Public CbCR: what non-EU groups need to know before filing in Luxembourg

Luxembourg transposed Directive (EU) 2021/2101 of the European Parliament and of the Council of 24 November 2021 (the Directive) on public country-by-country reporting (pCbCR) through the Law of 15 August 2023. The law introduced Chapter II quater into the Law of 19 December 2002 on the Trade and Companies Register (the Luxembourg Law) and applies to financial years beginning on or after June 22 2024.

The Directive applies both to groups whose ultimate parent entity (UPE) is in the EU and to groups whose UPE is outside the EU (non-EU UPE Groups). This article focuses on the obligations for non-EU UPE Groups.

Multinational non-EU UPE Groups with a presence in Luxembourg should assess whether they have a “qualifying presence” under the “main rule” described below and whether the non-EU UPE is willing to publish the pCbCR on its own website. For most calendar-year-end groups, FY25 is the first reporting period, and local practice and interpretation in Luxembourg continue to develop.

For non-EU UPE Groups, the Luxembourg Law provides three routes for meeting the pCbCR filing obligation.

Under Article 72duodecies(4), medium-sized and large subsidiaries established in Luxembourg, as defined by the thresholds in articles 35 and 47, must publish the full group pCbCR if consolidated group revenue exceeded €750 million in each of the last two consecutive financial years. Each subsidiary regarded as medium-sized or large under Luxembourg law has an independent obligation to publish the complete pCbCR.

In Luxembourg, a subsidiary qualifies as medium-sized or large if it meets at least two of the following three criteria for two consecutive financial years:

• A balance sheet total of at least €7.5 million;

• Net revenue (chiffre d’affaires net) of at least €15 million; or

• An average of at least 50 employees during the fiscal year.

Under Article 72duodecies(6), the non-EU UPE may publish the full report directly on its own website in a machine-readable format, free of charge, in at least one official EU language, and within 12 months of the financial year end. Doing so relieves qualifying subsidiaries and branches of their obligations under paragraphs 4 and 5. However, in these cases, the Luxembourg Law still requires the pCbCR to identify a single qualifying Luxembourg subsidiary or branch that will file the report with the Luxembourg Trade and Companies Register (RCS).

As the most significant deviation of Luxembourg rules from the language of the Directive, the text of the Luxembourg Law limits the application of the “nomination rule” for Luxembourg purposes to situations where the entity nominated by the non-EU UPE is resident in Luxembourg. Consequently, if a non-EU UPE Group with a qualifying presence in Luxembourg nominated, for instance, an Irish subsidiary for the EU publication of the report in the Irish Companies Registration Office, the non-EU UPE would still need to nominate a Luxembourg resident subsidiary to file the complete pCbCR in the RCS.

The law does not specify any thresholds for the Luxembourg resident entity that the non-EU UPE nominates.

To meet the requirements of Article 72duodecies(4), qualifying subsidiaries must obtain the data from the UPE and publish the full group pCbCR.

The Luxembourg Law also addresses cases in which the non-EU UPE does not provide the required data to the qualifying entity. In such cases, the subsidiary publishes the information available to it and includes a notice in the pCbCR. The subsidiary must retain documented evidence of its data request and of any lack of response or follow-up from the non-EU UPE.

When a non-EU UPE has not published the report on its own website, Article 72quaterdecies imposes two parallel obligations on the Luxembourg entities. They must file the report with the RCS and publish it on the company or branch website, or on the website of a related entity, within 12 months after the financial year end. Where the RCS filing is made in a machine-readable format accessible free of charge, the entity is exempt from the separate website publication requirement. However, the entity’s website, or that of a related entity, must refer to the exemption and provide a link to the RCS.

Commission Implementing Regulation (EU) 2024/2952 requires entities governed by EU member state law to use the common EU template and iXBRL tagging. When the non-EU UPE publishes directly on its website, those specifications do not apply, but Article 72duodecies(6) still requires a machine-readable format.

Based on the authors’ experience, the RCS accepts reports generated with the European Commission’s template. When a user uploads an XHTML file, the RCS publishes a ZIP folder containing the XHTML file and the deposit receipt. The filing process is fully electronic and requires a small fee. Before filing, the filer should obtain a valid LuxTrust card or another token authorised for RCS filings.

Article 72terdecies lists the required data points: the UPE’s name, financial year, reporting currency, subsidiaries located in the EU and those included on the EU’s Annex I or II list of noncooperative jurisdictions, description of activities, number of employees measured as full-time equivalents, revenue, profit or loss before tax, income tax accrued for the current year, income tax paid on a cash basis, and accumulated earnings. The report must present data separately for each EU member state and for each jurisdiction on the EU’s Annex I and II lists of noncooperative jurisdictions. It aggregates all remaining jurisdictions into a single rest-of-world line.

The Luxembourg Law allows reporting entities to omit specific data temporarily if disclosure would seriously prejudice their commercial position. The report must clearly identify any omission and provide a reasoned explanation, and the reporting entities must publish the omitted data within five years. This safeguard does not apply to Annex I or II jurisdictions.

When a group with a non-EU UPE chooses to use the European Commission’s template, it should interpret the Luxembourg Law alongside Commission Implementing Regulation (EU) 2024/2952, which sets out the content requirements for each section of the report.

Luxembourg does not require separate disclosure for European Economic Area countries. Norway, Iceland, and Liechtenstein therefore appear in the aggregated line. Groups may publish the report in any official EU language.

Under Article 72quindecies(2), directors of Luxembourg subsidiaries that file on behalf of a non-EU UPE must meet a qualified liability standard. They must ensure compliance “to the best of their knowledge and means”.

Non-compliance may result in statutory penalties ranging from €500 to €25,000.

With the first reporting period under way, non-EU groups with a qualifying presence in Luxembourg should assess their filing position carefully. Despite the deviations outlined above, the Luxembourg Law broadly aligns with the Directive and establishes a legal framework that provides a website-publication exemption and a temporary safeguard for commercially sensitive information.