Who controls a Luxembourg entity is not answered by the commercial register alone. Sanctions designations and PEP classifications are a parallel layer of control-relevant information. They determine whether a named director, shareholder, or beneficial owner carries a restriction that limits what the entity can do — and with whom.
Luxembourg sits at the intersection of three sanctions frameworks: EU restrictive measures administered by the European External Action Service, UN Security Council consolidated lists, and US OFAC designations. Each framework operates independently. A name cleared on one list may appear on another. The control question — whether the person who holds or exercises authority over a Luxembourg company is subject to a restriction — requires checking all three.
What the EU Consolidated Sanctions List showsNatural persons and legal entities subject to EU restrictive measures: name, date of birth where available, designation basis, and the measure applied. Source: EU Sanctions Map / EEAS Consolidated List · verified 2026-09-01 What the UN Consolidated List showsIndividuals and entities listed under UN Security Council resolutions: identifying information, narrative summary, and the committee responsible. Source: UN Security Council Consolidated List · verified 2026-09-01 What OFAC SDN showsSpecially Designated Nationals and Blocked Persons: name, aliases, date of birth, nationality, and the programme under which the designation was made. Source: OFAC SDN List · verified 2026-09-01 What no public list showsPEP status is not published in any official Luxembourg register. PEP classification is a compliance determination made by obliged entities under the AML Law of 12 November 2004 as amended — it is not a public record.What sanctions lists disclose about control in Luxembourg
A Luxembourg holding company, SOPARFI, or fund vehicle may have a designated person at any point in its control chain. The designation may attach to a direct shareholder, a beneficial owner, a director, or an authorised signatory. The lists name the person; they do not map the corporate structure around that person.
Establishing control therefore requires two parallel steps. The first is identifying who holds or exercises authority over the entity — drawn from the Registre de Commerce et des Sociétés (RCS), filed shareholder lists, and where accessible, the Registre des bénéficiaires effectifs (RBE). The second is screening each identified person against the applicable sanctions lists.
The EU Consolidated Sanctions List is publicly searchable without registration. The UN list is similarly open. OFAC publishes the SDN list for free download and online search. Access to the lists themselves does not require payment or a declared interest. What requires professional work is the matching process: name variants, transliterations, date-of-birth disambiguation, and the identification of entities controlled by a listed person at the 50-percent-or-more threshold under EU Council Regulation (EU) No 269/2014 and its successors.
The 50% ownership rule under EU sanctions means that an entity is automatically subject to the same restrictions as a listed person if that person holds, directly or indirectly, more than 50% of the ownership interest. This rule operates even when the entity itself is not named on any list. Establishing whether it applies requires tracing the ownership chain — which is a registry task, not a list task.
PEP classification: what exists and what does not
Luxembourg has no public PEP register. The Financial Intelligence Unit (Cellule de Renseignement Financier — CRF) does not publish a list of politically exposed persons. The Commission de Surveillance du Secteur Financier (CSSF) does not maintain a searchable PEP database.
PEP status in Luxembourg is determined by obliged entities — banks, notaries, lawyers, fund administrators — applying the definition in Article 1(7) of the AML Law. That definition follows the FATF standard: current or former holders of prominent public functions, their family members, and known close associates. The determination is made at the point of onboarding or periodic review. It is not recorded in any register accessible to a third party.
Commercial PEP screening databases — compiled from official gazette publications, parliamentary records, government websites, and court registers — provide a proxy. They are not official sources. Their coverage of Luxembourg-connected PEPs depends on the underlying data collection methodology of each vendor. Gaps exist, particularly for sub-national positions and for persons whose public function was held in a jurisdiction with limited digital records.
What can be established from official sources is the public function itself: Luxembourg parliamentary mandates are published in the Mémorial and on the Chamber of Deputies website; government appointments appear in official gazette notices; judicial appointments are published by the Ministry of Justice. These are primary sources for the function. The PEP classification derived from them is a compliance conclusion, not a registry fact.
The Luxembourg RBE and its intersection with sanctions screening
The Registre des bénéficiaires effectifs (RBE), established under the Law of 13 January 2019, holds beneficial ownership declarations for Luxembourg entities. Following the CJEU judgment of 22 November 2022 in Cases C-37/20 and C-601/20, public access to the RBE was suspended. Access is now restricted to competent authorities, obliged entities acting within an AML/CFT obligation, and persons or organisations demonstrating a legitimate interest.
This restriction has a direct consequence for sanctions screening. The beneficial ownership layer — the layer most relevant to the 50% ownership rule — is not publicly visible. An analysis that relies only on the RCS and public sanctions lists cannot confirm whether a listed person holds an indirect beneficial interest that triggers automatic designation of the Luxembourg entity.
The RCS does show direct shareholders for SA and Sàrl structures where shareholder lists have been filed. For holding chains involving multiple jurisdictions, the chain breaks at the first non-Luxembourg layer unless each intermediate jurisdiction's registry is also consulted.
Where the sources disagree
Three types of divergence arise regularly in Luxembourg sanctions and PEP analysis.
List versus registry. A person may appear on a sanctions list under a name variant that does not match the spelling in the RCS filing. Transliteration differences — particularly for names originating in Arabic, Russian, or Chinese scripts — mean that a direct string match between the list and the registry entry is insufficient. Manual review of aliases and date-of-birth data is required.
RBE versus RCS. The beneficial owner declared in the RBE may differ from the direct shareholder shown in the RCS. This divergence is not necessarily an error: intermediate holding structures are common in Luxembourg. But it means that a sanctions screen conducted only against RCS data may miss the person who actually controls the entity.
