Regulatory Update in Portugal: Q1 2026

Portugal';s regulatory landscape has shifted considerably in recent months, with new rules affecting corporate compliance, employment relations, tax reporting, and data governance. Businesses operating in or entering Portugal face a more demanding compliance environment than in previous years. This guide covers the most material legislative and regulatory developments of the current quarter, explains their practical implications for international operators, and highlights the steps companies should take to remain compliant.

The Portuguese Commercial Registry Code, administered by the Instituto dos Registos e do Notariado (IRN), continues to be updated to align with European Union directives on corporate transparency. The most notable recent development is the tightening of beneficial ownership disclosure obligations under the Central Register of Beneficial Owners (Registo Central do Beneficiário Efetivo, or RCBE). Entities registered in Portugal - including sociedades por quotas (Lda) and sociedades anónimas (SA) - must now ensure that their beneficial ownership records are current, accurate, and updated within a shorter window following any structural change.

Under the current framework, any change in beneficial ownership must be reported to the RCBE within 30 days of the triggering event. Failure to update the register can result in administrative fines and, critically, can block the entity from accessing certain public contracts and notarial services. Many foreign-owned companies underestimate this requirement, particularly when a reorganisation at the group level abroad indirectly changes the ultimate beneficial owner of a Portuguese subsidiary.

A common mistake is treating the RCBE update as a formality that can be deferred. In practice, Portuguese banks and public procurement bodies routinely verify RCBE status before executing transactions or awarding contracts. Companies should build a compliance calendar that flags any upstream ownership change as a trigger for a mandatory Portuguese filing.

Additionally, the IRN has reinforced requirements around the registered office address. Virtual office arrangements that lack a genuine operational presence are receiving closer scrutiny. Businesses using such arrangements should review their setup to confirm it satisfies the current administrative standard.

Tax compliance in Portugal is governed primarily by the Código do Imposto sobre o Rendimento das Pessoas Coletivas (IRC Code) for corporate income tax and the Código do IVA for value added tax. The Autoridade Tributária e Aduaneira (AT), Portugal';s tax authority, has intensified its digital audit capabilities, and several procedural changes have come into effect that directly affect how businesses file and substantiate their returns.

The mandatory e-invoicing regime, which requires certified invoicing software for all VAT-registered entities, has been extended in scope. Businesses that previously operated below the threshold for certified software are now required to comply. The AT cross-references invoice data submitted through the SAFT-PT (Standard Audit File for Tax) system against VAT returns in real time, meaning discrepancies are flagged automatically and can trigger an audit request within weeks rather than months.

For corporate income tax, the transfer pricing documentation requirements have been updated to reflect the OECD';s current guidance. Portuguese subsidiaries of multinational groups must maintain a local file and, where applicable, a master file, and these must be available for submission within 15 days of an AT request. Many groups prepare these documents centrally but fail to adapt them to Portuguese-specific requirements, which is a recurring compliance gap.

The AT has also clarified its position on the tax treatment of remote workers employed by foreign entities but physically present in Portugal. Where such individuals create a taxable presence for the foreign employer, a permanent establishment analysis is required. Businesses with employees working remotely from Portugal should obtain a formal assessment of their exposure before the next filing cycle.

If your business is navigating these tax reporting changes and needs a structured compliance review, contact info@vlolawfirm.com. We can help structure the setup correctly the first time.

Portuguese employment law is codified in the Código do Trabalho, and recent amendments have introduced several obligations that employers - particularly those managing international or hybrid workforces - must address promptly.

The most significant change concerns the right to disconnect. Employers with ten or more employees are now subject to strengthened obligations to refrain from contacting employees outside working hours, except in genuine emergencies. While this rule existed in outline previously, enforcement guidance has clarified that systematic after-hours communication can constitute a labour law violation, exposing the employer to claims before the Autoridade para as Condições do Trabalho (ACT), Portugal';s labour inspectorate.

Remote work agreements have also been subject to updated requirements. Written agreements must now specify the location of remote work, the equipment provided, and the cost reimbursement mechanism. Employers who rely on informal arrangements or generic employment contracts without a dedicated remote work annex are exposed to challenge. The ACT has increased inspection activity in this area, and penalties for non-compliant arrangements can include fines calculated per affected employee.

A non-obvious requirement relates to the posting of workers. Foreign companies sending employees to Portugal on a temporary basis must register the posting with the ACT before the worker begins activity. The registration is completed through an online portal, and the company must designate a local representative. Many foreign employers are unaware of this obligation and proceed without registration, which can result in significant administrative penalties discovered only during a later inspection.

Parental leave entitlements have also been extended under recent amendments to the Código do Trabalho. Employers must update their internal policies and payroll systems to reflect the current entitlements, including the enhanced shared parental leave provisions that incentivise both parents to take leave simultaneously.

Portugal';s data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), has increased its enforcement activity in line with broader EU trends. The CNPD has issued several decisions in recent months addressing inadequate data processing agreements, insufficient retention policies, and failures to conduct data protection impact assessments (DPIAs) for high-risk processing activities.

Under the General Data Protection Regulation (GDPR), as applied in Portugal, controllers and processors must maintain records of processing activities and be able to demonstrate compliance on request. The CNPD';s current focus areas include the use of third-party analytics tools on websites, the adequacy of consent mechanisms, and the lawfulness of employee monitoring practices. Businesses that have not reviewed their privacy notices and consent flows since the GDPR';s initial implementation are likely to have gaps.

