The European Union's approach to beneficial ownership transparency has been one of the most consequential regulatory developments of the past decade. The Anti-Money Laundering Directives — particularly AMLD4 (2015) and AMLD5 (2018) — required member states to establish registers of beneficial owners for companies and other legal entities, and AMLD5 required those registers to be publicly accessible. By late 2022, most EU member states had implemented public UBO registers.
Then, in November 2022, the Court of Justice of the European Union (CJEU) issued its landmark judgment in the joined cases of WM v Luxemburger Gesellschaft and Sovim SA v Luxembourg Business Registers. The Court ruled that the provision of AMLD5 requiring public access to beneficial ownership registers was invalid as it disproportionately interfered with the fundamental rights to privacy and data protection under the EU Charter. The impact was immediate and significant.
The CJEU WM Ruling: What It Said
The Court's reasoning centred on the proportionality of public access. While beneficial ownership transparency serves the legitimate aim of preventing money laundering and terrorist financing, the Court found that making UBO information accessible to "any member of the general public" — without requiring those accessing the information to demonstrate any legitimate interest — went beyond what was strictly necessary for that purpose.
The ruling did not invalidate UBO registers themselves. It invalidated specifically the requirement for unrestricted public access. The consequence was immediate: Luxembourg suspended public access to its UBO register within hours of the ruling; the Netherlands, Belgium, Ireland, and most other EU member states followed, closing public access pending legislative response.
Key distinction: The CJEU ruling affected public access — the ability of anyone with an internet connection to search for a beneficial owner. It did not affect the obligation of companies to maintain and disclose UBO information, the access rights of competent authorities and FIUs, or the obligation of obliged entities (including CSPs) to apply CDD to identify beneficial owners.
The Current Position Across Key EU Jurisdictions
Luxembourg
Luxembourg was the first jurisdiction to restrict public access following the ruling. The Luxemburg UBO register (Registre des bénéficiaires effectifs, RBE) remains operational, and companies must continue to file and update beneficial ownership information. Access is now restricted to competent authorities, obliged entities carrying out CDD, and persons/organisations demonstrating a "legitimate interest." The definition of legitimate interest is being developed through case law and regulatory guidance.
Netherlands
The Netherlands suspended public access to its UBO register (held by the Chamber of Commerce, KVK) following the ruling. The Dutch government subsequently implemented access restriction legislation. Obliged entities — including financial institutions and CSPs carrying out CDD — retain access. Law enforcement and other competent authorities retain full access. Private individuals must demonstrate legitimate interest.
Belgium
Belgium restricted public access pending legislative clarification. The Belgian UBO register continues to be maintained and obliged entities retain access for CDD purposes. The federal government has been working on legislation to define the legitimate interest categories for public access.
Ireland
Ireland suspended public access to its register of beneficial ownership (RBO) following the ruling. Companies House (CRO) continues to maintain the register and obliged entities can access it. Ireland's legislative response has included a tiered access framework.
What Has Not Changed for CSPs
Despite the public access restrictions, the core obligations for CSPs remain unchanged:
- CDD obligations: CSPs must still identify and verify the beneficial owners of client entities at the 25% threshold (or lower in enhanced due diligence contexts). The UBO register's inaccessibility to the public does not affect this requirement.
- Registry obligations: Companies remain legally required to identify their beneficial owners and file that information with the relevant registry. Non-compliance carries penalties.
- Obliged entity access: CSPs acting as financial institutions or DNFBPs under AMLD continue to be entitled to access UBO register information for CDD verification purposes.
- Information accuracy: The obligation to keep register information accurate and up to date is unaffected. Changes in beneficial ownership must be reported within the prescribed timeframe (typically within 30 days in most jurisdictions).
The AML Package: Looking Ahead
The EU's legislative response to the CJEU ruling is embedded in the new AML Package, which includes the Anti-Money Laundering Regulation (AMLR) and the establishment of a new EU Anti-Money Laundering Authority (AMLA). This package represents the most comprehensive overhaul of EU AML law since AMLD4.
Under the proposed framework:
- UBO register information will remain accessible to obliged entities and competent authorities
- Public access will be restricted to persons demonstrating legitimate interest — journalists, civil society organisations, and specific investigative purposes
- Interconnection of EU member state UBO registers through a central platform will continue, improving cross-border access for competent authorities
- Beneficial ownership thresholds and disclosure requirements will be harmonised across member states
AMLA is expected to begin operations in Frankfurt in 2025 and will have direct supervisory powers over certain high-risk financial institutions from 2026.
CSP Operational Implications
For CSPs servicing EU-connected entities or operating within the EU, the practical implications are:
- UBO verification cannot rely solely on public register searches — enhanced document collection from clients remains necessary
- CSPs must maintain their own internal beneficial ownership records that accurately reflect current ownership — register data alone is insufficient for CDD purposes
- Clients with complex or multi-jurisdictional EU holding structures should be engaged on register accuracy, as the consequence of inaccurate filings includes regulatory penalties in multiple member states
- Monitor legislative developments in each EU member state — the timeline for implementing legitimate interest access frameworks varies across jurisdictions
The CJEU ruling has created a more complex regulatory landscape for UBO transparency — but not one that reduces CSPs' obligations. If anything, the limitation on public access reinforces the importance of CSPs' own CDD processes as the primary mechanism for verifying beneficial ownership. The fundamental obligation to know your client has not changed; the public information shortcut has become less reliable.