The future of corporate transparency

In a significant decision, the Court of Justice of the European Union (CJEU) has declared that legislation requiring details of the beneficial owners of European Union (EU) legal entities to be made available to the general public is invalid as it stands.

The decision of the Grand Chamber has significant ramifications for EU Member States and the three members of the European Economic Area (EEA) (Iceland, Liechtenstein and Norway).

It will also cause the UK to pause and consider its own approach to corporate transparency.

Areas covered in this article 

• The background
• A key change
• Challenges arise in Luxembourg
• What did the CJEU say?
• What happens now?
• Answered and unanswered questions
• Does this affect the UK's register?
• What will the UK do next?
• Timeline of events

The background

Since 2017, all member states of the EU and the EEA have been required to keep central registers containing information on the “beneficial owners” of legal entities established within their jurisdiction.

Beneficial ownership in this context is interpreted broadly. It includes not only persons who hold a significant economic stake in a legal entity, but also persons who can exercise a degree of control over a legal entity (regardless of their economic stake).

The requirement for these so-called “beneficial ownership” or “transparency” registers ultimately derives from Article 30 of the Fourth EU Money Laundering Directive (2015/849) (4MLD). Article 30 requires Member States to establish central registers for this purpose and to ensure that legal entities within their jurisdiction provide the relevant information.

Member States can decide what information needs to be provided. However, as a minimum, the information must include each beneficial owner’s name, nationality and country of residence, the month and year of their birth, and the nature and extent of their “beneficial interest”.

Article 30(5) of 4MLD sets out who is entitled to gain access to this information. Broadly speaking, the information must be freely available, without restrictions, to official authorities, as well as to any organisations that are required to carry out anti-money laundering checks.

In addition, 4MLD stated that any person or organisation was entitled to access beneficial ownership information, provided they could “demonstrate a legitimate interest”. 4MLD did not define “legitimate interest”, leaving this question to be decided by the national governments and authorities.

Finally, although 4MLD required beneficial ownership information to be made public, it provided a narrow exception where access to the information could place the beneficial owner at risk of certain dangers, such as fraud, kidnapping, blackmail, violence or intimidation. In those circumstances, a beneficial owner would be able to apply to “suppress” their details from public view.

EU Member States were required to implement these requirements by 26 June 2017. As a result, we saw the creation of new registers across the EU, such as the Transparenzregister in Germany and the Registre des Bénéficiaires Effectifs (RBO) in Luxembourg. In other jurisdictions, such as France, the disclosure regime was integrated into existing corporate registers.

At the time, the UK was a member of the EU and had already introduced requirements to disclose the identity of beneficial owners in the form of the persons with significant control (or PSC) regime. In this sense, the UK had already pre-empted Article 30 of 4MLD and, on 26 June 2017, needed to make only minor modifications to the PSC regime to fully implement Article 30.

It is important to note, however, that the PSC regime did not incorporate (and has never incorporated) a “legitimate interest test” in the manner originally contemplated by 4MLD. More on that later.

A key change

In 2018, the European Parliament and Council enacted the Fifth EU Money Laundering Directive (2018/843) (5MLD). This made various changes to 4MLD, including to Article 30.

One key change (made by Article 1(15)(c) of 5MLD) was to amend Article 30 of 4MLD to state that any member of the general public was entitled to access beneficial ownership information, whether or not they had a “legitimate interest” in doing so.

The rationale for this change was that the “legitimate interest” test was difficult to define in legal terms, meaning it risked creating disharmony in the approach taken by different EU and EEA Member States and could give rise to arbitrary decisions by national authorities. The European Parliament and Council therefore decided simply to remove the test.

A practical consequence of this, however, is that it removed a potentially significant legal barrier to the disclosure of information on beneficial owners of legal entities. Members of the general public would henceforth be able to access information freely and without giving any reason at all.

Alongside this, 5MLD (specifically, Article 15(1)(g)) also made changes to Article 30(9) of 4MLD. The key changes were to extend the list of circumstances justifying suppression of information to include “harassment” and “disproportionate risk” and to clarify that exemptions should be granted only following a “detailed evaluation of the exceptional nature of the circumstances”.

Member States had until 10 January 2020 to implement these changes. Again, the UK was still a member of the EU at this point (it formally left at the end of 31 January 2020) and was required to implement the changes. However, as noted above, the UK had never in fact implemented a “legitimate interest” test and so, in this respect at least, did not need to take any action to implement 5MLD.

