Portugal';s regulatory landscape shifted meaningfully in the final quarter, with changes spanning corporate governance, tax compliance, employment law, and financial services oversight. For international businesses and foreign founders operating in Portugal, these developments carry direct practical consequences - from revised filing obligations to updated thresholds for labour protections. This guide covers the most significant regulatory changes, the authorities responsible for enforcement, the practical implications for businesses, and the steps companies should take to remain compliant.
The Portuguese Companies Code (Código das Sociedades Comerciais) continued to evolve, with recent amendments reinforcing transparency obligations for entities with foreign beneficial owners. The Commercial Registry (Conservatória do Registo Comercial) now applies stricter verification procedures when registering changes to shareholding structures, particularly where non-EU entities hold direct or indirect stakes.
A non-obvious requirement that has caught several foreign founders off guard is the obligation to update the Central Register of Beneficial Owners (Registo Central do Beneficiário Efetivo, or RCBE) within a shorter window following any structural change. The RCBE, maintained by the Institute of Registries and Notaries (Instituto dos Registos e do Notariado, IRN), requires notification within 30 days of any qualifying event. Failure to comply triggers administrative penalties that can accumulate quickly.
In practice, founders should consider that the IRN has increased its cross-referencing activity, comparing RCBE data against tax authority records. Discrepancies between the two registers are now flagged automatically and can result in compliance notices being issued to the company';s registered address in Portugal. Companies that rely on a registered agent address without active monitoring have been caught out by missed deadlines.
The recent amendments also clarify the rules on single-member private limited companies (Sociedade Unipessoal por Quotas, or SUQ). A single natural person may now hold a SUQ and simultaneously act as its sole director without the previous ambiguity around conflict-of-interest declarations. This simplification reduces administrative friction for solo founders but does not remove the obligation to maintain separate accounting records.
The Portuguese Tax and Customs Authority (Autoridade Tributária e Aduaneira, AT) introduced several procedural changes affecting corporate income tax (IRC) and value added tax (IVA) compliance. The most consequential for international businesses relates to the mandatory use of certified accounting software (software de faturação certificado) for all entities above a certain revenue threshold. The AT has tightened enforcement of this requirement, and audits targeting non-certified invoicing systems have increased.
For companies subject to IRC, the recent update to the Tax Benefits Statute (Estatuto dos Benefícios Fiscais) adjusted the conditions under which research and development expenditure qualifies for the SIFIDE II tax credit. The qualifying criteria now require more granular documentation of project activities, including time-tracking records for personnel involved. Many companies that previously claimed this credit without detailed records are now exposed to reassessment.
Transfer pricing documentation requirements were also reinforced. Portuguese entities that are part of multinational groups must maintain a master file and local file in accordance with the OECD guidelines as transposed into Portuguese law. The AT has signalled that it will prioritise transfer pricing audits for intra-group service arrangements, particularly management fees and intellectual property licences. A common mistake is treating these arrangements as low-risk simply because they are between related parties - the AT applies the arm';s length standard rigorously.
VAT compliance saw a procedural update affecting the submission of the periodic VAT return (Declaração Periódica de IVA). The AT extended the electronic submission window for certain categories of taxpayer but simultaneously reduced the tolerance for late corrections. Companies that discover errors in previously submitted returns must now file a substitution return within a tighter timeframe to avoid surcharges.
For businesses considering their tax position in Portugal, we are available to review your current compliance posture and identify any gaps arising from recent changes. Contact us at info@vlolawfirm.com.
The Labour Code (Código do Trabalho) received targeted amendments that affect hiring practices, remote work arrangements, and collective bargaining obligations. The Authority for Working Conditions (Autoridade para as Condições do Trabalho, ACT) has been given expanded inspection powers, and its enforcement activity has visibly increased.
Remote work rules, which were introduced in earlier legislation, were refined to clarify the employer';s obligations regarding equipment provision and expense reimbursement. The current framework requires employers to bear the costs of equipment necessary for remote work and to contribute to the employee';s additional home utility costs. The precise calculation method for utility contributions remains a point of practical uncertainty, and the ACT has issued guidance indicating that flat-rate agreements between employer and employee are acceptable provided they are documented in writing.