Commercial PEP database versus official gazette. Commercial databases update on different cycles. An official gazette notice of a government appointment may precede the database update by weeks or months. For time-sensitive transactions, the official gazette is the controlling source.
The limit of what the sources allow
The EU Consolidated Sanctions List, the UN Consolidated List, and the OFAC SDN List are public and searchable without charge. Identifying whether a named individual or entity appears on these lists is a mechanical task once the correct name and identifiers are known.
The ceiling is reached at four points.
First: PEP status is not a public record in Luxembourg. No official source confirms or denies that a specific individual is classified as a PEP by any obliged entity. What can be established is the public function from which PEP status would be derived — not the classification itself.
Second: The RBE is closed to general access. The beneficial ownership layer cannot be confirmed from public sources alone. The analysis can reach the direct shareholder level from the RCS; it cannot reach the ultimate beneficial owner without either RBE access under a legitimate interest declaration or registry analysis in each upstream jurisdiction.
Third: The 50% ownership rule under EU sanctions requires tracing the full ownership chain. If any link in that chain passes through a jurisdiction whose registry is not publicly accessible, the analysis cannot confirm or exclude automatic designation of the Luxembourg entity.
Fourth: Sanctions list data has a publication lag. A designation made today may not appear in a downloadable list file for hours or days depending on the list and the update cycle. For transactions closing on a specific date, the relevant check is the list status at the moment of closing — not a check conducted days earlier.
These four limits are stated before any engagement. The analysis establishes what the sources show; it names the point at which the chain breaks and explains why.
What the analysis covers
A sanctions and PEP analysis for a Luxembourg entity proceeds in three layers.
The first layer is list screening: the named directors, shareholders, and — where accessible — beneficial owners are checked against the EU Consolidated Sanctions List, the UN Consolidated List, and the OFAC SDN List. Aliases and name variants are included. The result is a documented match or no-match for each identified person, with the list entry cited where a match is found.
The second layer is ownership chain review: the RCS filing history is reviewed to establish the direct shareholder structure. For multi-jurisdictional chains, each upstream registry that is publicly accessible is consulted. The point at which the chain becomes inaccessible is identified and documented.
The third layer is PEP function review: official gazette publications, parliamentary records, and government appointment notices are reviewed for each identified person. The public function is documented. The PEP classification conclusion is left to the obliged entity conducting its own AML review.
FAQ
Does Luxembourg have a national sanctions list separate from the EU list? Luxembourg does not maintain a separate national sanctions list. EU restrictive measures apply directly in Luxembourg as a matter of EU law. The competent national authority for sanctions implementation is the Ministry of Finance, which publishes guidance on the application of EU measures. The operative list is the EU Consolidated Sanctions List.
Is the EU Consolidated Sanctions List the same as the OFAC SDN List? No. The two lists are maintained by different authorities under different legal frameworks. A person may appear on one and not the other. US-dollar transactions and US-nexus activity are governed by OFAC designations regardless of EU list status. Both lists must be checked independently.
Can a Luxembourg company itself be on a sanctions list without its shareholders being listed? Yes. An entity can be designated directly — for example, under EU Council regulations targeting specific sectors or activities — without any of its shareholders appearing on a list. The entity-level check and the person-level check are separate steps.
What does 'legitimate interest' mean for RBE access? The Law of 13 January 2019 and the CSSF's implementing guidance describe legitimate interest as a documented, specific, and credible connection to AML/CFT purposes. Journalists, civil society organisations, and persons with a direct legal interest in the entity have been recognised as qualifying. The determination is made by the RBE administration on a case-by-case basis. There is no automatic right of access for commercial due diligence purposes.
How current are the sanctions lists? The EU Consolidated Sanctions List is updated when new restrictive measures enter into force, typically within hours of publication in the Official Journal of the EU. The UN list is updated by the relevant Security Council committee. OFAC updates the SDN list on a rolling basis. All three lists publish the date and time of the most recent update. The analysis records the list version and timestamp used.
What happens if a shareholder is added to a sanctions list after the analysis is completed? The analysis reflects list status at the time of the check. Post-closing designations are not covered by a point-in-time report. Ongoing monitoring requires a separate arrangement with a compliance service provider or an internal screening programme.
Sources
- EU Sanctions Map / EEAS Consolidated List — https://www.sanctionsmap.eu — verified 2026-09-01
- UN Security Council Consolidated List — https://www.un.org/securitycouncil/content/un-sc-consolidated-list — verified 2026-09-01
- OFAC Specially Designated Nationals and Blocked Persons List — https://ofac.treasury.gov/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists — verified 2026-09-01
- Luxembourg Registre de Commerce et des Sociétés (RCS) — https://www.lbr.lu — verified 2026-09-01
- Luxembourg Registre des bénéficiaires effectifs (RBE) — https://www.lbr.lu/mjrcs-rbe — verified 2026-09-01
- Luxembourg AML Law of 12 November 2004 as amended — https://legilux.public.lu — verified 2026-09-01
- CSSF AML/CFT guidance — https://www.cssf.lu — verified 2026-09-01
Request this report
Disclaimer: This report is a factual compilation from official registers and public sources. It is provided for informational purposes only, does not constitute legal advice, and contains no legal qualification of the facts established. VLO Law Firm assumes no liability for actions taken or not taken based on this material. For advice regarding your particular situation, please contact info@vlolawfirm.com.
Author: Elena Moretti — Partner, Continental Europe, VLO Law Firm
