As pressures grow on governments around the world to increase corporate transparency and disclosure, beneficial ownership registers have come to play an important role in combatting money laundering, terrorist financing, and sanctions and tax evasion by requiring companies and other legal entities to disclose who ultimately owns or controls an asset.  Sunlight is the best disinfectant, and all that.

In the European Union, since the beginning of 2020 the Fifth Money Laundering Directive (5MLD) requires Member States to facilitate public access to beneficial ownership information, including at least the names, month and year of birth and country of residence and nationality and nature of interest of the beneficial owners of an entity.  Previously, under the Fourth Money Laundering Directive (4MLD), this had been limited to access by “any person or organization that can demonstrate a legitimate interest”.

While Member States may require online registration and charge a fee for public access to this information, this change significantly increased the scope of people able to view the information.  In Luxembourg, following 5MLD implementation, access to this information was initially unrestricted and more recently made available following online registration and payment of a fee.

On Tuesday, the Court of Justice of the European Union ruled that the national beneficial ownership law that implements the 5MLD in Luxembourg is too transparent, such that it breaches Articles 7 and 8 of the EU’s Charter of Fundamental Rights (the rights to respect for private and family life, home and communications, and protection of personal data, respectively).  The judgment could have significant ramifications on the use of corporate ownership information in a range of circumstances, from AML and KYC to transactional diligence, sanctions screening, and background checks.  In a nutshell, the CJEU found:

  • The general public’s access to information on beneficial ownership constitutes a serious interference with an individual’s Article 7 and 8 rights.  For example, depending on the type of personal data contained in the register, it may be possible to determine an individual’s wealth and investment activity — resulting in, as one of the claimants argued before the CEJU, a risk of fraud, kidnapping, extortion, harassment, violence or intimidation.
  • However, maintaining national ownership registers can be appropriate for contributing to the prevention of money laundering and terrorist financing, even where doing so seriously interferes with an individual’s Article 7 and 8 rights.  Crucially, this interference must be limited to what is strictly necessary and proportionate to the objective pursued — which in this case it was not, given (1) the type of information required by the Luxembourg law, and (2) the degree to which such information was accessible and subject to dissemination.
  • The safeguards built into 5MLD — namely (1) the possibility of restricting public access by requiring registration and a fee, and (2) the exemptions in exceptional circumstances where public access would expose the beneficial owner to disproportionate risk (which exemption one of the claimants attempted to rely on and failed) — were not sufficient to balance the AML objective with the beneficial owners’ fundamental rights.

In the UK, similar requirements are mostly met by the register of people of significant control (PSC) at Companies House.  The public is able to access this information freely online without charge, although the disclosures are more limited (for example, if a PSC is an unlisted foreign company, then disclosures regarding its ownership do not have to be made).  Additionally, at the time of implementation, Companies House lacked the resources and mechanisms to ensure that the information on the register was adequate, accurate and current.

Although courts in the UK aren’t bound to follow the CJEU’s post-Brexit case law, it can have interpretive value in areas that are under dispute in English law, such as around the lawfulness of the U.S. Foreign Account Tax Compliance Act.  More significantly, the decision may also give litigants the impetus to challenge the UK’s beneficial ownership register regime, which does in some cases — and likely soon will in others — apply to companies, properties and land, and trusts.  In light of this judgment, the third reading of the UK’s Economic Crime and Corporate Transparency Bill 2022, which proposes significant reforms to Companies House, is likely to be even more interesting.

Within 48 hours of the CJEU ruling, the online registers in Luxembourg and Netherlands were closed to public access, with other countries perhaps to follow.  The European Commission has stated that it is considering the judgment and its next steps, which may see a reversion to the position under 4MLD in which a legitimate interest must be demonstrated to access registry information.  Whilst the onus is now on the Commission and national governments to change their practices to comply with the CJEU’s ruling, it will be interesting to see whether companies receive an increase in access, rectification and deletion requests from individuals on whom they have run AML or sanctions checks or otherwise conducted diligence for corporate transactions or investigations using the Luxembourg register.

Many British Overseas Territories will also be considering the implications of this decision carefully. Previous commitments to promote transparency in offshore jurisdictions by creating public ownership registers may now be watered down to follow the tide of European privacy laws.