Fixed-term employment contracts received renewed scrutiny. The amendments tighten the conditions under which a fixed-term contract may be renewed, reducing the maximum number of renewals in certain circumstances. Employers who have relied on successive fixed-term arrangements to avoid permanent employment obligations should review their current workforce structures. A common mistake is assuming that a gap between contracts resets the renewal count - the ACT and the courts have consistently rejected this interpretation.
Collective bargaining agreements (Contratos Coletivos de Trabalho) saw their scope extended through ministerial extension orders (portarias de extensão). Several sector-specific agreements were extended to cover employers who were not party to the original negotiation. This means that companies operating in sectors such as hospitality, retail, and construction may now be bound by minimum wage and working-time provisions that exceed the statutory baseline, even if they have no union membership.
In practice, founders should consider conducting a workforce audit whenever a new extension order is published in the Official Gazette (Diário da República). The extension orders take effect from the date of publication and do not provide a grace period for compliance.
The Bank of Portugal (Banco de Portugal) and the Securities Market Commission (Comissão do Mercado de Valores Mobiliários, CMVM) both issued updated guidance in the final quarter, reflecting the transposition of recent EU directives into Portuguese law.
The most significant development for businesses outside the traditional financial sector is the expanded scope of anti-money laundering (AML) obligations under the Portuguese AML Law (Lei n.º 83/2017). Recent amendments extend the definition of obliged entities to capture a broader range of service providers, including certain categories of virtual asset service providers and high-value goods dealers. Entities newly captured by this definition must register with the relevant supervisory authority and implement a full AML compliance programme - including customer due diligence procedures, internal policies, and staff training - within the timeframe specified in the implementing regulation.
The CMVM updated its supervisory priorities for investment firms and fund managers, with particular emphasis on product governance obligations under the Portuguese transposition of MiFID II. Firms are expected to review their target market assessments and distribution strategies in light of the updated guidance. Many underestimate the documentation burden associated with product governance - the CMVM expects firms to maintain records that demonstrate ongoing monitoring, not merely a one-time assessment at product launch.
Banco de Portugal issued a circular clarifying the treatment of payment institutions operating on a cross-border basis under the EU passport regime. Institutions passporting into Portugal must now notify Banco de Portugal of any material changes to their business model within 30 days, a requirement that previously applied only to domestically authorised institutions. This change has practical implications for fintech companies that service Portuguese customers from a base in another EU member state.
A non-obvious requirement in the AML context is the obligation to appoint a compliance officer who is resident in Portugal for entities that are locally authorised. Remote compliance officers based in other EU jurisdictions are not accepted by Banco de Portugal as satisfying this requirement, regardless of their qualifications.
The National Data Protection Commission (Comissão Nacional de Proteção de Dados, CNPD) increased its enforcement activity, issuing several decisions that clarify how the General Data Protection Regulation (GDPR) applies in the Portuguese context. The CNPD has focused on three areas: cookie consent mechanisms, employee monitoring, and data transfers to third countries.
On cookie consent, the CNPD';s recent decisions confirm that pre-ticked boxes and implied consent mechanisms do not satisfy the GDPR';s requirement for freely given, specific, informed, and unambiguous consent. Businesses operating websites directed at Portuguese users should audit their consent management platforms against the CNPD';s published criteria. The CNPD has shown willingness to impose fines on companies of all sizes, not only large platforms.
Employee monitoring received specific attention following complaints from trade unions. The CNPD clarified that employers may monitor work-related communications on company-owned devices only where employees have been clearly informed in advance and where the monitoring is proportionate to a legitimate business purpose. Covert monitoring of any kind is prohibited under both the GDPR and the Labour Code. A common mistake is implementing monitoring software without updating the company';s privacy notice and obtaining a formal record of employee acknowledgement.
Data transfers to third countries remain a compliance risk for companies using US-based cloud providers or software-as-a-service platforms. The CNPD expects companies to maintain up-to-date transfer impact assessments and to document the supplementary measures in place where standard contractual clauses are relied upon. Many underestimate the ongoing maintenance burden of these assessments - they must be reviewed whenever the legal or factual circumstances change.
