Belgium extends professional-withholding return filing after cyber incident

For professional withholding tax, the relief covers the September 2026 monthly return and third-quarter 2026 return, whose filing date had already been moved from 15 October to 31 October because of separate FinProf technical problems.^[1][2][3]

Administrative filing relief

The change is administrative deadline relief, not an amendment to Belgium’s professional-withholding rules. FPS Finance said the attack was detected within hours, potentially affected components were isolated and services including MyMinfin were taken offline. It reported that the attack had not gained control of applications or accessed data. The 29 October notice then moved tax-return deadlines falling around 31 October to 16 November.^[1]

September and third-quarter returns

FPS Finance’s FinProf notice identifies the affected professional-withholding periods as September 2026 and the third quarter of 2026. Belgian professional-withholding returns must generally be submitted electronically through FinProf under the Royal Decree of 3 June 2007, published in the Belgian Official Gazette on 14 June 2007. The filing obligation concerns persons that pay or attribute Belgian remuneration subject to professional withholding, including Belgian employers within multinational groups.^[2][4]

Payment deadline was not extended

The relief concerns filing rather than payment. The FinProf notice expressly kept the payment deadline unchanged and told taxpayers to remit the tax using the appropriate structured reference even where they could not submit the return. The official 2026 calendar gives 15 October 2026 as the payment date for both September monthly and third-quarter liabilities. The later cybersecurity notice does not state that payment dates were extended.^[1][2][3]

Check filing and remittance separately

Affected groups should confirm separately whether the return and remittance were completed. An outstanding September or third-quarter FinProf return should be filed by 16 November. Where payment was not received by the original deadline, the group should assess late-payment interest rather than assume the cybersecurity extension provides payment relief. Returns for later periods, including October 2026 returns ordinarily due on 13 November, should not be treated as extended on the evidence reviewed.^[1][2][3]