The Register of Beneficial Owners after WM and Sovim (joined cases C-37/20 and C-601/20)

The judgments

The question

Companies and the other entities registered with the Luxembourg Trade and Companies Register that the law covers must file their beneficial owners with the Register of Beneficial Owners (Registre des bénéficiaires effectifs, RBE), kept by the economic interest grouping Luxembourg Business Registers (LBR) under the Law of 13 January 2019. When the register opened, part of each beneficial owner’s data could be consulted by anyone on the internet. The only way out was Article 15 of the RBE Law: a duly reasoned application to LBR to restrict access, in exceptional circumstances, where access would expose the beneficial owner to a disproportionate risk or a risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation, or where he is a minor or legally incapable.

In 2019 and 2020 LBR refused two such applications, one for a businessman, WM, and one for a company, Sovim SA. Both went to the tribunal d’arrondissement de Luxembourg (Luxembourg District Court), which referred two sets of questions to the Court of Justice. WM’s case asked what “exceptional circumstances”, “risk” and “disproportionate” risk mean. Sovim’s case went further and asked whether public access was lawful at all. On 22 November 2022 the Grand Chamber answered only the most radical question: the EU rule requiring public access was invalid. Everything WM had asked, and most of what Sovim had asked, was left unanswered.

For Luxembourg founders, family offices and their advisers the result is a mixed picture. The register is no longer public, but the restriction procedure in Article 15 survives in the same words that the tribunal d’arrondissement found unclear, and the only detailed guidance on it comes from the Advocate General’s opinion, which the Court did not follow on the main point. This review sets out what the Luxembourg court asked, what the Advocate General proposed, what the Court decided, and how the current RBE Law compares with the text the Court examined. The Court’s reasoning on validity is analysed in full in our Dutch review of the UBO register and public access; here it is summarised only so far as it bears on Luxembourg.

The legal framework

The directive

Article 30 of Directive (EU) 2015/849, the fourth Anti-Money Laundering Directive, requires Member States to ensure that companies and other legal entities hold adequate, accurate and current information on their beneficial owners and that the information is held in a central register (Article 30(1) and (3), quoted in the judgment at para. 6). In its original version, Article 30(5) gave access to competent authorities and financial intelligence units without restriction, to obliged entities within customer due diligence, and to “any person or organisation that can demonstrate a legitimate interest” (para. 7). Article 1(15)(c) of Directive (EU) 2018/843 replaced that third category with “any member of the general public”, who were to be permitted to access “at least” the name, month and year of birth, country of residence and nationality of the beneficial owner and the nature and extent of the interest held, with an option for Member States to give access to “additional information” including at least the date of birth or contact details (para. 8). A new Article 30(5a) allowed Member States to require online registration and a fee.

The exemption at the centre of WM’s case is Article 30(9), as amended:

9. In exceptional circumstances to be laid down in national law, where the access referred to in points (b) and (c) of the first subparagraph of paragraph 5 would expose the beneficial owner to disproportionate risk, risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation, or where the beneficial owner is a minor or otherwise legally incapable, Member States may provide for an exemption from such access to all or part of the information on the beneficial ownership on a case-by-case basis. Member States shall ensure that these exemptions are granted upon a detailed evaluation of the exceptional nature of the circumstances.

Article 30(9) continues with rights to administrative review and an effective judicial remedy and with annual statistics. Its second subparagraph, quoted by the Advocate General (point 9), adds that exemptions do not apply to credit institutions, financial institutions or obliged entities that are public officials.

The RBE Law as the Court read it

The judgment quotes the Luxembourg provisions in the version in force when the disputes arose (paras 15 to 19). The Court’s translation calls the register the “Register of Beneficial Ownership” (RBO); our translation uses “Register of Beneficial Owners” and the French abbreviation RBE.

