partner Laurent Thailly (pictured right), associate Benjamin Devouassoux (middle) and professional support lawyer Iva Dobric (left) at Ogier in Luxembourg delineate the plans that their jurisdiction has for the gathering of data about beneficial owners and fiduciary arrangements. The regime, which is still in the process of gestation, is to be a much more restrictive one than that of the UK.

The Luxembourgeois Ministry of Justice filed two bills of law on 6 December 2017 in order to transpose Articles 30 and 31 of the Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing and to implement transparency standards set in Recommendations N° 24 and 25 of the Financial Action Task Force.

Bill N°7217 (hereinafter known as the BOs Bill) relates to the creation in the Grand Duchy of Luxembourg of an electronic national register of beneficial owners (registre des bénéficiaires effectifs) (hereinafter known as the REBECO) for corporate entities and other legal entities registered with the Luxembourg Trade and Companies' Register (hereinafter, the RCSL); and Bill N°7216 (hereinafter, the Fiduciary Bill) relates to the creation in the Grand Duchy of Luxembourg of an electronic national register (Registre des Fiducies) (hereinafter, the Fiduciaries Register) of fiduciaries for fiduciary arrangements governed by the Luxembourg law of 27 July 2003 relating to trusts and fiduciary contracts (hereinafter, the Fiduciary Arrangements) located in and subject to a tax treatment in the Grand Duchy of Luxembourg (hereinafter, the Fiduciaries Register).

The BOs Bill

The REBECO, an electronically maintained and operated national register of beneficial owners (as defined in the Luxembourg law of 12 November 2004 on the fight against money laundering and terrorist financing), shall be:

• created as a separate database that the RCSL maintains and monitors; and
• controlled and supervised by the Luxembourg Ministry of Justice.

It will concern all legal entities registered with the RCSL, i.e. all Luxembourg corporate entities (with the exception of temporary commercial companies and commercial companies by participation); economic interest groups, including European ones; civil law partnerships; non-profit organisations; foundations; pension savings associations; and agricultural associations. Commercial companies listed on the Luxembourg, European Economic Area or equivalent regulated market, common funds and foreign companies' branches will sit outside the BOs Bill's scope because they belong to a different 'transparency' regime.

Information regarding beneficial owners that is to be made available on the REBECO is as follows: name, nationality, place and date of birth, country of residence, personal or professional address, a domestic or foreign personal identification number and the nature and extent of the beneficial interest held by the beneficial owners.
 
The Ministry of Justice's Explanatory Memorandum states that the Luxembourg legislator does not intend to create an autonomous notion of 'beneficial owner,' but such a definition is contained in the old Law of 12 November 2004 - this is to be amended by the subsequent Bill N° 7128, in order to satisfy the requirements of the European directive.

An obligation to submit exact and complete information and further modifications rests with the corporate entity, either (i) on its own, or (ii) through its domiciliation agent, any ad hoc agent to whom such power has been granted, or the notary who incorporates or amends its articles of association. Information must be handed over to the RCSL within one month of the change.

Furthermore, a six-month transition period will be given to corporate entities that exist at the time of the Bill's entry into force. Supporting documents are yet to be designed by a Grand-Ducal regulation; when they appear they might form a good evidentiary standard for the civil servants in charge of assessing documents.

The RCSL will be authorised to refuse a piece of information that somebody submits if it believes the content to be incomplete or if the relevant request has failed to comply with the provisions of the BOs Bill and if the corporate entity does not correct the relevant data within 15 days from the first notice of refusal.

Judicial remedies will be available against such decisions. Applicants will be able to commence action before the judge who presides over the chamber of the District Court (Tribunal d'Arrondissement) on the subject of commercial matters (for merchants) or before the president of the District Court who judges civil matters (for commercial companies, non-profit organisations, foundations, agricultural associations and state- and commune-owned public establishments), within 8 days from receiving the second notice of refusal.

Entities subject to the BOs Bill and registered with the RCSL will also have to maintain the aforementioned information at their registered offices and tell the RCSL where they are going to keep it during the statutory five-years' record retention period in the event of their eventual dissolution and/or liquidation.

