Beyond the Register: Beneficial Ownership, Privacy and the New Due-Diligence Problem

The EU has not abandoned beneficial-ownership transparency. It has changed who may obtain personal beneficial-ownership information, on what basis, and with what safeguards.

In November 2022, the Court of Justice of the European Union invalidated the rule that made company beneficial-ownership information available in all cases to any member of the general public. The Court held that unrestricted access through the internet created a serious interference with privacy and data-protection rights that was not limited to what was strictly necessary. ¹

The practical consequence is often misunderstood. The judgment did not abolish beneficial-ownership registers and it did not remove the need to identify ultimate owners and controllers. The EU's later AML framework instead moves toward controlled access, verification and defined legitimate-interest routes. ²

What the 2022 judgment actually changed

The 2022 judgment in Luxembourg Business Registers and Sovim was about proportionality of general public access. It did not say beneficial ownership was irrelevant, confidential in every circumstance, or incapable of lawful disclosure. ¹

That distinction matters for investigations and due diligence. Privacy can limit the route by which personal ownership information is obtained without eliminating the commercial, regulatory or evidential question that ownership creates.

The EU has replaced open access with a legitimate-interest model

Directive (EU) 2024/1640 requires Member States to provide access to beneficial-ownership registers for competent authorities and obliged entities, and creates a specific route for natural or legal persons able to demonstrate a legitimate interest connected with preventing money laundering, predicate offences or terrorist financing. Articles 11, 12, 13 and 15 were subject to an accelerated transposition deadline of 10 July 2026. ²

The Directive expressly treats persons likely to enter into a transaction with a legal entity or arrangement as a category capable of legitimate-interest access for defined AML/CFT purposes. It also recognises providers of AML/CFT products in tightly defined circumstances where the information is supplied only to obliged entities or competent authorities and the provider can demonstrate the need in connection with a contract. ²

From 10 November 2026, Article 13 requires central registers to operate the specified verification process for legitimate-interest applications and ordinarily respond within 12 working days. National implementation and access mechanics remain important, so no investigator should assume that a generic commercial instruction automatically creates a right of access in every Member State. ²

The 2026 cases reinforce the privacy boundary without removing access

On 21 May 2026, the Court held in Across Fiduciaria and Unione Fiduciaria that, subject to a legitimate interest, the public may have access to beneficial-ownership information concerning Italian trust mandates that fall within the relevant AML framework. The judgment is important because it confirms that privacy and beneficial-ownership access are not mutually exclusive: access can be lawful when structured around a legitimate-interest test. ⁵

On 3 September 2026, the Court decided Jautiva, which concerned personal information about minority shareholders rather than the UBO register itself. The Court held that EU law precludes unconditional online disclosure of those shareholders' personal data where access is not subject to conditions such as legitimate interest. The judgment should therefore be described as part of the wider privacy direction of EU company information law, not as a new UBO-register ruling. ⁶

Ownership is more than finding a 25% shareholder

The new EU AML Regulation makes the identification task more demanding, not less. It requires ownership interests and control through other means to be considered in parallel. It addresses indirect interests, multiple ownership chains, multi-layered structures and control that can arise through voting rights, appointment rights, veto or decision rights, profit distribution, agreements, family relationships and formal or informal nominee arrangements. ³

Why EU screening now needs wider corroboration

A register remains valuable evidence, but it should not be confused with a complete due-diligence conclusion. Directive (EU) 2024/1640 itself requires mechanisms to verify that central-register information is adequate, accurate and up to date and provides for discrepancies between register information and information available to obliged entities to be reported and resolved. ²

FATF's Recommendation 24 guidance supports a multi-pronged approach to beneficial-ownership transparency, designed to combine information from more than one source or mechanism so weaknesses in a single source are less likely to determine the outcome. ⁴

National practice illustrates the access issue. The Netherlands Chamber of Commerce states that not everyone has access to its UBO register, operates different access levels and is progressively restoring access to eligible organisations following the CJEU ruling. KVK also states that the organisation filing UBO information remains responsible for its correctness and completeness. ^{7 8}

Where Carratu can help

Carratu's role is not to promise access to restricted personal data. Access to a national beneficial-ownership register depends on the relevant law, the applicant, the purpose and the facts of the instruction.

The investigative value lies in developing the wider ownership and control picture from compliant sources and testing what has been declared against independent evidence. Depending on jurisdiction and brief, that can include:

• reconstructing direct and indirect ownership chains across jurisdictions;
• identifying historical shareholders, directors, controllers, predecessor entities and corporate restructurings;
• testing declared ownership against connected-company, litigation, insolvency, regulatory and other reliable records;
• examining indicators of fiduciary, nominee, trust or related-party arrangements where supported by evidence;
• assessing control through relationships or decision rights where ownership percentages do not tell the whole story;
• resolving identities and names across jurisdictions;
• distinguishing recorded legal ownership from wider evidence of beneficial ownership, influence or control;
• identifying material discrepancies, gaps and areas requiring a lawful specialist or client-held access route.

Where a client, regulated professional or other qualifying party has lawful access to restricted UBO material, that material can be incorporated into the wider analysis supplied for the brief.

A practical ownership-and-control framework

1. Identify the legal entity. Confirm the exact counterparty, registration and jurisdictions before tracing ownership.
2. Map the recorded chain. Build the direct and indirect shareholder/control structure across every relevant layer.
3. Test control separately. Examine whether influence or decision rights exist independently of percentage ownership.
4. Use the appropriate access route. Treat restricted UBO information according to national law, applicant status and legitimate-interest requirements.
5. Corroborate independently. Compare the declared position with historical, corporate, regulatory, litigation, insolvency and other appropriate evidence.
6. Report confidence and gaps. State what is established, what is indicated and what cannot presently be verified.

The objective is not simply to produce a UBO name. It is to establish who ultimately appears to own or control the entity, through what structure, on what evidence, and with what degree of confidence.