• Article 2 established the register under the authority of the Minister responsible for Justice, “the purpose of which is to retain and make available information on the beneficial ownership of registered entities” (para. 15).
• Article 3(1) listed thirteen items to be filed for each beneficial owner: surname, forenames, nationality, day, month and year of birth, place of birth, country of residence, complete private or professional address, the national identification number or, for non-residents, a foreign identification number, and the nature and extent of the beneficial interest (para. 16).
• Article 11(1) gave national authorities access to all of that information in the performance of their duties (para. 17).
• Article 12 opened access to the information in Article 3(1), points 1° to 8°, 12° and 13°, to “any person” (para. 18). Points 1° to 8° include the day of birth and the place of birth, which the directive did not require to be public.
• Article 15(1) and (2) set out the restriction procedure (para. 19). Under paragraph 1 a registered entity or a beneficial owner could ask LBR, case by case and in exceptional circumstances, to restrict access to national authorities, credit institutions, financial institutions, and bailiffs and notaries acting as public officers. Under paragraph 2, LBR restricted access provisionally to national authorities on receipt of the application, until notification of its decision and, after a refusal, for a further 15 days; if an appeal was brought, the restriction was maintained until the refusal could no longer be appealed.

The Luxembourg legislature had therefore taken up both options in the directive: it made more data public than the minimum list, adding the day and place of birth, and it provided for exemptions. The Advocate General observed that Luxembourg defined “exceptional circumstances” simply by reference to the risks listed in Article 30(9) (point 249), and that public access in Luxembourg was by automated procedures on the internet, searchable only by reference to the legal entity and not by the beneficial owner (points 94 and 102). The national identification number and the exact address were not accessible to the public (point 159).

The beneficial owner himself is defined by reference to Article 1(7) of the AML Law of 12 November 2004, as Article 1 of the RBE Law provides in our current text.

The two disputes before the tribunal d’arrondissement

WM (Case C-37/20)

According to the Advocate General, WM is the beneficial owner of 35 commercial companies and of a real estate company, YO, and each of those companies applied to LBR under Article 15(1) to restrict access to the information on WM (point 18). The applications argued that disclosure would “seriously, actually and immediately” expose WM and his family to a disproportionate risk and to a risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation (judgment, para. 20; opinion, point 18). LBR rejected all of them; the application for YO was rejected by decision of 20 November 2019 (point 19).

On 5 December 2019 WM sued before the tribunal d’arrondissement (para. 21). His case was that his position as executive officer and beneficial owner of YO and other companies required him to travel frequently to countries with unstable political regimes and high crime, with a significant risk of being kidnapped, abducted, subjected to violence or killed. The Advocate General adds that, on WM’s argument, the risk would be greater if people with criminal intent could find out that he was a beneficial owner, since that status suggests that he owns the entities (point 20). LBR answered that WM could rely neither on exceptional circumstances nor on any of the listed risks (para. 22), and in particular that his involvement in the companies was public knowledge, reported many times in the press and easy to find by a simple internet search (point 21). The order for reference also mentioned that the refusals for the other companies were being challenged before the President of the Commercial Division of the same court (footnote 8 to point 20).

The tribunal d’arrondissement noted that Article 15(1) transposes Article 30(9) and had doubts about the meaning of the directive (point 22). By a decision of 24 January 2020, received the same day, it stayed the proceedings and referred three questions (paras 5 and 24).

Sovim (Case C-601/20)

Sovim SA is a company established in Luxembourg (point 25). It applied to LBR on 12 August 2019 to restrict access to the information on its beneficial owner (point 26). LBR refused on 6 February 2020, and Sovim sued on 24 February 2020 (paras 25 and 26).

Sovim’s principal claim was more ambitious than WM’s. It asked the court to declare Article 12 and/or Article 15 of the RBE Law inapplicable and to order that the information it had filed under Article 3 not be made public (para. 27). It argued that public access infringed Articles 7 and 8 of the Charter of Fundamental Rights; that the aims of the directive were to identify the beneficial owners of companies used for money laundering or terrorist financing and to ensure certainty in commercial relationships and market confidence, without any showing of how unrestricted public access served them; and that public access infringed several provisions of the GDPR, in particular the principles in Article 5(1) (paras 28 to 30). In the alternative, it asked the court to find a disproportionate risk under Article 15(1) and to order LBR to restrict access (para. 31): its beneficial owner and his family faced a significant, real and present risk of kidnapping while travelling or staying in Africa (point 30).