The RCSL will be authorised to ask such an entity to update any relevant information, whether ex officio or in line with a notice of refusal. If the request is not answered within 30 days, the RCSL may hand the matter over to the state prosecutor.

In order to balance 'transparency' requirements and data protection, access to data envisaged in the BOs Bill can be divided into several categories.

• Unrestricted access will be granted only to governmental authorities, i.e. judicial and tax authorities, Luxembourg regulators such as the Financial Sector Surveillance Authority (Commission de Surveillance du Secteur Financier) or the Luxembourg Registration and Domains Authority (Administration de l’enregistrement et des domaines) (hereinafter, the AED).
• Self-regulatory bodies acting within their powers to supervise legal entities that have anti-money laundering and anti-terrorist duties (i.e. the Luxembourg Bar Council, the Notaries' Chamber, the Institute of Company Auditors, the Association of Chartered Accountants and the Chamber of Judicial Officers) and professionals subject to anti-money laundering regulations because they have to conduct "customer due diligence" (CDD) procedures (i.e. notaries, lawyers, accountants, banks etc.) will be able to access the database following an accreditation procedure which is to be set up by an upcoming Grand-Ducal regulation.
• Lastly, resident persons or organisations resident in Luxembourg who can show that they have a "legitimate interest" in such information (to be assessed on a case-by-case basis by a special "co-ordination commission" for whose establishment the Bill calls), may be given access upon demand concerning a particular entity, excluding data about the day and place of someone's birth, his addresses and his identification number (Luxembourg is one of many European jurisdictions that could not kick the habit of forcing their citizens to carry identification papers around on pain of prosecution after the last World War ended). The entity in question will always be informed of the request and will therefore have the option of contesting it beforehand.

The notion of "legitimate interest" is also to be interpreted on a case-by-case basis; indeed, the BOs Bill lacks further clarification on the subject. Regardless of why the Luxembourg legislator made this omission, it is clear that the courts should use the wording of the European directive when interpreting legitimate interest. Indeed, the directive's Recital 14 has something to say.

"Member-states should also ensure that other persons who are able demonstrate a legitimate interest with respect to money laundering, terrorist financing, and the associated predicate offences, such as corruption, tax crimes and fraud, are granted access to beneficial ownership information, in accordance with data protection rules. The persons who are able to demonstrate a legitimate interest should have access to information on the nature and extent of the beneficial interest held consisting of its approximate weight."

Another means of limiting access is based on the initiative of the entity in question, in exceptional circumstances. It can, on a case-by-case basis, submit a substantiated request for access to beneficial owners' information to be limited to governmental authorities only. The aforementined "special co-ordination commission" will evaluate the request and might accept it if the disclosure of the information would (i) expose the beneficial owner to the risks of fraud, kidnapping, blackmail, violence or intimidation, or (ii) if the beneficial owner is a minor or is legally incapable. In order to protect beneficial owners heavily, the RCSL can temporarily limit access to his information until the commission makes up its mind (or 15 days after it issues a refusal).

The BOs Bill aims to establish a general obligation for all persons who have access to the REBECO to notify the RCSL "without any delay" of any information that they believe to be inaccurate or false. This provision, read in conjunction with Article 5(3), which states that the RCSL is in any case not to be responsible for the content of the beneficial owners' information being disclosed, indicates that it is more of a data-protection intermediary than a "transparency enforcer."
 
It is therefore questionable whether the register, with such principles to satisfy, is going to help AML and CDD people to discharge their duties.

The BOs Bill, finally, contains sanctions for non-compliance. Any person subject to it who defies it may have to pay a fine ranging from €1,250 to €1,250,000, depending on the seriousness of the infringement, which can consist of: having omitted to submit relevant information within the set deadlines; knowingly providing incorrect or incomplete information; having omitted to retain information at his/its registered office; or finally, having knowingly provided incorrect or incomplete data to those who have a right to see it. Entities entitled to data access, with the exclusion of national authorities, can also be fined if they knowingly ask for access to beneficial owners' information which would exceed their monitoring or customer due diligence obligations.

