Luxembourg Tax Alert 2026-02

The EU Public Country-by-Country Reporting (EU public CbCR), transposed into Luxembourg law on 19 July 2023 through Directive (EU) 2021/2101, is now moving from policy to practice, and organizations within its scope can no longer afford to delay.

The obligations apply to accounting periods starting on or after 22 June 2024¹ so that for the majority of taxpayers with a reporting period that just ended on 31 December 2025, it is now your turn to act: 2025 will be the first financial year subject to public CbCR, with the corresponding report due by the end of 2026.

Beyond ensuring regulatory compliance, public CbCR increases transparency and exposes groups to stakeholder scrutiny, but it also provides an opportunity to proactively shape and communicate your tax narrative.

Governance and audit obligations under Luxembourg’s Public CbCR regime are more significant than ever, illustrated by three concrete points of attention:

1. Members of the administrative, management, and supervisory bodies have a legal responsibility in the correct and timely publication of the Public CbCR. These requirements effectively embed Public CbCR compliance into corporate governance duties at the board and management level, elevating it from a technical reporting task to a core governance obligation that must be overseen through processes and internal controls.
2. Sanctions for non-compliance are directed at individuals (board/management) and not at the company as an entity itself. The persons responsible² are collectively liable for compliance and provides for administrative sanctions for non‑compliance. Failure to meet the reporting or publication obligations can result in fines between approximately EUR 500 and EUR 25,000 if Public CbCR duties are breached.
3. Statutory auditors have a defined role: where the accounts of an in‑scope Luxembourg entity are audited, the auditor’s report must indicate whether the company was required to publish a Public CbCR for the preceding year and, if so, whether that report was drawn up and made available in accordance with the law. This requirement integrates Public CbCR compliance into the statutory audit process and effectively places it on the auditor’s checklist.

It is important to understand that Public CbCR is an additional compliance layer on top of the existing non-public CbCR obligations, which were introduced under BEPS Action 13 and implemented in the EU through Council Directive 2016/881/EU.

Public CbCR is intended for public transparency. While the underlying financial and tax data may overlap with non-public CbCR, public reporting requires additional steps to ensure accuracy, clarity, and readability:

1. Companies must provide a detailed jurisdictional breakdown for all EU Member States individually and for jurisdictions classified as non-cooperative for tax purposes, according to the EU list as of 1 March of the reporting year.
2. Aggregated reporting is permitted for all other jurisdictions (“rest of the world”).
3. Unlike non-public CbCR, the report must be prepared in a format suitable for public disclosure, often including explanatory notes, tables, or charts to make the information understandable to non-tax audiences.

While the law does not explicitly require an accompanying letter, companies may choose to include a brief statement from management when publishing the report. This statement can provide context for the figures and clarify the treatment of particularly sensitive information. It also helps ensure that the publicly disclosed figures are understandable to stakeholders.

Public CbCR is mandatory, and with the first publishing deadlines, the earliest of which will be June 2026, are approaching fast, a tailored action plan can help you navigate the process from start to finish:

1. Assess scope and thresholds
   Is your entity holding or belonging to a group consolidating more that EUR 750 million revenue over two consecutive financial years?
2. Evaluate exemptions and derogations from reporting obligations
   Does your group’s size, the nature or sector of its activities qualify for any exemptions or derogations under Luxembourg law?
   Would the Public CbCR disclose commercially sensitive information where publication could harm competitiveness?
   Does your Luxembourg entity belong to a non-EU group that prepares a comparable report? Does this report meet the necessary criteria to benefit from the exemption?
3. Plan the Publication Process
   Identify:
   - which group entity will publish.
   - responsibilities, internal review steps, and the timeline to ensure that the report is prepared and published correctly, within the statutory deadline and remain accessible for a minimum of five consecutive years.
4. Prepare the Report
   - Collect and consolidate the required financial and tax information for all in-scope entities.
   - Consider to include a brief management statement to provide context, explain methodological choices or aggregations, and clarify the treatment of particularly sensitive information.
5. Review, Approve, and Publish
   Management or the relevant administrative bodies should formally approve that the report is complete, accurate, and compliant with the law before publication. The report must then be published and made publicly accessible within 12 months of the balance sheet date.
   Following publication, companies should continue to monitor any changes in law, thresholds, or the EU non-cooperative list to ensure ongoing compliance for future reporting periods.

Our team can support you in assessing scope, preparing and validating data, aligning it with your transfer pricing and governance story, and planning both the publication process and stakeholder communication, providing clarity and confidence as you move toward compliance.

If you are interested in learning more about the topic and gaining early insights into the first wave of EU public country-by-country reporting, KPMG Global has published an insightful article summarising key findings from the initial disclosure obligations for 2025 in other EU member states. These first reports relate to financial year 2025 (for calendar-year taxpayers), with Romania and Croatia among the first jurisdictions with publishing obligations. Please click the link below to read the full article.

Navigating the first wave of EU public country-by-country reporting

¹ For a 1 July 2024 start of the accounting period, the first Luxembourg public CbCR report must be published by 30 June 2026.