Talk to usTry the demo

Beneficial Owner Registers in the EU: Access After the Court of Justice Judgment and Under the New AML Package

Regulation and standards

For: Compliance officer, investigator or product owner who needs beneficial ownership data and has to know who is allowed to see it

Why public access to beneficial ownership registers was struck down in 2022, what the Court reasoned, and who may now see which data under the 2024 directive and regulation.

For information; not legal advice.

If you work with company ownership data in Europe, the rules on who may read the beneficial ownership register changed twice: once when the Court of Justice struck down public access in November 2022, and again when the 2024 anti-money laundering package replaced it with access for those who can show a legitimate interest. This article follows that line from the judgment to the new text. It does not repeat the definition of a beneficial owner, the ownership threshold or the identification cascade, which the article on beneficial ownership under the FATF standard and EU texts sets out. It is about the register: who may see it, what they see, and why.

Where the rule came from

Before 2018, the access rules for registers of beneficial owners under the Fourth Directive gave competent authorities and financial intelligence units unrestricted access, gave obliged entities access within customer due diligence, and gave other persons or organisations access if they could demonstrate a legitimate interest. Directive (EU) 2018/843, the amending directive usually called the Fifth Directive, changed the third group. Its Article 1(15)(c) amended Article 30(5) of Directive (EU) 2015/849 so that Member States had to ensure that the beneficial ownership information of companies and other legal entities was accessible in all cases to any member of the general public.

The Court records why. The Commission and the Council explained that an impact assessment had found that the lack of a uniform definition of "legitimate interest" had caused practical difficulties, so the condition was removed. The recitals of the amending directive give the policy reasons: public access allows greater scrutiny by civil society, including the press, contributes to preserving trust in the integrity of business transactions, can help to combat the misuse of corporate vehicles through investigations and reputational effects, and facilitates the availability of information for financial institutions and authorities.

The judgment of 22 November 2022

The Grand Chamber of the Court of Justice decided joined Cases C-37/20 and C-601/20 on 22 November 2022. The cases came from the Luxembourg District Court. In the first, WM challenged the refusal of Luxembourg Business Registers to prevent public access to the information that WM is the beneficial owner of a real estate company; in the second, Sovim SA made the same challenge for its own beneficial owner.

The question for the Court was the validity of the provision that required public access, read against Articles 7 and 8 of the Charter of Fundamental Rights, which protect respect for private and family life and the protection of personal data. It is useful to follow the reasoning in the order in which the Court took it, because it shows what a replacement rule had to avoid.

First: an interference, and a serious one

The Court restated that making personal data available to third parties is an interference with Articles 7 and 8 of the Charter whatever the subsequent use of the information. It then explained why this one is serious. The information identifies the beneficial owner and the nature and extent of the beneficial interest, so it is capable of enabling a profile to be drawn up concerning the person's wealth and the economic sectors, countries and undertakings in which he or she has invested. Public availability makes the information accessible to a potentially unlimited number of persons, including those who seek it for reasons unrelated to the objective of the measure, and the risk is all the greater where the data can be consulted on the internet. Once data are public they can be retained and disseminated, so that it becomes increasingly difficult, or even illusory, for data subjects to defend themselves against abuse. The Court concluded that general public access constitutes a serious interference.

Second: legality and essence were not the problem

The Court found that the principle of legality was fulfilled, because the limitation was provided for by an EU legislative act which listed the data to be made accessible and set the conditions for exemptions. It also found that the interference did not undermine the essence of the fundamental rights, noting that the data fall into two categories, identity data and economic data, and that only information adequately related to the purposes of the directive could be held and made accessible.

Third: the objective, and what is not an objective

The Court accepted that preventing money laundering and terrorist financing by creating, through increased transparency, an environment less likely to be used for those purposes is an objective of general interest capable of justifying even serious interferences. It refused a second objective. The Council had also relied on the principle of transparency as it results from the Treaty on European Union and the Treaty on the Functioning of the European Union, and the Court held that this principle cannot, as such, be an objective capable of justifying the interference, because its concrete expression concerns institutional and procedural transparency of public bodies and not the identity of private beneficial owners.

Fourth: appropriate, but not strictly necessary

The Court held that public access is appropriate for contributing to the objective. It then held, in paragraph 76, that the interference is not limited to what is strictly necessary. Three points in the reasoning bear on the replacement rule.

  • The Court addressed the argument that "legitimate interest" is hard to define. In paragraph 72 it said that the difficulty of providing a detailed definition of the circumstances and conditions of access is no reason for the legislature to give the general public access.
  • In paragraph 74 it said that the press and civil society organisations connected with the prevention and combating of money laundering and terrorist financing have a legitimate interest in accessing the information, as do persons who wish to know the identity of the beneficial owners of a company because they are likely to enter into transactions with it, and financial institutions and authorities that do not already have access.
  • It compared the two regimes: in paragraph 85 it described the regime with general public access as a considerably more serious interference than the earlier one with access for persons demonstrating a legitimate interest, without any benefit that could offset the increase.