The Fiduciary Bill

The content of the Fiduciary Bill is quite similar to the BOs Bill and is intended to create the Fiduciaries Register, which will be electronically controlled and supervised by the AED. The Fiduciary Bill will also create an obligation for Luxembourg fiduciaries' agents to obtain and retain, at their registered office, all relevant information regarding BOs for whom they perform their "fiduciary" services: the settlor (fiduciant), trustees, protector (if any), beneficiaries or another person which exercises effective control over the Fiduciary Agreement.

As the beneficiaries do not have to be determined by name but by characteristics or categories, the Fiduciary Bill sets an additional standard of information quality – Luxembourg fiduciaries' agents must indeed ensure that the beneficial owners are identified at the time they express their intention to exercise their rights, or at the time of pay-out.

Any fiduciary agreement whose trustee is based in Luxembourg and which generates tax consequences must be registered, whereupon the AED will give it a registration number.

The information to be registered in the Fiduciaries Register concerning the aforementioned beneficial owners is almost the same as that provided by the BOs Bill and includes the person's name, date of birth, place of birth, place of residence, nationalities, private or professional address and an identification number, domestic or foreign. Information to help people identify the person should also be included, if applicable. In the case of a legal person, information will have to include its denomination, precise address and an identification number. The information has to be retained for a five-year period after the fiduciary arrangement ends. Unlike the BOs Bill, the Fiduciary Bill does not say anything about the nature and extent of interest held by the beneficial owners.

Similarly, specific deadlines for the provision and updating of beneficial owners' information for fiduciary arrangements were not included in the Fiduciary Bill, which simply mentions that any change should be recorded in the Fiduciary Register within a "reasonable deadline," not forgetting that there is to be a transition period of six months after that bill is passed and comes into force.

The Fiduciary Bill, similarly to the BOs Bill, foresees the AED's right to refuse an information submission request but without any final judicial control over such a decision. It also states explicitly that the AED is not to be responsible for the content of information, while at the same time establishing a general obligation on people who have access to the Fiduciary Register to report incorrect or missing data. From such provisions arise the same, aforementioned, questions of enforceability, confidentiality and usefulness for AML and CDD purposes.

Access to the Fiduciaries Register, is to be limited exclusively to Luxembourg's governmental authorities under certain conditions which an upcoming Grand-Ducal regulation will impose.

When it comes to oversight, the Fiduciary Bill establishes a detailed system of surveillance, consisting of control, access to documents, inspections and investigation.

Non-compliance with the provisions of the Fiduciary Bill (e.g. failure to gather relevant information, to update it when needed, to retain it and to provide it to controlling authorities), may invite administrative sanctions. These will include, among other things, a simple warning, a public declaration revealing the identity of the relevant natural person or corporate entity that should have been registered in the Fiduciaries Register, a temporary ban of up to five years on the exercise of any professional activities in the financial sector or an administrative fine of up to €1,250,000.
 
The courts will gauge the seriousness of the infringement, and subsequently the amount of the fine, by taking into account circumstances enumerated by the Bill: the seriousness and duration of the infraction; the degree of responsibility of the person being held responsible; the financial situation of the responsible person; any financial gains resulting from the infraction; the level of co-operation with the controlling authorities; and previous infractions committed by the same person.

Final provisions

The final provisions of both the BOs Bill and the Fiduciary Bill are still to be expected. Personal data will have to be treated in compliance with Luxembourgois data protection law, which includes the EU Regulation 2016/679, which will enter into force on 25 May.

The Bill 7128 transposing EU's Directive 2015/849 (Fourth Anti-Money Laundering Directive) is currently still under discussion in the Luxembourg Chamber of Deputies, and the Fifth Anti-Money Laundering Directive is also on its way. Once it becomes EU law, the latter might impose a reduction in the percentage of voting control of corporate arrangements from 25% to 10% for the purpose of identifying beneficial owners. Moreover, registries such as the REBECO and the Fiduciary Registry might become subject to unlimited public access.

* Laurent Thailly can be reached on + 352 2712 2032 or at laurent.thailly@ogier.com. Benjamin Devouassoux is an associate at Ogier in Luxembourg and Iva Dobric is a professional support lawyer.