The referring court observed that Article 15(1) requires LBR to analyse case by case whether exceptional circumstances justify a restriction, that it had already referred questions on that point in WM’s case, and that Sovim’s case also raised the compatibility of public access with the Charter and the GDPR (para. 32). By a decision of 13 October 2020, received on 13 November 2020, it referred three further questions (paras 5 and 33).

The questions referred

Case C-37/20: exceptional circumstances, risk and disproportionality

The first question concerned “exceptional circumstances” (para. 24). Question 1(a) asked whether Article 30(9), which makes a restriction conditional on “exceptional circumstances to be laid down in national law”, allows national law to define those circumstances simply as equivalent to the listed risks, which are already a separate condition under the directive. The referring court plainly had Article 15(1) of the RBE Law in mind. Question 1(b) asked, if not, and where the national law offers nothing beyond what the referring court called “the ineffective concepts” of the listed risks, whether the national court may disregard the condition of exceptional circumstances or must fill the gap itself; whether the Court of Justice can give guidance when the content of the condition is left to national law; and, if so, what that guidance is.

The second question concerned “risk”. Question 2(a) asked whether the list “disproportionate risk, risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation” describes eight cases (a general risk subject to the disproportionality requirement plus seven specific risks that are not) or seven cases, each subject to the disproportionality requirement. Question 2(b) asked whether the risk is assessed only by reference to the beneficial owner’s relationship with the entity for which restriction is sought, or also by reference to his relationships with other entities; if so, whether only as beneficial owner or in any capacity; and whether the nature of the relationship matters. Question 2(c) asked whether the protection is lost where the information, or the information the beneficial owner relies on to show the risk, is easily available to third parties through other channels. That question matches LBR’s argument that WM’s role was already in the press.

The third question asked which competing interests must be weighed when deciding whether a risk is “disproportionate”.

Case C-601/20: validity, the threshold for exemption and the GDPR

Question 1 asked whether Article 1(15)(c) of Directive 2018/843, in so far as it requires information on beneficial owners to be accessible to the general public in all cases without any requirement of a legitimate interest, is valid in the light of Article 7 of the Charter (read with Article 8 of the European Convention on Human Rights and the objectives in recitals 30 and 31) and Article 8 of the Charter (lawfulness, fairness, transparency, purpose limitation and data minimisation) (para. 33).

Question 2(a) asked whether the exceptional circumstances in Article 30(9), as amended by Article 1(15)(g) of Directive 2018/843, can be found only where a disproportionate risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation is demonstrated which is exceptional, actually borne by the beneficial owner as an individual, and “significant, real and present”. Question 2(b) asked whether, so interpreted, Article 30(9) is valid under Articles 7 and 8 of the Charter.

Question 3 put six questions on the GDPR: - (a) whether Article 5(1)(a) (lawfulness, fairness and transparency) allows a register accessible to the public with no monitoring of access, no justification and no way for the beneficial owner to discover who has seen his data, and access by an unlimited and indeterminable number of persons; - (b) whether Article 5(1)(b) (purpose limitation) allows public access where the controller cannot guarantee that the data will be used only to combat money laundering and terrorist financing, a purpose for which the general public is not responsible; - (c) whether Article 5(1)(c) (data minimisation) allows public access to the date and place of birth in addition to the minimum data, a question directed at Luxembourg’s choice to publish the day and place of birth (opinion, footnote 97); - (d) whether Article 5(1)(f) (integrity and confidentiality) allows unlimited and unconditional access with no undertaking of confidentiality; - (e) whether Article 25(2) (data protection by default) allows a register that requires no account for consultation on its website, tells the beneficial owner nothing about consultations, and places no restriction on the extent and accessibility of the data in the light of their purpose; - (f) whether Articles 44 to 50 (transfers to third countries) allow the data to be accessible in all circumstances to anyone, with no legitimate interest and no limitation as to where the public is located.

The Advocate General’s opinion

Advocate General Pitruzzella delivered his opinion on 20 January 2022. The Court had held a hearing on 19 October 2021, and observations had been submitted by WM, Sovim, the Luxembourg, Austrian, Finnish and Norwegian Governments, the European Parliament, the Council, the Commission and the European Data Protection Supervisor (as recorded in the judgment before para. 1). He regrouped the questions into three groups: validity (Question 1 and Question 2(b) in Sovim), the GDPR (Question 3 in Sovim), and the interpretation of Article 30(9) (all of WM’s questions and Question 2(a) in Sovim) (points 33 to 36).

