In brief

On 22 November 2022, the Court of Justice of the European Union (CJEU), sitting as the Grand Chamber, rendered a landmark decision on the validity of the Luxembourg provisions of the law of 13 January 2019, establishing the register of beneficial owners (RBO) (“RBO Law“) and implementing the EU anti-money laundering directives.

According to the CJEU, the provision, whereby the information on the beneficial ownership of companies incorporated within the territory of the member states is accessible in all cases to any member of the general public, is invalid.

The CJEU’s ruling stems from a claim brought by a Luxembourg company and its beneficial owner in the Luxembourg District Court, after the relevant authority refused to restrict the public’s ability to access their information held on the RBO.

The CJEU held that the “public access” feature of the RBO Law constitutes an interference with the rights guaranteed by the Charter of Fundamental Rights of the European Union (“EU Charter“), more specifically that it constitutes a serious interference with the fundamental rights to private life and to the protection of personal data. The RBO Law’s interference with the rights guaranteed by the EU Charter is neither limited to what is strictly necessary nor proportionate to the objective of preventing anti-money laundering and terrorist financing.

The impact of this decision on any beneficial owner having personal information available to the general public in one or more of the EU member states’ registers should be assessed, to the extent the member state considered has implemented similar provisions.

For further information on what these developments mean for your organization, please get in touch with your usual Baker McKenzie contact.

In more detail

Facts

The RBO Law establishes an RBO and provides that information on the beneficial owners of registered entities must be entered and retained in that register.

Some of that information is accessible to the general public, particularly via the internet. The RBO Law provides that a beneficial owner can request that the Luxembourg Business Registers (LBR), the administrator of the RBO, restrict access to all or part of the information relating to the beneficial owner on a case-by-case basis, if the access to this information would expose the beneficial owner to disproportionate risk, risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation, or where the beneficial owner is a minor or otherwise legally incapable.

The beneficial owner of a Luxembourg company requested that access to their information be restricted from the general public based on that exemption. The request was rejected. The Luxembourg District Court in charge of the case decided to refer to the CJEU for a preliminary ruling. The main issue here was determining whether Article 30 paragraph 5 c) of Directive (EU) 2018/843 of 30 May 2018, amending Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, and amending Directives 2009/138/EC and 2013/36 EU (“Fifth AML Directive“) that provide for public access to information on beneficial owners, is valid in light of Articles 7 and 8 of the EU Charter (that refer respectively to the respect for private life and the protection of personal data).

The CJEU’s findings

The CJEU ruled that Article 30 paragraph 5 c) of the Fifth AML Directive granting the general public access to information on beneficial ownership is invalid. The main findings of the decision are as follows:

The general public’s access to information on beneficial ownership constitutes a serious infringement of fundamental rights.

The provision constitutes an interference with fundamental rights: Article 30 paragraph 5 of the Fifth AML Directive with regard to making personal data available to the general public constitutes an interference with the fundamental rights enshrined in Articles 7 and 8 of the EU Charter. The judges exclude the argument according to which the general public’s access to information on beneficial ownership could be justified by the fact that the data is related to professional activities.
Seriousness of the interference with fundamental rights: The CJEU also highlights the seriousness of the interference, as the information relates not only to the identity of the beneficiary but also to the nature and extent of the beneficial interest held in corporate or other legal entities, allowing anyone to draw a profile of the beneficial owner and determine its state of wealth, and the economic sectors, countries and specific undertakings in which it has invested. The judges pointed out that unlimited access to this information may lead to abuse, especially when the information is freely accessible on the internet, as is the case in Luxembourg.

The interference with fundamental rights may be deemed appropriate but it is unnecessary and disproportionate compared to the objective pursued.

The CJEU found that the EU legislature seeks to prevent money laundering and terrorist financing by creating, by means of increased transparency, an environment less likely to be used for those purposes. It held that the legislature thereby pursues an objective of general interest, capable of justifying even serious interferences with the fundamental rights enshrined in Articles 7 and 8 of the EU Charter, and that the general public’s access to information on beneficial ownership is appropriate for contributing to the attainment of that objective.

However, the interference entailed by the measure under examination is neither limited to what is strictly necessary nor proportionate to the objective pursued.