Fifth: clarity, balance and safeguards

On proportionality the Court found that the text did not meet the requirement of clarity and precision. The open-ended words at least in the list of data accessible to the public allowed data to be made available that were not sufficiently defined and identifiable, as it said in paragraph 82. It balanced the seriousness of the interference against the objective and noted that combating money laundering is as a priority a matter for the public authorities and for entities such as credit or financial institutions, which is why the directive provides access in all cases to competent authorities and financial intelligence units without restriction, and to obliged entities within customer due diligence, as it said in paragraph 84. It added that the optional provisions allowing Member States to require online registration and to grant exemptions in exceptional circumstances were not in themselves capable of demonstrating a proper balance or sufficient safeguards, in paragraph 86.

The ruling

In paragraph 88 and the operative part, the Court declared Article 1(15)(c) of Directive (EU) 2018/843 invalid in so far as it amended point (c) of the first subparagraph of Article 30(5) of Directive (EU) 2015/849 in such a way that Member States must ensure that beneficial ownership information is accessible in all cases to any member of the general public. The ruling is narrow in one direction and wide in another. It does not touch access by competent authorities, financial intelligence units and obliged entities, and the Court said in terms that those remained the priority channel. But it did not create a list of who else may be admitted: it only held that unrestricted access fails.

What happened at once: Luxembourg

The judgment came from a Luxembourg case, and Luxembourg acted first. The Ministry of Justice reported that, following the suspension of public access to its register, access was restored on 16 December 2022 for the professionals covered by the national money laundering law who apply to the register operator. For the press, access was restored through an agreement concluded on 20 December 2022 under which the national press council can grant access to holders of professional press cards, justified by the legitimate interest of the press that the Court confirmed. The ministry said it was studying, with the register operator, the conditions for restoring access for other actors with a legitimate interest and a link to the fight against money laundering, and that national competent authorities kept dedicated access through an intranet portal. The sequence is instructive: the register closed to the public after the judgment, and access came back category by category over the following weeks, so a data user who relied on open access had no stable feed in between.

A second national example: the Netherlands

The Dutch Chamber of Commerce (KVK) shows what a tiered register looks like in operation. Its page on access to the register of beneficial owners of companies, edited on 26 October 2026, says that not everyone has access, and that a beneficial owner can look up their own data while an organisation with registered owners can see its own registration. The page describes three access levels, each with its own set of data that an organisation can view and download. The first level covers organisations such as chartered accountants, lawyers and trust companies named in the national money laundering act, and insurers and pension funds named in the sanctions act. At that level the visible data are the type and scope of the interest and, unless the person's data are shielded, the name, month and year of birth, country of residence and nationality. The second level covers the organisations listed in the financial supervision act, such as banks, investment firms, electronic money institutions and payment services agents. The third level covers the financial intelligence unit and competent authorities such as the central bank, the Netherlands Authority for the Financial Markets, the tax administration and the police.

Shielding is part of the design. A beneficial owner who is a minor, under police protection or under guardianship can ask for their data to be hidden, and when that happens organisations at the first level see only the type and extent of the person's interest.

The judgment is acknowledged on the same page. KVK states that a ruling of the Court of Justice of the European Union closed part of the register, that it is gradually making access possible again, and that since the second quarter of 2026 online ordering with a national electronic identification has become available again and an interface for software connections exists. In the meantime an organisation can order an extract of its own beneficial owner data, and the institutions that enforce the money laundering act and the sanctioning bodies can obtain that extract through their clients, for example during client research. KVK also explains why not every obliged entity is admitted: it may grant access only to organisations that are objectively identifiable, which it defines as holding a licence from, or being registered with, a supervising authority or a mandatory professional body.

For a data user, the practical point is that the same register returns different fields to different callers, and that access can be restored in steps, sector by sector, years after the ruling.

The position before the new text: the data protection supervisor

In September 2021, before the judgment, the European Data Protection Supervisor gave its opinion on the legislative package. It said that beneficial ownership information should only be accessible for the purpose of preventing money laundering and terrorist financing to competent authorities in charge of enforcing the law and to obliged entities taking customer due diligence measures. It acknowledged that non-governmental organisations, the press and investigative journalism contribute to drawing the public's attention to phenomena relevant for enforcement, but considered that access motivated by other objectives of general interest, such as enhancing transparency, should be treated as a different right to obtain information, requiring a separate assessment of necessity and proportionality and a distinct set of rules. The Court later went one step further in a single respect: it said that the press and civil society organisations connected with preventing money laundering do have a legitimate interest, which the supervisor had treated as a separate question.

