Beneficial Ownership Registers in 2026: Who Can Actually See Your Name

For a few years, the working assumption in cross-border planning was simple: if you own a company in the EU, your name and stake are on a public register, full stop. In most of Europe that's now wrong. It isn't privacy coming back by default, though. Access has narrowed to specific kinds of requester, and the detail varies sharply by country.

What did the November 2022 court ruling change?

It ended automatic public access to company ownership information. It did not end access altogether.

In November 2022, the Court of Justice of the European Union (the EU's top court) ruled on two joined cases. They were about when member states must open up beneficial ownership information. That's the record of who ultimately owns or controls a company. The Court struck down a rule from the Fifth Anti-Money Laundering Directive, which required member states to make this information available to any member of the public as a matter of course.

The Court's reasoning was about fundamental rights, not about going soft on financial crime. It found that unrestricted public access interfered with privacy and personal data protection rights under the EU Charter of Fundamental Rights.

It did not say public access can never be justified. It said that, in this EU legal context, access has to be limited to people who can show a genuine, defined interest. The Court confirmed that three groups qualify: journalists, civil society organizations investigating financial crime and corruption, and entities subject to anti-money-laundering obligations.

This is the point most often missed in client conversations. Your name is still on these registers. What changed is who can look it up, and on what grounds.

Why is the picture so patchy across Europe?

Because the ruling didn't create one EU-wide replacement. Each member state had to write its own response, and they didn't move at the same speed or land in the same place.

Several countries, Luxembourg, Austria, Germany, the Netherlands, and Ireland among them, took their registers offline almost immediately after the ruling. Others kept public access open for a while as their domestic laws caught up.

France shows where things have settled in one big country. Since the summer of 2024, access to its Registry of Beneficial OwnersBeneficial owner (UBO)The real person who ultimately owns or controls a company or trust, behind any chain of companies. has been limited to people demonstrating a legitimate interest. Legislation passed in the spring of 2025 wrote that restriction into French law, along with a defined list of entities entitled to access.

That two-step pattern, an administrative restriction first and formal legislation second, is one several other member states followed too. So don't assume the 2022 ruling alone tells you the answer for a given country. Check how that country has actually implemented it today.

The EU's cross-border plumbing is still in place. The Beneficial Ownership Registers Interconnection System still links national central registers holding information on companies, trusts, and other legal arrangements. The pipes stay where they were. What changed is who is allowed to turn the tap.

Where are the grey areas?

Most of the grey comes from three things: "legitimate interest" is applied country by country, the non-EU registers move on their own timetable, and the standard itself may not last. None of this is a reason to avoid a structure, but it is a reason not to treat any of it as settled for good.

What counts as a "legitimate interest"?

It's a short list of categories, and the phrase isn't new. It predates the public-access era entirely.

Under the original Fourth Anti-Money Laundering Directive, before the Fifth Directive briefly mandated public access, disclosure was limited to competent authorities, financial intelligence units, and people or organizations able to show a legitimate interest. The current regime is, in substance, a return to that earlier standard, with clearer legal definitions of who qualifies, country by country.

Across most countries' rules, these groups reliably qualify:

• Regulated financial institutions and other entities with anti-money-laundering obligations, doing due diligence on a counterparty.
• Journalists and civil society organizations with a demonstrable link to investigating financial crime, corruption, or related misconduct.
• Competent authorities (tax authorities, financial intelligence units, law enforcement), who keep full access whatever happens with public access.
• Business counterparties in specific transactional contexts, where several countries have given access to parties doing genuine due diligence on a company they're dealing with.

These generally don't qualify:

• General public curiosity
• Competitor research
• Journalists or researchers without a specific investigative link
• Advisers doing speculative due diligence with no live transaction or regulated obligation behind it (this one trips up a surprising number of advisory firms)

What about registers outside the EU?

Non-EU registers don't have to follow the Court's reasoning, and several haven't. Within the EU, the picture is fragmented but converging on one legal principle. Outside it, there's no such convergence.

A number of British Crown Dependencies and Overseas Territories, namely the British Virgin Islands, the Cayman Islands, Jersey, Guernsey, and the Isle of Man, had been moving toward broader public access to their own registers. They did so on a timeline set independently of EU developments. Panama, by contrast, has a register that has never been available to the public at all.

So take a structure with an EU holding companyHolding companyA company whose main job is to own shares in other companies. and a BVI or Cayman operating company. The same beneficial owner can face two quite different regimes: one restricted, one moving toward openness.

This is the trap for cross-border families and founders. Having one restricted-access entity in the chain doesn't mean the whole structure is shielded. It usually isn't. You have to check each entity in each country separately, because the access rules don't line up, even within a single ownership chain.

What does this mean for how you set things up?

Three practical points follow from where the law actually stands, as opposed to where clients often assume it stands.

• Don't build a structure that depends on the public not being able to see it. Banks and other regulated counterparties keep full access to beneficial ownership information, whatever the public sees. A structure that would embarrass you if a compliance officer read it is a bad structure, public register or not.
• Restricted access isn't anonymity. Journalists and civil society organizations with a genuine investigative angle still have a path to the same information. Restricted access adds friction, and a determined, qualified requester can still reach the information.
• Pick holding-company jurisdictions based on how each country actually runs its rules. The 2022 EU headline won't tell you that. Two EU countries can have meaningfully different practical access rules for the same type of requester, and the register status of any non-EU entities in the chain needs checking separately.

The direction of travel matters as much as today's position. The anti-corruption lobby objected strongly to the 2022 ruling, and the EU has said it intends to revisit the balance between privacy and transparency over time. So treat the legitimate-interest standard as the current position, and expect it to change.

If you're relying on today's access rules for a structure meant to last ten years, build in a periodic review. A static assumption is the risky bit.