The regime introduced by the Fifth AML Directive amounts to a considerably more serious interference with the fundamental rights guaranteed by Articles 7 and 8 of the EU Charter than the former regime: The CJEU recalled that the former version of Article 30 paragraph 5 limited access to information on beneficial owners to persons able to demonstrate a “legitimate interest” and went on to explain that the reason for the withdrawal of the limitation was the result of difficulties encountered by the EU Commission in reaching a consensus on the definition of “legitimate interest.” The fact that it may be difficult to provide a detailed definition of the circumstances and conditions under which legitimate interest exists is no reason for the EU legislature to provide for the general public to access the information in question.
The optional provisions of the Fifth AML Directive that allow member states to make information on the beneficial ownership available on the condition of online registration and to provide, in exceptional circumstances, for an exemption from access to that information by the general public need to be revisited: According to the CJEU, these provisions are not, in themselves, capable of demonstrating either a proper balance between the objective of general interest pursued and the fundamental rights enshrined in Articles 7 and 8 of the EU Charter, or the existence of sufficient safeguards enabling data subjects to protect their personal data effectively against risk of abuse.

In practice

For Luxembourg and other EU member states

Based on the decision, member states may have to reintroduce a limitation on the access to information on beneficial owners. To determine the framework of the limitation, the EU Commission is currently reviewing the decision.

The Luxembourg Ministry of Justice, in consultation with the LBR, decided to temporarily suspend public access to the RBO via the internet portal of the LBR services. The Luxembourg government has stated that it will closely liaise with the EU Commission to discuss the consequences of the decision and the solutions that may be envisaged at the EU level.

For any beneficial owner of a company incorporated within the EU

For any beneficial owners residing in the EU or abroad, where applicable, reference to this decision can possibly be made to request an exemption of the general public’s access to their information. Beneficial owners may wish to act to protect their personal data and seek for the exemption to apply in their case, to the extent that the member state considered has implemented similar provisions.

For the UK

As the UK is no longer a member of the EU, this decision of the CJEU is not legally binding. However, since leaving the EU, the UK has continued to implement several transparency measures, including the creation of the Register of Overseas Entities. The CJEU’s recent decision is relevant to the UK, as it highlights the tension between transparency on the one hand and an individual’s right to privacy and data protection on the other. It remains to be seen how this decision will impact on the UK’s broader policy in this area. One possible result is that, in the longer term, the UK may limit the public’s ability to access information about beneficial owners on the Persons with Significant Control (PSC) register and the Register of Overseas Entities, to ensure that the UK maintains a competitive advantage in Europe. Alternatively, it may be that some beneficial owners required to register on the UK’s PSC register and Register of Overseas Entities will seek to challenge the regimes on similar grounds through the UK courts.

In addition, this decision may impact on the beneficial ownership registers in Britain’s Overseas Territories (such as Bermuda and the Cayman Islands). In 2018, the UK Parliament legislated that each of the Overseas Territories must establish a publicly accessible register of the beneficial ownership of companies registered in its jurisdiction. The rationale was that, by making the registers public, it would increase the level of scrutiny on these entities and so reduce the scope for them to be used for the purposes of financial crime. The recent decision from the CJEU may prompt the Overseas Territories to restrict (or seek to restrict) public access to the information on these registers, either in part or completely.

Relevant developments in the United States

The decision comes after legislative and regulatory movement in the United States towards the introduction of a federal beneficial ownership register from 1 January 2024 applicable to corporations, limited liability companies and other similar entities. Unlike the now-invalidated requirements of the Fifth AML Directive, the US register will not be available to the public in any form, with access by request limited to US law enforcement agencies, non-US governments via an applicable treaty and financial institutions for due diligence purposes. Companies and entities impacted by this new register may wish to discuss the potential reporting obligations with their advisers and potential beneficial owners.

Conclusion

Based on this landmark decision, certain limitations on the access to information on beneficial owners will need to be reintroduced. Without providing any further guidance on these limitations, the CJEU requires that the interference with the fundamental rights that may occur be appropriate, necessary and proportionate. While awaiting an amendment to the Fifth AML Directive, beneficial owners should act to protect their personal data and seek for the exemption to apply to them. For further information on what these developments mean for your organization, please get in touch with your usual Baker McKenzie contact.