The replacement: the 2024 directive

The new framework has two instruments. The Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, defines beneficial owners and the duties of obliged entities and of the entities themselves. The Directive, Directive (EU) 2024/1640, governs the central registers and access to them. Its recitals begin from the judgment: the Court annulled the amendment of Article 30(5), and, to ensure legal clarity, the provision is adapted by clarifying that only persons or organisations with a legitimate interest should be able to access the information, and the same condition applies to trusts and similar legal arrangements.

What the register holds

Article 10 requires Member States to hold, in a central register, the beneficial ownership information required by the Regulation, the statement where no beneficial owner can be identified, and information on nominee arrangements. The information must be available in machine-readable format. Where no beneficial owner is identified, the register includes a statement that there is no beneficial owner or that the beneficial owners could not be determined, with a justification, and the details of the senior managing officials.

The Directive also makes the register responsible for quality. Entities in charge of the registers verify, within a reasonable time after submission and on a regular basis, that the information is adequate, accurate and up to date. They have to act within 30 working days of a reported discrepancy to resolve it, they can carry out checks including on-site inspections, they can withhold or suspend the certificate of proof of registration when the verification finds errors, and they have to check against targeted financial sanctions and show an indication of association with designated persons. Registers are interconnected through the European Central Platform established by Article 22(1) of Directive (EU) 2017/1132, and the information stays available for 5 years after a legal entity is dissolved, with a possible additional period of up to 5 years in specific cases.

Who sees what: three tiers

Tier one: authorities. Article 11 gives competent authorities immediate, unfiltered and direct access, without charge and without alerting the legal entity. The list includes supervisors, self-regulatory bodies in their supervisory functions, tax authorities, authorities responsible for restrictive measures, the new European anti-money laundering authority, the European Public Prosecutor's Office, the European Anti-Fraud Office, and Europol and Eurojust when they support national authorities.

Tier two: obliged entities. Article 11(3) says that, when taking customer due diligence measures under the Regulation, obliged entities shall have timely access to the information in the interconnected registers. Member States may charge a fee that is limited to what is strictly necessary to cover the cost of ensuring the quality of the information and making it available, and fees may not undermine effective access. This is the access that the Regulation presupposes when it tells obliged entities to verify beneficial owner information by consulting the central registers.

Tier three: persons with a legitimate interest. Article 12(1) gives any natural or legal person who can demonstrate a legitimate interest in preventing and combating money laundering, its predicate offences and terrorist financing access to a defined set of data, without alerting the entity. The set is: the name of the beneficial owner; the month and year of birth; the country of residence and the nationality or nationalities; for beneficial owners of legal entities, the nature and extent of the beneficial interest held; and for beneficial owners of express trusts or similar arrangements, the nature of the beneficial interest. The Directive lists the fields one by one and has no open-ended at least, which is the wording the Court criticised. Compare it with what the Regulation requires a legal entity to report to the register: all names, the place and full date of birth, the residential address, the number of the identity document and, where it exists, a personal identification number. None of those extra fields is in the set that the third tier may see. The list is also close to the one that the Fourth Directive gave to persons with a legitimate interest before 2018: the name, the month and year of birth, the nationality, the country of residence, and the nature and extent of the interest held. What changed is the procedure around the list, not the list.

Certain categories are deemed to have a legitimate interest. Article 12(2) lists, among others, persons acting for journalism or other forms of expression in the media connected with the prevention or combating of money laundering; civil society organisations, including non-governmental organisations and academia, connected with it; persons likely to enter into a transaction with a legal entity who wish to prevent any link with money laundering; entities subject to anti-money laundering requirements in third countries, and third-country counterparts of the Union's competent authorities, when they show the need; the authorities in charge of company registration and of scrutinising conversions, mergers and divisions; programme authorities for Union funds and for the Recovery and Resilience Facility; public authorities in public procurement, in respect of tenderers; and providers of anti-money laundering products, to the strict extent that their products are provided only to customers that are obliged entities or competent authorities and the provider can demonstrate the need in the context of a contract. Other persons who can demonstrate a legitimate interest are granted access on a case-by-case basis. For the press, civil society organisations and third-country counterparts of Union authorities, historical information, including on entities dissolved in the preceding 5 years, and a description of the control or ownership structure are also available.

The list mirrors paragraph 74 of the judgment: press, civil society, persons likely to transact, and authorities, each of which the Court had named.

How the interest is checked

Article 13 turns the legitimate interest from a concept into a procedure, which is the answer to the argument in the impact assessment that the concept could not be applied uniformly.