As required, Luxembourg implemented the requirement for a central register of beneficial ownership through its Law of 13 January 2019, which established the Luxembourg Register of Beneficial Ownership (loi du 13 janvier 2019 instituant un Registre des bénéficiaires effectifs) (the RBO Law).

Challenges arise in Luxembourg

In due course, two legal actions came before the Luxembourg District Court (le tribunal d’arrondissement de Luxembourg).

The first action concerned the refusal by the Luxembourg RBO to grant an application for suppression of beneficial ownership information. The claimant challenged the grounds on which the RBO assessed whether there had been a risk or disproportionate risk to the beneficial owner in that case.

The second, and arguably more significant, action concerned a direct challenge to the RBO Law itself. The claimant argued that the right of a member of the general public to gain unfettered access to beneficial ownership information directly infringed two protections conferred by the European Union’s Charter of Fundamental Rights:

• Article 7, which guarantees the right to respect for an individual’s private and family life, home and communications; and
• Article 8, which confers on individuals the right to the protection of personal data concerning them.

The claimant also argued that unfettered access infringed several provisions of the EU General Data Protection Regulation (GDPR), because it involved disproportionate processing and disclosure of personal data relating to the beneficial owners of legal entities.

Ultimately, both actions centred around the interpretation and validity of EU legislation. The Luxembourg District Court therefore referred several questions to the CJEU for its view (see box “Answered and unanswered questions” below).

What did the CJEU say?

The CJEU found that the right to unfettered access, with no requirement to demonstrate a legitimate interest, infringes Articles 7 and 8 of the EU Charter of Fundamental Rights.

The Grand Chamber held that making information on beneficial owners available to the general public naturally interfered with a right to privacy. It also held that, because making the information available involved processing personal data, it also interfered with the right to protection of personal data.

However, the CJEU acknowledged that Articles 7 and 8 of the Charter do not create absolute rights. They can be qualified or infringed in certain circumstances where there is a public interest in doing so. However, for this to happen, certain conditions must be satisfied.

• The interference must be provided for by law.
• The interference must nonetheless “respect the essence” of the rights and freedoms set out in the Charter of Fundamental Rights.
• The interference must be necessary and must meet objectives of “general interest” recognised by the European Union.
• The interference must be proportionate.

The court was satisfied that the interference caused by unfettered access was provided for by law (because it was set out in legislation, namely 4MLD and 5MLD) and it respected the essence of the rights and freedoms in the Charter (because it required only “adequate” information to be disclosed).

It also found that the disclosure of information on beneficial owners of legal entities was designed to meet an objective of general interest, namely to promote greater transparency so as to discourage money laundering and terrorist financing.

However, the CJEU found that granting unfettered access for the general public, with no requirement to demonstrate any legitimate interest for seeking the information in question, was neither necessary nor proportionate.

The fact that it might be difficult to define a “legitimate interest” in legal terms did not justify abolishing the test completely. If the purpose of making beneficial ownership information publicly available is to combat money laundering and terrorist financing, then any member of the public would have a “legitimate interest” in the information if they were seeking it for that purpose. It was not necessary to grant automatic, unfettered access to all information to satisfy that objective.

Moreover, the degree of access was not proportionate. 4MLD set minimum standards for the information to be disclosed but did not set limits on what Member States could require in terms of information. The legislation was, therefore, neither clear nor precise enough to justify interfering with the rights and freedoms in Articles 7 and 8 of the Charter.

In addition, the CJEU noted that primary responsibility for tackling money laundering and terrorist financing lies with public authorities and financial and credit institutions, not the general public. That is why no “legitimate interest” applies when those organisations request beneficial ownership information.

By removing the “legitimate interest” test for the general public, 5MLD created a “more serious interference” with the rights and freedoms in the Charter without creating any new corresponding benefit.

As a result, the CJEU declared Article 15(1)(c) of 5MLD invalid insofar as it amended Article 30(5)(c) of 4MLD. In less legalistic terms, the CJEU has reinstated the “legitimate interest” test.

What happens now?

By finding that the amendments to Article 30(5)(c) of 4MLD were invalid, the CJEU effectively settled both cases for the Luxembourg court.

