Public access to UBO registers across the EU ruled invalid

In the past years, the EU legislator has gone quite far in its anti-money laundering (AML) and counter terrorist financing (CTF) efforts. Under the EU’s Anti-Money Laundering Directives (MLD), companies and other legal entities must, among other things, collect information on their ultimate beneficial owners (UBOs) and submit this information to public registers, providing extensive insights into the material and financial situation of individuals.

On 22 November 2022, the Court of Justice of the European Union (CJEU)  ruled that the provision of the MLD which requires that beneficial ownership information on legal entities is generally and publicly accessible violates fundamental rights to privacy and data protection under the Charter of Fundamental Rights of the EU (Charter) and is therefore invalid. This represents a significant change to the transparency of company information and may have an immediate impact on the related registers across the EU.

Update 8 December 2022: In the aftermath, the CJEU published a clarification of the ruling’s effect on the MLD.

The background of the MLD provision: public information on beneficial ownership as a means to combat money laundering and terrorist financing

According to the EU legislator, accurate and up-to-date information on UBOs is key in tracing criminals who might otherwise hide their identity behind a corporate structure. Therefore, the MLD require member states to ensure that entities obtain correct and current information on their UBOs. This information must be stored in a central register (incorporated in the existing company register in eg France and the Netherlands, or in separate UBO registers in eg Austria, Belgium and Germany (Transparenzregister)). In Germany, the most recent amendments to AML legislation provided for a far-reaching extension of reporting requirements.

Under Directive 2015/849 (MLD4), public access to the UBO register (which is also available to competent authorities, FIUs and obliged entities under MLD4) was limited to persons or organisations that could demonstrate a ‘legitimate interest.’

However, further to an amendment by Directive 2018/843 (MLD5) ‘any member of the general public’ could obtain access to certain identity information (including ‘at least’ the UBO’s name, month and year of birth, country of residence and nationality) as well as financial information (concerning the nature and extent of the beneficial interest, for instance the percentages of shares or voting rights held by the UBO). Member states may provide for access to additional information enabling the identification of UBOs, which shall include ‘at least’ the date of birth or contact details in accordance with data protection rules. For example, Belgium gave public access to information on, among others, all intermediary entities with respect to ‘indirect UBOs’, while Austria did so for UBOs’ date of birth.

Member states may build in protection measures, such as making public access to beneficial ownership information conditional upon online registration, as is required in eg Belgium. Also, a UBO could request that public access is restricted but only in exceptional circumstances (disproportionate risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation, or where the UBO is a minor or otherwise legally incapable) and on a case-by-case basis following a detailed evaluation.

By permitting public access to beneficial ownership information, the EU legislator sought to further prevent money laundering and terrorist financing by creating, via enhanced transparency, an environment less likely to be used for those purposes. In particular, such public access was meant to allow greater scrutiny of information by the civil society, contribute to preserving trust in the integrity of business transactions and of the financial system, combat the misuse of legal entities for money laundering or terrorist financing purposes (by helping investigations and through reputational effects), and facilitate the timely and efficient availability of information for financial institutions as well as authorities.

The ruling: partial invalidity of the MLD

However, it seems that the legislator’s good intentions went against other legally protected concerns.

In 2020, two requests for a preliminary ruling were brought before the CJEU to challenge public access to the Luxembourg UBO register. As a result, in a well-considered ruling of 22 November 2022, the CJEU concluded that the broad access under MLD5 whereby UBO information of EU legal entities is accessible to any member of the general public in any case, is invalid.

The CJEU first qualified such public access as a serious interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter (on private life and protection of personal data, respectively). The current framework not only enables a potentially unlimited number of persons to get insight on the material and financial situation of a UBO, but also leaves the UBO unprotected against possible abuse of its personal data which can be freely consulted, retained and disseminated.

