D&O cover gap review in Luxembourg: rules, filings and risk

A D&O cover gap review in Luxembourg tests whether the insurance a board actually holds matches the personal liability its directors carry under Luxembourg company law, not whether a policy exists at all. Most policies are bought against a generic exposure list; the gap shows up when that list is compared against what Luxembourg civil liability rules and Luxembourg register filings actually attach to the office. For a group with a Luxembourg holding or operating entity, the review is the document that closes that gap before a claim, not after one.

A parent group installs a Luxembourg S.à r.l. as a holding vehicle, staffs the board with directors who already sit on three other boards in the group, and renews the group D&O policy centrally without a Luxembourg-specific schedule. Six months later a creditor of the Luxembourg entity alleges mismanagement against one of those directors personally. The policy responds, in part, on terms nobody in the group has read since the acquisition.

What follows sets out what actually changes when this work is done for a Luxembourg entity, rather than for the group generically, what becomes fixed on the Luxembourg corporate register once a director is appointed, and where the advisory boundary sits.

What changes in Luxembourg

There is no standalone statutory obligation in Luxembourg requiring a company to carry out a D&O cover gap review, and no filing exists that records one. A director does not have to be resident in Luxembourg to hold office there, which is precisely why the gap tends to open in cross-border groups: the person carrying the personal exposure is often based, insured and advised from another jurisdiction entirely. 02

The requirement that actually drives the review in Luxembourg is not procedural. Directors and managers are personally liable to the company for the proper performance of their mandate, and to third parties for damage caused by a breach of the law or the articles of association. 01 That liability sits with the individual, not with the group structure above them, and a D&O policy written at group level does not automatically follow the Luxembourg entity's own gouvernance d'entreprise, corporate governance, arrangements down to that individual. Confirming that it does is the point of the exercise, and the D&O cover gap review methodology sets out how that confirmation is built for any jurisdiction; this page sets out what is different when the entity sits in Luxembourg.

The local requirement or test that drives the work

The test the board should be applying is not "do we hold a policy" but "does the policy respond to the specific conduct the Luxembourg civil liability regime punishes". Mismanagement claims under Luxembourg law are brought against the individual who took the decision, and the standard applied looks at whether a reasonably careful director in the same position would have acted differently, not whether the group's central compliance function signed off on the transaction.

A director found personally liable for mismanagement in Luxembourg carries that finding personally: once a court has entered a judgment against the individual, the exposure cannot be undone by taking out better cover afterwards, and indemnification from the company for a deliberate or grossly negligent breach is not generally available to correct it. That is the sequencing problem a gap review exists to solve while there is still time to solve it – before the conduct in question, not after.

Shareholder rights sit alongside this rather than instead of it. Where a claim against the board is contemplated, the question of who may bring it and on whose authority is a separate track from the insurance question, and the two are frequently confused inside groups that have not mapped either one against the Luxembourg entity specifically.

The filing, register or forum consequence

Directors of a Luxembourg company are identified by name on the Luxembourg Trade and Companies Register, and their registered office details, appointment and any cessation of office are matters of public record on that register. 03 The Luxembourg corporate register is not a private group file: a counterparty, a claimant or a regulator can identify the individual holding office at any given date without approaching the company at all.

That has a direct consequence for the personal liability question. Once a director's appointment is filed against a Luxembourg registered office, the exposure that attaches to the office becomes traceable to that individual on the public record for the whole period of the appointment; removing the entry after a claim has already crystallised does not remove the liability, it only affects who can be shown to have held the office at the relevant date. A gap review has to work from the register entry as it stands, not from an internal org chart that may no longer match it. See how the same director's exposure is scoped more generally in the comparison of personal director liability across jurisdictions, and how the sequencing of this review interacts with other governance work in a note on timing the review correctly.

What this service does not include in Luxembourg

The review does not extend into acting as, supplying, sourcing or arranging a director, secretary, nominee shareholder or trustee for the Luxembourg entity, and it does not extend into any activity for which a Luxembourg trust or corporate service provider licence is required. That boundary is not a matter of preference. Luxembourg, like a number of the jurisdictions in this plan, restricts the provision of directors and related services to entities holding the relevant licence, and a firm without that licence cannot cross the line without exposing the client rather than protecting it.

What the client receives instead is scoped precisely:

• The personal liability exposure of each Luxembourg board member mapped against the group's existing D&O policy schedule
• A gap memorandum setting out which heads of Luxembourg mismanagement liability the policy currently excludes or leaves ambiguous
• A review of the appointment terms held by each director, cross-checked against what the Luxembourg register shows
• A short list of the questions the board should put to its insurer before the next renewal

Where a group's reorganisation touches the Luxembourg entity's board at the same time, the governance questions and the insurance questions should be worked through together rather than in sequence; the related work on group reorganisation governance in Luxembourg covers that overlap, and the same review methodology applied to a neighbouring jurisdiction is set out on the Malta version of this page for groups comparing the two.

Frequently asked questions

Does a D&O cover gap review in Luxembourg change for a foreign-owned company?

Yes, in one specific respect. The personal liability regime applies to the individual holding office in Luxembourg regardless of where the parent group is based, so a policy written around the parent's home jurisdiction will not automatically track the Luxembourg entity's own exposure unless it is checked against the Luxembourg register entry for that entity.

What does a D&O cover gap review in Luxembourg require in practice?

It requires the current board composition as filed against the Luxembourg registered office, the existing D&O policy wording, and the appointment terms of each director. Without the register entry as a starting point, the review is working from an assumption rather than from the position the entity is actually in.

Who inside the company is responsible for the review in Luxembourg?

Responsibility sits with the board as a whole, because the liability being tested is the board's own. A group compliance function can commission and coordinate the review, but it cannot discharge the board's own obligation to confirm its cover matches its exposure.

What evidence should the board keep on this in Luxembourg?

A dated gap memorandum, the policy schedule it was tested against, and a record of when the register entries for each director were last checked. The date matters as much as the content, because a review that is not refreshed after a board change is evidence of the position at the wrong point in time.

What happens if this is left unaddressed in Luxembourg?

Nothing happens on the register or in any filing – the gap stays invisible until a claim tests it. At that point, the exclusion in the policy and the personal liability under Luxembourg law are both already fixed, and neither can be adjusted retrospectively to help the director named in the claim.

A group that has just added a Luxembourg entity, or changed its board, is at the point where this exposure is cheapest to fix and hardest to see. Confirming the position now avoids finding out the shape of the gap from a claim rather than from a review.

Assess your director exposure. Write to info@hreithlaw.com with the jurisdiction and the structure.

A board that has recently taken on a Luxembourg subsidiary, or renewed a group policy without a jurisdiction-specific schedule, carries this exposure whether or not anyone has looked at it. The review either confirms the cover holds or identifies, in writing, exactly where it does not.

Assess your director exposure. Write to info@hreithlaw.com with the jurisdiction and the structure.