Portugal';s Digital Transition Agency (Agência para a Transformação Digital, ATD) published updated guidelines on the use of artificial intelligence in public procurement processes. While these guidelines apply directly to public bodies, they signal the direction of future private-sector regulation and are worth monitoring for companies that supply AI-enabled services to Portuguese government entities.
Foreign businesses face a layered compliance environment in Portugal. The combination of EU-level regulation, Portuguese transposition measures, and sector-specific guidance from multiple supervisory authorities creates a risk of gaps - particularly for companies that manage Portuguese operations from abroad.
Consider two practical scenarios. First, a UK-based technology company that recently expanded into Portugal by hiring three employees and establishing a branch. Under the current framework, this company must register with the Social Security Institute (Instituto da Segurança Social), enrol employees in the applicable collective bargaining agreement for the technology sector, comply with the remote work expense reimbursement rules, and ensure its invoicing software is AT-certified. Each of these obligations has its own deadline and responsible authority. Missing any one of them can trigger penalties that are disproportionate to the underlying infraction.
Second, a non-EU holding company that owns a Portuguese operating subsidiary. Recent changes to the RCBE and the AT';s cross-referencing activity mean that the beneficial ownership chain must be accurately reflected in both registers. If the holding company has recently changed its own ownership structure - for example, through a private equity transaction - the Portuguese subsidiary has 30 days to update the RCBE. Many foreign groups are unaware that the obligation runs at the Portuguese entity level, not at the group level.
In practice, founders should consider appointing a local compliance coordinator who monitors the Diário da República for new legislation and extension orders. The volume of regulatory change in Portugal is significant, and relying on annual reviews is no longer sufficient.
For international clients navigating these obligations, our team can provide a structured compliance review and help prioritise the most urgent actions. Reach out to info@vlolawfirm.com to discuss your situation.
What is the most significant compliance risk for foreign companies following recent Portuguese regulatory changes?
The most immediate risk for foreign companies is the combination of stricter RCBE enforcement and the AT';s cross-referencing activity. Companies that have not updated their beneficial ownership register following structural changes face administrative penalties that can accumulate daily. Beyond this, the expansion of AML obligations to new categories of obliged entities means that some businesses may now be subject to a full compliance programme requirement without realising it. The safest approach is to conduct a gap analysis against the current regulatory framework rather than assuming that previous compliance measures remain sufficient. Sector-specific risks - particularly in financial services and digital services - require separate assessment.
How long does it typically take to implement a compliant AML programme in Portugal, and what does it cost?
Implementing a compliant AML programme for a newly obliged entity typically takes between six and twelve weeks, depending on the complexity of the business and the availability of internal resources. The process involves drafting internal policies, conducting a business-wide risk assessment, implementing customer due diligence procedures, and training staff. Professional fees for external legal and compliance support vary significantly by firm size and scope, but businesses should budget for meaningful professional input rather than treating this as a purely administrative exercise. The cost of non-compliance - including supervisory fines and reputational damage - substantially exceeds the cost of a properly implemented programme.
Should a company operating in Portugal review its employment contracts following the recent Labour Code amendments?
Yes, particularly if the company uses fixed-term contracts or has employees working under remote work arrangements. The amendments to fixed-term renewal limits and the clarification of remote work expense obligations both have retrospective practical implications - meaning that existing arrangements may no longer comply with the current rules even if they were valid when entered into. Companies in sectors covered by recently extended collective bargaining agreements should also verify whether their contractual terms meet the new minimum standards. A targeted employment contract review, focused on the specific changes introduced in the recent amendments, is a proportionate and cost-effective step.
Portugal';s regulatory environment in the final quarter brought meaningful changes across corporate, tax, employment, financial services, and data protection law. For international businesses, the cumulative effect of these changes requires active monitoring rather than periodic review. The most exposed companies are those that manage Portuguese operations remotely without a local compliance function.
VLO Law Firms advises international clients on regulatory compliance and legal structuring in Portugal. We can assist with RCBE filings, AML programme implementation, employment contract reviews, tax compliance assessments, and data protection audits. To request a consultation, contact: info@vlolawfirm.com