While the prevention of money laundering and terrorist financing as such constitutes an objective of general interest that can, in principle, justify an interference with the fundamental rights of private life and protection of personal data, the CJEU observed that this is not the case as regards the principle of transparency. Indeed, this principle is primarily used to determine requirements of institutional and procedural transparency covering activities of a public nature, whereas the present case concerns disclosure of data on private persons. In this light, the CJEU held that the principle of transparency cannot be considered as an objective of general interest capable of justifying the serious interference with the fundamental rights on private life and protection of personal data.

Further, the CJEU considered that the serious interference inflicted by public access to UBO information is not limited to what is strictly necessary or proportionate to the objective pursued, and is therefore invalid because, among other things:

• the MLD5 allows for data to be made available to the general public which is not sufficiently defined and identifiable. This is apparent from the use of the expression that ‘at least’ certain data should be made public and that member states may allow access to additional, not exhaustively listed, information;
• the reported legislative difficulties in defining the condition of ‘legitimate interest’ under MLD4 (which restricted public access) or similar restrictions to public access are no reason to justify installing general public access;
• the significant increase of the interference under MLD5 is not offset by any benefits in terms of combating money laundering and terrorist financing when compared against the less intrusive regime formerly in place under MLD4; and
• the optional measures to offer some protection for UBOs (such as online registration prior to consulting the UBO register or restrictions of public access in exceptional cases) are not sufficient to solve the issues identified.

Implications of the ruling: what’s next?

Across the EU, member states are reflecting on, or indeed applying first aid measures to comply with the ruling (which can be invoked before member states’ courts and tribunals). Provisions of national law providing for public register access are not invalid directly as a result of the ruling but member states’ legislators will need to amend such provisions accordingly. Existing rules have to be interpreted in accordance with EU law and, to the extent that they are incompatible therewith, authorities will not apply them.

The Belgian UBO register announced that access by members of the general public has been temporarily suspended and that a solution to allow access will be communicated shortly. Similarly, in Austria the service for the provision of UBO excerpts to the general public has discontinued and in the Netherlands no excerpts are delivered at all. Luxembourg has shut down any access to its UBO register. Official communications have been made, for instance in the Netherlands where the minister of Finance has informed the parliament and circulated a press release, and in Austria where the Ministry of Finance has communicated that section 10 of the Austrian Beneficial Owner Register Act (WiEReG) on public access is not to be applied and that the requirements under Articles 5 and 6 of the EU General Data Protection Regulation are no longer met. The German UBO register also issued a press release confirming that it will no longer approve requests from the general public while clarifying that requests based on legitimate interests will still be granted. Comparable measures may be expected to follow in other EU member states.

We note that the ruling only affects the conditions under which member states must make UBO information available for the general public. It does not aim to affect the existing access to UBO information by authorities or obliged entities conducting costumer due diligence to prevent money laundering and terrorist financing. Similarly, the existing AML/CTF obligations of obliged entities, the obligations of legal entities to identify their UBOs and submit UBO-related information to registers, and obligations of UBOs to support therewith remain unchanged.

In a statement published after the ruling, the CJEU confirmed that the ruling only affected the above-mentioned MLD5 amendment (providing access for ‘the general public’), turning clocks back to the MLD4 regime (limiting access on legitimate interest-base). To remove all doubt the court explicitly stated that, following its ruling, access to UBO information is still allowed ‘for persons and organisations with a legitimate interest, including the press and certain organisations in society.’ The same is true of the persons who wish to know the identity of the UBO of a company or other legal entity because they are likely to enter into transactions with them.

The EU is working on a new AML/CTF legislative package (for further information see our blogpost, 2021 podcast and 2022 podcast), including a directive (dubbed ‘MLD6’) which is intended to replace the current MLD.  While the legislative proposal of the European Commission still provides for access to register information on the beneficial ownership of legal entities to any member of the general public, the Council position published on 7 December 2022 already reflects the ruling and limits such access to cases of legitimate interest.

We will closely monitor upcoming developments and keep you informed. Please do not hesitate to get in touch if you would like to discuss any of the topics raised in this blogpost.