Luxembourg submits draft legislation introducing public country-by-country reporting for multinational enterprises

• The Luxembourg Government recently transmitted draft legislation to implement the European Union (EU) public country-by-country reporting (CbCR) Directive (the Directive) to Parliament.
• The new reporting obligations will apply to financial years starting on or after 22 June 2024.
• Luxembourg opted to allow in-scope groups to (1) defer, in certain cases, the disclosure of commercially sensitive information for up to five years and (2) exempt, under certain conditions, undertakings from the obligation to publish the income tax information on their website.
• Board members will be responsible for properly implementing the new rules.

Executive summary

On 24 February 2023, the Luxembourg Government submitted a draft law (Draft Law)¹ to Parliament aimed at transposing the public CbCR Directive (Directive (EU) 2021/2101 of the European Parliament and of the Council of 24 November 2021 amending Directive 2013/34/EU as regards disclosure of income tax information by certain undertakings and branches).

The rules set forth in the Directive require both multinational enterprises (MNEs) based in the EU and non-EU based MNEs doing business in the EU through a branch or subsidiary with total consolidated revenue exceeding €750 million in each of the last two financial years to disclose publicly the income taxes paid and certain other information, such as a breakdown of profits, revenues and employees per country.

The Luxembourg Government has chosen to make use of the two options granted by the Directive, namely, to allow in-scope groups to defer in certain cases the disclosure of commercially sensitive information for up to five years and to exempt, under certain conditions, undertakings from the obligation to publish the income tax information on their website.

Information will have to be published for financial years that begin on or after 22 June 2024. Companies whose financial year coincides with the calendar year will have to make 2025 reports available during calendar year 2026.  

Members of the administrative, management and supervisory bodies of undertakings subject to the reporting requirements are collectively responsible for ensuring that the reporting obligations are met. Failure to comply with these obligations can result in a fine of between €500 and €25,000.

This Alert summarizes the main features of the Draft Law.

Detailed discussion

Background

Published in the Official Journal of the EU on 1 December 2021, the Directive entered into force on 21 December 2021². The Directive was formally adopted by the Council of the EU on 28 September 2021³ and approved by the European Parliament on 11 November 2021⁴.

The timeline set forth by the Directive is as follows:

• EU Member States must transpose the Directive into national law by 22 June 2023
  
• The first financial year for which reporting will be required is the year starting on or after 22 June 2024
  
• Publication is required within 12 months from the balance sheet date for the financial year in question
  

Covered enterprises

The Draft Law restricts the scope of the Directive to undertakings covered by the Accounting Directive⁵ – i.e., in substance, to corporations (société anonyme (SA), société à responsabilité limitée (Sàrl), société en commandite par actions (SCA)) and certain partnerships (namely société en nom collectif (SNC), société en commandite simple (SCS)) with direct and indirect general partner(s) organized as corporations, as well as Luxembourg branches of a non-EU corporation.

Entities established under another legal form (e.g., special limited partnerships – société en commandite spéciale (SCSp)) are thus outside the scope of the rules.

In line with the Directive, the Draft Law requires the drawing up, publication and making available of certain income tax and other information for four categories of enterprises:

1. Luxembourg-based ultimate parent undertakings (i.e., an undertaking governed by the laws of Luxembourg that draws up the consolidated financial statements of the largest body of legal entities and consequently heads the entire group) with consolidated revenue reflected in their consolidated financial statements, as of their balance sheet date, exceeding €750 million for each of the last two financial years, unless the group operates in only one Member State.
   
2. Luxembourg-based standalone undertakings (i.e., an undertaking governed by the laws of Luxembourg that is not part of a group) with annual net turnover exceeding a total of €750 million for each of the last two consecutive financial years, unless they operate in only one Member State.
   
3. Luxembourg-based large⁶ and medium-sized undertakings⁷ controlled by a non-EU ultimate parent undertaking (subsidiary undertakings) if the consolidated turnover of the ultimate parent undertaking exceeds a total of €750 million for each of the last two consecutive financial years. Where the subsidiary does not have the relevant information at its disposal, it must request from the ultimate parent undertaking all the necessary information to be able to comply. If the parent does not provide this information, the subsidiary must prepare and publish a report with the available information, indicating that its ultimate parent undertaking did not provide the necessary information.
   
4. Luxembourg branches of undertakings that are not governed by the laws of a Member State with annual net turnover exceeding €8.8 million for each of the last two financial years, provided (i) the undertaking is related to a non-EU ultimate parent undertaking or is a stand-alone undertaking, (ii) the annual (consolidated) turnover of the ultimate parent undertaking or standalone undertaking exceeds a total of €750 million for each of the last two financial years and (iii) the ultimate parent undertaking does not control a Luxembourg-based large or medium-sized undertaking. In such case, the branch must publish the information for the entire group or for the standalone undertaking that opened the branch.
   

Financial institutions established in Luxembourg are already required to file a CbCR under Directive 2013/36/EU as transposed in Luxembourg law. Financial institutions that meet the definition of standalone undertakings, or are MNEs likely to fulfill the aforementioned criteria, will be exempted from public CbCR requirements if the CbCR they filed covers all their activities and, for ultimate parent undertakings, also covers all the activities of related enterprises.

Furthermore, Luxembourg-based large and medium-sized undertakings controlled by a non-EU ultimate parent undertaking and qualifying branches are exempt from reporting under certain conditions.

