For a few years, the assumption in cross-border planning was straightforward: if you own a company in the EU, your name and stake are on a public register, full stop. That assumption is now wrong in most of Europe, and the reasons why matter more than the headline. This isn't a story about privacy returning by default, it's a story about access narrowing to specific categories of requester, with the details varying sharply by country.
The Ruling That Changed the Baseline
In November 2022, the Court of Justice of the European Union ruled on two joined cases concerning the conditions under which member states had to grant access to beneficial ownership information under the EU's anti-money-laundering directives. The Court struck down the requirement, introduced by the Fifth Anti-Money Laundering Directive, that member states make beneficial ownership information on legal entities accessible to any member of the general public as a matter of course.
The Court's reasoning centered on fundamental rights, not on weakening enforcement against financial crime. It found that unrestricted public access interfered with the rights to privacy and personal data protection guaranteed under the EU Charter of Fundamental Rights. Crucially, the ruling did not hold that public access to beneficial ownership information can never be justified, it held that, in the specific EU legislative context and under EU data protection law, access has to be limited to parties who can demonstrate a genuine, defined interest. The Court explicitly confirmed that journalists, civil society organizations investigating financial crime and corruption, and entities subject to anti-money-laundering obligations all qualify as having that legitimate interest.
That distinction, narrowed access rather than eliminated access, is the one most commonly missed in client conversations. Your name did not disappear from these registers. Who can query it, and under what justification, changed.
The Patchwork That Followed
The ruling didn't create a single EU-wide standard for what replaces public access; each member state had to legislate its own response, and they didn't move at the same speed or land in the same place. Several countries, Luxembourg, Austria, Germany, the Netherlands, and Ireland among them, took their registers offline almost immediately following the ruling. Others kept public access open for a period afterward while domestic legislation caught up.
France illustrates where the dust has settled in one major jurisdiction. Since the summer of 2024, access to France's Registry of Beneficial Owners has been limited to persons demonstrating a legitimate interest, and legislation passed in the spring of 2025 wrote that restriction into French statute along with a defined list of entities entitled to access. That two-step process, an administrative restriction first, formal legislation second, is a pattern several other member states followed too, which is why the practical access rules in any given country depend on checking current local implementation rather than assuming the 2022 ruling alone tells you the answer.
At EU level, the technical infrastructure for cross-border lookups is still in place. The Beneficial Ownership Registers Interconnection System continues to link national central registers holding information on corporate entities, trusts, and other legal arrangements, the plumbing didn't go away, but who can turn the tap did.
What "Legitimate Interest" Actually Covers
This is the phrase doing all the work in the post-2022 regime, and it isn't new, it predates the public-access era entirely. Under the original Fourth Anti-Money Laundering Directive, before the Fifth Directive briefly mandated public access, disclosure was limited to competent authorities, financial intelligence units, and persons or organizations able to demonstrate a legitimate interest. The current regime is, in substance, a return to that earlier standard, with more explicit statutory definitions of who qualifies, country by country.
In practice, categories that reliably qualify across most implementations include:
- Regulated financial institutions and other entities with anti-money-laundering obligations, performing due diligence on a counterparty.
- Journalists and civil society organizations with a demonstrable connection to investigating financial crime, corruption, or related misconduct.
- Competent authorities, tax authorities, financial intelligence units, law enforcement, who retain full access regardless of the public-access question.
- Business counterparties in specific transactional contexts, where several jurisdictions have carved out access for parties conducting genuine due diligence on an entity they are transacting with.
What doesn't reliably qualify: general public curiosity, competitor research, journalists or researchers without a specific investigative link, and, this trips up a surprising number of advisory firms, advisors conducting speculative due diligence unconnected to an actual live transaction or regulated obligation.
The Piece Non-EU Jurisdictions Complicate Further
The EU picture is genuinely fragmented, but it's at least converging toward a common legal principle. Non-EU jurisdictions with their own UBO registers are under no obligation to follow the ECJ's reasoning, and several haven't. A number of British Crown Dependencies and Overseas Territories, the British Virgin Islands, the Cayman Islands, Jersey, Guernsey, and the Isle of Man, had been moving toward broader public accessibility for their own UBO registers on a timeline set independently of EU developments, meaning a structure with an EU holding company and a BVI or Cayman operating entity can face two entirely different disclosure regimes for the same beneficial owner: one restricted, one moving toward openness. Panama, by contrast, maintains a UBO register that has never been made available to the public at all.
This is the practical trap for cross-border families and founders: assuming that "my structure has a restricted-access entity in it" means the whole structure is shielded. It usually doesn't. Beneficial ownership disclosure has to be assessed entity by entity, jurisdiction by jurisdiction, because the access rules genuinely don't harmonize even within a single ownership chain.
What This Means for Structuring Decisions
A few practical conclusions follow from where the law actually stands, as distinct from where clients often assume it stands:
- Don't structure around an assumption of public opacity. Regulated counterparties, banks, in particular, retain full access to beneficial ownership information regardless of what the general public sees. A structure that would embarrass a client if a compliance officer read it is a bad structure, public register or not.
- Restricted access is not the same as anonymity. Journalists and civil society organizations with a genuine investigative angle still have a path to the same information under the legitimate-interest standard; restricted access changes the friction involved, not the ultimate reachability for a determined, qualified requester.
- Jurisdiction selection for holding entities should account for local implementation, not the 2022 EU headline. Two EU countries can have meaningfully different practical access rules for the same category of requester, and the register status of any non-EU entities in the chain has to be checked independently.
The direction of travel matters as much as the current state. Given the strength of the anti-corruption lobby's objections to the 2022 ruling, and the EU's own stated intent to revisit the balance between privacy and transparency over time, the legitimate-interest standard should be treated as the current position rather than a permanent one. Anyone relying on today's access rules for a structure meant to last a decade should build in a periodic review, not a static assumption.