The EU';s Digital Services Act (DSA) and Digital Markets Act (DMA) are also generating compliance obligations for Portuguese-based digital businesses, particularly platforms and intermediary service providers. While the primary enforcement of these instruments sits at EU level, Portuguese businesses must align their terms of service, content moderation procedures, and transparency reporting with the applicable requirements.

A practical scenario: a Portuguese e-commerce operator using a US-based analytics provider must ensure that the data transfer is covered by an adequate mechanism - such as standard contractual clauses - and that users are informed of the transfer in the privacy notice. Many operators have updated their notices but have not executed the underlying data processing agreements, leaving a compliance gap that the CNPD can act on.

A second scenario: a financial services firm operating in Lisbon that uses automated decision-making in its credit assessment process must conduct a DPIA and document the logic of the automated system. Failure to do so is a recurring finding in CNPD inspections of the sector.

Portugal';s real estate and investment regulatory environment has seen notable activity, driven in part by EU state aid rules, housing policy reform, and changes to the investment licensing framework.

The Agência Portuguesa para o Investimento e Comércio Externo (AICEP) continues to administer the investment incentive framework, but the eligibility criteria for certain incentive programmes have been revised. Investors planning to claim incentives under the Portugal 2030 programme should verify current eligibility thresholds and application windows, as these have been updated and the previous parameters no longer apply.

In the real estate sector, the Arrendamento Urbano (urban lease) framework has been subject to further amendment. Landlords and tenants operating under commercial leases should review whether their agreements comply with the current statutory requirements, particularly regarding rent update mechanisms and notice periods. Non-compliant clauses may be unenforceable, which creates risk for both parties.

The licensing of certain regulated activities - including financial intermediation, insurance distribution, and payment services - continues to be overseen by the Banco de Portugal and the Comissão do Mercado de Valores Mobiliários (CMVM). Both regulators have issued updated guidance on fit-and-proper assessments and on the requirements for passporting EU-licensed entities into Portugal. Businesses relying on passporting arrangements should confirm that their notifications remain current and that any material changes to their business model have been reported to the relevant authority.

Many underestimate the time required to obtain or update a regulated licence in Portugal. Applications that appear straightforward can take several months if documentation is incomplete or if the regulator requests additional information. Building in adequate lead time is essential for businesses planning to launch or expand regulated activities.

For assistance navigating investment incentives, licensing requirements, or real estate compliance, contact info@vlolawfirm.com. We can assist with documents and filings across these areas.

What are the consequences of failing to update the RCBE in Portugal?

The RCBE is the Central Register of Beneficial Owners, and maintaining accurate entries is a legal obligation for all Portuguese companies. Failure to update the register within the required 30-day window can result in administrative fines imposed by the IRN. Beyond fines, an outdated RCBE entry can prevent the company from completing notarial acts, accessing public procurement procedures, and in some cases executing banking transactions. Portuguese banks routinely verify RCBE status as part of their know-your-customer procedures, so an outdated entry can cause practical disruption well before any formal penalty is imposed. Foreign parent companies should treat any group restructuring as a trigger for an immediate review of their Portuguese subsidiaries'; RCBE filings.

How long does it typically take to resolve a tax compliance issue with the Autoridade Tributária in Portugal?

The timeline depends heavily on the nature and complexity of the issue. A straightforward correction to a VAT return can be resolved within a few weeks through the AT';s online portal. A transfer pricing query, by contrast, can take several months if the AT requests additional documentation and the taxpayer needs to compile a local file. Formal tax inspections (inspecções tributárias) can run for six months or longer. The AT is required to notify the taxpayer of the outcome within statutory deadlines, but these can be extended. Businesses facing an AT inquiry should engage qualified tax counsel promptly, as the window for submitting a voluntary regularisation - which typically attracts lower penalties - is time-limited.

Should a foreign company establish a branch or a subsidiary in Portugal, and does the choice affect regulatory obligations?

The choice between a branch (sucursal) and a subsidiary (typically an Lda or SA) affects regulatory obligations in several ways. A branch is not a separate legal entity; it is an extension of the foreign parent, which remains directly liable for the branch';s obligations. A subsidiary is a separate legal person with its own liability shield. From a regulatory standpoint, branches must register with the IRN and comply with Portuguese accounting and tax rules, but they are not subject to the same corporate governance requirements as subsidiaries. However, branches of regulated entities - such as banks or investment firms - face additional requirements from the Banco de Portugal or CMVM. For most commercial activities, a subsidiary offers cleaner liability separation and is the more common choice for foreign investors. The decision should be made after considering the tax implications, the nature of the activity, and the group';s long-term plans for Portugal.

Portugal';s regulatory environment is evolving across multiple domains simultaneously, from corporate transparency and tax digitalisation to employment rights and data protection enforcement. Businesses operating in Portugal must treat compliance as a continuous process rather than a one-time exercise. Staying current with changes to the Código do Trabalho, the IRC Code, RCBE obligations, and CNPD guidance is essential to avoiding penalties and operational disruption.

VLO Law Firms advises international clients on regulatory compliance and corporate matters in Portugal. We can assist with RCBE filings, tax compliance reviews, employment law updates, data protection assessments, and investment licensing. To request a consultation, contact: info@vlolawfirm.com