This provides useful clarity in many respects. However, it is also frustrating, as the CJEU declined to give a view on other questions raised by the Luxembourg District Court (see box “Answered and unanswered questions” below).

Some of those questions are most interesting and responses would have provided useful clarity on the grounds on which a beneficial owner can apply to suppress their details from public view. Some of the responses might well also have influenced the position in the UK (see below).

The immediate effect of the CJEU’s decision is that the amendments to Article 30(5)(c) of 4MLD made by 5MLD are invalid. The natural inference of this is that we are back to the position, within the EU, that a member of the public must demonstrate a legitimate interest to access beneficial ownership information.

The decision may not automatically have changed domestic laws. This will depend on the legal system of each EU and EEA Member State in question, but states will likely now need to amend their domestic law to reflect the original position (to require members of the public to show a legitimate interest) or risk being in breach of their EU treaty obligations.

However, the judgment has had immediate practical ramifications within EU and EEA Member States. As of writing, we are aware that the beneficial ownership registers in Austria, Luxembourg and the Netherlands have all been closed to the public following the decision.

It is not clear whether these closed registers are accepting requests for information accompanied by a legitimate interest. Indeed, many registers may not have the infrastructure or architecture in place to accept, process and adjudicate on applications of this kind.

We await the EU’s next steps. Corporate transparency has long been an objective of the EU. Given the CJEU’s finding that unfettered public access offends the Charter of Fundamental Rights, it is difficult to see how the European Parliament and Council could legislate to achieve the effect they wanted.

One approach might be to examine other ways to open up access to beneficial ownership information beyond merely showing a “legitimate interest”. But, in exploring this, the Council will need to reach a view on whether any other routes to access are sufficiently necessary and proportionate to warrant interfering with EU citizens’ fundamental rights and freedoms.

Does this affect the UK’s register?

Although the UK is no longer a member of the EU, it was a member state when 4MLD and 5MLD were required to be implemented in domestic law. As we explain above, the UK effectively satisfied its obligations under these Directives by creating the PSC regime.

Under the PSC regime, persons with significant control over certain legal entities (PSCs) are required to provide their details to the legal entity, which must in turn record them in an internal register (unless the entity is a Scottish partnership) and file them publicly at Companies House within 14 days.

The UK also has a mechanism to allow a PSC to apply to suppress their details from public view if they can show they are at “serious risk of violence or intimidation” due to the legal entity’s activities or one or more of their characteristics or personal attributes when associated with the legal entity.

However, there has never been a “legitimate interest” test under the PSC regime.

This probably means that, were the UK still a member of the European Union, the PSC regime would infringe the Charter of Fundamental Rights and need to be changed. But EU law ceased to apply in the UK from the end of the transition period at 11:00 p.m. (UK time) on 31 December 2020, and the Charter itself ceased to apply in the UK from 11:00 p.m. (UK time) on 31 January 2020.

Under the European Union (Withdrawal) Act 2018, decisions of EU courts made after the end of the transition period no longer have any legal effect in the UK (although the UK courts are allowed to take them into account). The decision certainly, therefore, has no immediate impact on UK law.

Moreover, it is no longer possible to bring new legal proceedings alleging that the UK has failed to properly transpose EU law into UK domestic law (as might have been the case here).

It is possible to contemplate a very narrow and rather conceptual argument that the right of unfettered access in the UK is invalid because it purportedly implements an EU law (Article 15(1)(c) of 5MLD) that arguably never in fact existed. This argument assumes that the CJEU’s decision renders 5MLD void right from the outset, such that it was never valid law in the first place.

This argument seems unlikely to succeed. First, in its deliberations over the Retained EU Law (Revocation and Reform Bill) (styled the “Brexit Freedoms Bill” by the UK Government), ministers have suggested that EU law which has become assimilated into UK domestic law will not automatically fall away if the CJEU declares that that EU law is invalid.

Second, as we explain above, the UK enacted its PSC regime on its own initiative before 4MLD was published (see the timeline at the end of this article). Although the PSC regime served the purpose of implementing 4MLD (until EU law ceased to apply in the UK), it was not introduced specifically for that purpose. Arguably, it stands alone as its own regime and is not affected by what happens in the European Union.