Information to be disclosed

The report must include the following information relating to all the activities of the ultimate parent undertaking or the standalone undertaking, including the activities of all affiliated undertakings consolidated in the financial statements for the relevant financial year:

• Name of the ultimate parent undertaking or the standalone undertaking, the financial year concerned, the currency used and, where applicable, a list of all subsidiary undertakings consolidated in the financial statements of the ultimate parent undertaking, for the relevant financial year, established in the EU or in tax jurisdictions included in Annexes I and II to the Council conclusions on the revised EU list of noncooperative jurisdictions⁸ for tax purposes (so-called EU black list and gray list)
  
• Nature of the activities
  
• Number of employees
  
• Revenues (i.e., sum of net turnover, other operating income, income from participating interests, excluding dividends received from affiliated undertakings, income from other investments and loans forming part of the fixed assets, other interest receivable and similar income; or the income as defined by the financial reporting framework on the basis of which the financial statements are prepared, excluding value adjustments and dividends received from affiliated undertakings)
  
• Profit or loss before income tax
  
• Amount of income tax (corporate income tax, municipal business tax and withholding tax on capital income) accrued during the relevant financial year (i.e., the current tax expense recognized on taxable profits or losses of the financial year by undertakings and branches in the relevant tax jurisdiction, but limited to the tax expense generated by the undertaking’s activities, excluding deferred tax and tax provisions for uncertain tax expenses)
  
• Amount of income tax actually paid during that year (including tax withheld at source by other undertakings on payments received by the relevant undertaking and branch within a group)
  
• Accumulated earnings (i.e., profits of prior years and of the relevant financial year that have not been distributed)
  

The information must be disclosed separately for each Member State and all jurisdictions included on the EU black list and gray list. For all other jurisdictions, aggregated data may be disclosed. The information must be reported using a template and a common electronic reporting format.

Luxembourg elected to allow in-scope undertakings to defer, under certain conditions, the disclosure of commercially sensitive information for up to five years. Sensitive information should be understood as information that, if made publicly available, would be seriously prejudicial to the commercial position of the MNE to which the report relates. Any omission must be clearly indicated in the report, together with a reasoned explanation. Note, however, that information pertaining to tax jurisdictions included in Annexes I and II of the Council conclusions on the revised EU list of non-cooperative jurisdictions for tax purposes may never be omitted.

Publication and accessibility

The report must be lodged with the Luxembourg Trade and Companies Register (Registre de commerce et des Sociétés (RCS)) and information about this filing must be published with a filing notification in the Luxembourg Electronic Compendium of Companies and Associations (Recueil électronique des Sociétés et associations (RESA)) within 12 months of the balance sheet date of the financial year for which the report is drawn up.

In addition, the report must be made accessible to the public free of charge for at least five consecutive years no later than 12 months after the balance sheet date of the financial year for which the report is drawn up. Public accessibility can be accomplished by posting the report on the website of the ultimate parent undertaking, the standalone undertaking, the subsidiary undertaking, an affiliated undertaking, or the branch or undertaking that opened the branch.

Luxembourg also has opted to exempt undertakings from the obligation to publish the report on their website if the report has been published in accordance with the aforementioned rules (lodging with the RCS and publication with a filing notification in the RESA) and is publicly available in a machine-readable electronic reporting format on the RCS website and free of charge to any third party located in the EU. The undertakings must include a notice on their websites explaining the exemption and referring interested parties to the RCS website.

Statement by statutory auditor

Audit reports prepared for Luxembourg undertakings that are required by law to have their financial statements audited by one or more approved statutory auditor(s) (réviseur d’entreprises agréé) or approved audit firm(s) must verify and state whether the particular undertaking was required to publish a public CBCR for the financial year preceding the financial year being audited. If a public CBCR was required, the auditor or audit firm must indicate in their audit report whether the prior year’s report was drawn up and made available in keeping with the law.

Management responsibility and penalties

For undertakings that are subject to the reporting requirements, the Draft Law holds the members of their administrative, management and supervisory bodies collectively responsible for ensuring that the CBC Report is drawn up, published and made accessible in accordance with the provisions of the Draft Law.

A distinction is made between the responsibility of the administrative, management and supervisory bodies of ultimate parent undertakings and standalone undertakings – which can be expected to be capable of drawing up and publishing a report in accordance with the legal provisions – and the responsibility of the administrative, management and supervisory bodies of subsidiary undertakings and branches – which, because they can’t control the ultimate parent undertaking of the standalone undertaking, are expected simply to ensure, to the best of their knowledge and ability, that the report is drawn up in a manner consistent with or in conformity with the legal provisions and is also published and made accessible to the public.

Noncompliance can result in fines between €500 and €25,000 for the management or administrative bodies of ultimate parent undertakings, standalone undertakings, subsidiary undertakings and permanent representatives of the undertaking for the activity of the branch.

Entry into effect

Luxembourg did not choose to allow for early enactment of the new rules, meaning that the obligation of drawing up, publishing and making accessible the public CbCR applies to financial years starting on or after 22 June 2024.

For undertakings with a calendar financial year, the reporting obligation will apply for the first time to financial year 2025. The lodging of the report with the RCS, the publication by notification in the RESA and on the website of the undertaking will have to take place in the course of calendar year 2026.

Implications

The public CbCR Directive has a significant impact on both EU-based MNEs and non-EU based MNEs doing business in the EU. In-scope MNEs must be prepared to be able to meet these new reporting obligations, which require reviewing the availability and quality of the information to be disclosed and possibly an adaptation of data capture processes.

Compliance with the new reporting rules is of particular relevance for board members, given that the members of administrative, management and supervisory bodies are held responsible for noncompliance.