  • The register verifies the interest on the basis of documents, information and data from the applicant, taking into account the applicant's function or occupation and, except for journalists and civil society organisations, the connection with the specific legal entities or arrangements sought.
  • The register verifies the applicant's identity whenever they access it, and Member States must allow electronic identification means and qualified trust services for that purpose.
  • A verified interest is portable: where another Member State's register has verified the interest under one of the listed categories, the proof it issues satisfies the check on function or occupation.
  • From 10 November 2026 the register must verify and answer within 12 working days, with possible extensions of 12 working days when requests surge; when access is granted the register issues a certificate granting access for 3 years, and responds to later requests by the same person within 7 working days.
  • The register may refuse only on listed grounds, such as missing documents, no demonstrated interest, a reasonable concern that the data will not be used for the purposes requested, or an exemption under Article 15, and it must give reasons and the right of redress; access may be revoked. The register may re-verify the function or occupation from time to time, and in any case not earlier than 12 months after access is granted, unless it has reasonable grounds to believe that the legitimate interest no longer exists, in which case it may check earlier.
  • Member States may charge a fee limited to what is strictly necessary to cover the cost of ensuring the quality of the information and making it available.

Protection of the beneficial owner

Two safeguards answer the Court's concern about abuse. First, registers keep records of the persons who access the data and can disclose them to the beneficial owner on a data protection request, except that the information provided must not identify journalists or civil society organisations, for whom the beneficial owner is told the function or occupation of those who consulted the data. Second, Article 15 requires an exemption from access, in exceptional circumstances laid down in national law, where access would expose the beneficial owner to a disproportionate risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation, or where the beneficial owner is a minor or otherwise legally incapable; the exemption is granted case by case after a detailed evaluation, with a right to administrative review and to an effective judicial remedy. An exemption does not apply to obliged entities that are public officials.

Dates

The Directive has staggered transposition dates. Articles 11, 12, 13 and 15, the access rules, had to be brought into force by 10 July 2026, and most of the rest of the Directive is due by 10 July 2027. The Directive's recitals add that, because the first months of the new regime would see a peak of requests, the response deadlines should not apply for the first 4 months of application. That is consistent with Article 13(6), under which the 12-working-day deadline starts on 10 November 2026. The Regulation, by contrast, applies from 10 July 2027. National laws differ in detail, and whether your country has transposed the access rules, and which register interface works in practice, are facts to check in the national source and not to infer from the Directive.

What this means in practice

If you are an obliged entity, your access is the second tier, and it is attached to the performance of customer due diligence. The Regulation's recitals say that consulting the registers lets an obliged entity check consistency with what it learned through its own verification, and should not be the primary source for verification. Article 22 adds the register consultation on top of the other means of verifying a beneficial owner. Where the register differs from what the customer declared, Article 24(1) requires the entity to report the discrepancy without undue delay and in any case within 14 calendar days of detection. Article 24(2) lets the entity refrain from reporting, and ask the customer for more information instead, in two cases: the discrepancy is limited to typographical errors, different ways of transliteration or minor inaccuracies that do not affect the identification of the beneficial owners or their position, or it results from outdated data while the beneficial owners are known to the entity from another reliable source and nothing suggests an intention to conceal information. That relief does not apply to cases of higher risk that call for enhanced due diligence, and where the entity concludes the register is incorrect it must invite the customer to correct it within 14 calendar days, failing which it reports. So build the register lookup into the due diligence step, store what the register returned with the date, and treat a mismatch as a discrepancy to resolve or report.

If you supply data to obliged entities, the list of persons with a legitimate interest contains a category for providers of anti-money laundering products, with strings attached: the products must be provided only to obliged entities or competent authorities, and the provider must demonstrate the need under a contract. That is not a general licence to republish the register.

If you are neither, you may qualify under the category for persons likely to enter into a transaction with an entity, or under the case-by-case rule, and you should expect to prove who you are, to prove the connection to a specific entity, and to be logged.

If you are the beneficial owner, your data is visible to more people than the public used to be able to see in some respects, and to fewer in others: the third tier sees a closed list of fields and is recorded and identified, with the exception for journalists and civil society organisations.

Questions to put to your own design

  • Which tier of access does each of your processes rely on, and is the legal basis for it documented?
  • What do you do when a register is unavailable in a country, or access requires an application with a lead time?
  • Do you store the register response, the date and the register's own identifier of the entity?
  • How do you separate the data that obliged entities collect from the closed list that the third tier may see, when you show a result to a user?
  • Who answers a request from a beneficial owner who asks who consulted their data?

Where this sits in a verification flow

The registers give you names and attributes of beneficial owners; they do not tell you that the person in front of you is that owner. Verifying the individual is the part a verification session does. The face match step compares the selfie with the portrait on the document in a one-to-one comparison, and includes foreign-face detection and an age check against the date of birth. The liveness step is active: the person moves the face closer through two ovals.

To see how these steps look in your own scenario, contact the team.

Sources

All sources were fetched on 27 October 2026.

Ready to talk?

Tell us what you are building and we will help you plan the integration.

Talk to us