But the decision raises other interesting prospects for challenge in the UK:

• Article 7 of the EU Charter of Fundamental Rights is nearly identical to Article 8 of the separate (and non-EU-related) European Convention on Human Rights (the ECHR), which has been incorporated into UK law by the Human Rights Act 1998. It is possible to see how a person might challenge unfettered access under the PSC regime on the basis that it infringes Article 8 of the ECHR. However, this would result only in a “declaration of incompatibility”, rather than nullifying this aspect of the regime.
• The CJEU left open the question of whether unfettered access infringes the GDPR. Although the Charter of Fundamental Rights no longer applies in the UK, the GPDR does (in the form of a modified “UK GDPR”). It is possible to contemplate a challenge to unfettered access under the PSC regime on the basis that it infringes UK GDPR.

Again, however, it is not clear how successful either challenge would be.

For the time being, therefore, legal entities and PSCs should continue to operate on the basis that beneficial ownership information in the UK remains freely available to the public, at no cost and without any need to provide a reason for access.

What will the UK do next?

The decision does, however, put the UK in a difficult position politically.

Until 22 November 2022, the UK and the EU had shared a “level playing field”: beneficial ownership information was publicly available in both geographies without needing to show any reason for accessing it.

The CJEU’s decision now means that beneficial ownership information will be more publicly available and easily accessible in the UK than in the EU. This cuts both ways.

The UK Government will need to consider carefully the balance it wishes to strike. This is particularly relevant following Brexit, as the UK tries to position itself as a dynamic, “independent” nation, free of the constraints of EU legislation, and an attractive destination to businesses and entrepreneurs.

On the one hand, free and easy access chimes with the UK Government’s historic and continuing drive for greater transparency. The UK has long championed disclosure of control of legal entities. It was one of the first countries in the world to introduce a public beneficial ownership registry.

Indeed, recently, the UK has pushed further forward with its drive towards transparency by creating the new Register of Overseas Entities, which requires non-UK legal entities that hold, or wish to acquire, registered land in the UK to disclose their beneficial owners in a public register. That information, too, is available to the general public free of charge with no need to show any legitimate interest.

On the other hand, the CJEU’s decision and the removal of the level playing field could put the UK at a competitive disadvantage to the European Union.

The CJEU has clearly framed the unsuitability of unfettered disclosure in the context of protecting personal privacy. Individuals wishing to establish a business or to hold assets through a new legal entity may well feel they find comfort in a legal jurisdiction that more closely safeguards the right to privacy by imposing constraints on access and disclosure.

That is not to say that the UK has no regard for privacy. The right to privacy is a fundamental right enshrined in UK law, as well as EU law.

Take, for example, the Trust Registration Service (TRS), another creation of 4MLD and 5MLD. UK trusts, as well as certain non-UK trusts, are required, in certain circumstances, to register details of their beneficial owners (which includes their trustees, beneficiaries, settlor and protector) in the TRS.

In theory, any member of the general public can access basic information recorded on UK trusts in the TRS. However, to do so, they must demonstrate a “legitimate interest” (or to show that the trust has a controlling interest in “third country entity”). In other words, there is no unfettered right of access to beneficial ownership of trusts in the UK.

When all is said and done, it seems distinctly unlikely that the UK will reduce its requirements on transparency. The UK Government was among the first states to introduce a public register of beneficial ownership unilaterally and has sought to persuade others to adopt the same approach.

The UK has also consistently insisted that the Crown Dependencies (Guernsey, Jersey and the Isle of Man) and the British Overseas Territories (including, for example, Bermuda, the British Virgin Islands, the Cayman Islands, Gibraltar and the Turks and Caicos Islands) adopt regimes similar to the PSC regime or it will legislate for them. Having extracted commitments to implement transparency by 2023, the CJEU’s decision now arguably gives these offshore jurisdictions justification to proceed slowly and cautiously. We can perhaps expect some of these jurisdictions to push back against public disclosure.

However, any attempts to delay implementation will face criticism in the UK’s House of Commons. They could even result in considerable Parliamentary pressure on the UK Government to issue an Order in Council requiring the Crown Dependencies and Overseas Territories to introduce public registers. It is very possible that this issue will create significant tension between the UK and the Dependencies and Territories over the coming months.

For many in the UK government (and opposition), there had been an assumption that Brexit would bring an end to the influence of EU law and the EU courts in the UK. The CJEU’s decision in this case shows that that may well be far from the case.

Timeline of events