Validity: public access upheld, open-ended data struck down

On validity, which our Dutch review covers in detail, the Advocate General would have upheld public access. He considered the interference not particularly serious, because the data were limited and not especially sensitive and the potential harm moderate (point 104), and the removal of the legitimate-interest condition strictly necessary, relying on the Commission’s impact assessment (points 172 to 177). Two Luxembourg features entered his analysis. Internet access was “liable to result in the maximum proliferation of the data” (point 94); but the fact that the Luxembourg register could be searched only by entity, not by person, reduced the risk of economic profiling (point 102). Giving the public a person’s home address would, by contrast, be a serious interference (point 107), and Luxembourg did not do so (point 159).

He would have declared invalid the words “at least” in the second subparagraph of Article 30(5) and the whole third subparagraph, because the scope of the data disclosed must be fixed by the EU legislature and not left to Member States (points 114 to 118 and 229 to 230). Additional information was neither clearly defined nor necessary, since a beneficial owner can be identified from the minimum list (point 165). In a footnote he recorded that the referring court and Sovim questioned the Luxembourg addition of the full date of birth, including the day, and the place of birth (footnote 97). Since he regarded as invalid the third subparagraph, in the exercise of which Luxembourg had added those items, his reasoning left them without a basis in the directive.

He would also have read Article 30(5a) as obliging Member States to ensure that register keepers know who consults the register, so that information on requesters can be given to beneficial owners where needed to protect their rights (points 205 to 208), and Article 30(9) as obliging Member States not merely to allow but to grant exemptions where access would expose the beneficial owner, in exceptional circumstances, to a disproportionate risk of interference with any of his Charter rights (points 191 and 192). He accepted that the beneficial owner need not be notified each time his data are consulted: automatic notification could deter access, expose journalists to reprisals and alert suspects (point 179).

On data security he noted Sovim’s assertion that press articles had reported vulnerabilities at LBR, through which data had been extracted from the register so that it could be searched by beneficial owner as well as by company name (footnote 121). He left it to the referring court to ascertain whether LBR had implemented adequate technical and organisational measures (point 213).

The GDPR questions

The Advocate General considered that the GDPR is not a criterion for the validity of the directives, which are of equal rank, but that the directives must be interpreted consistently with it (points 65 to 71). Articles 5 and 6 of the GDPR do not in themselves preclude a register open to an unlimited and indeterminate public without monitoring or justification; the real question is proportionality (point 127). Since his validity analysis answered the doubts in Questions 3(a) to 3(e), he saw no need to answer them separately (point 233). He did, however, address the purpose-limitation point: a member of the public who accesses the register may himself become a controller and must comply with Articles 5 and 6 GDPR, so that unlawful further use can be stopped, for example by a de-referencing request (points 199 to 203). On Question 3(f) he proposed that Chapter V of the GDPR does not preclude a register partly accessible to the public without a legitimate interest and without limitation as to location; a transfer from such a register under Article 49(1)(g) may be made only if the conditions for consultation are met and not for the entire register (points 239 and 240).

Exceptional circumstances (WM, Question 1)

The reference to national law in Article 30(9) shows that the EU legislature intended to leave Member States discretion in identifying the exceptional circumstances (point 245). But Member States must protect fundamental rights whatever their discretion (point 246). Since the provision says nothing about the form of the national definition, nothing prevents a Member State from defining exceptional circumstances, “as the Grand-Duchy of Luxembourg has done, simply by reference to the cases already referred to in that provision”, provided beneficial owners are protected against disproportionate infringements of their fundamental rights (point 249). For the national court, he endorsed the Commission’s view that it may itself have to determine the nature and scope of the exceptional circumstances, but only so far as necessary to protect fundamental rights (point 251). In doing so it must take account of three points (points 252 to 254): the evaluation is case by case; the provision derogates from a general rule and must be interpreted strictly; and the circumstances must be out of the ordinary and give rise to a disproportionate risk of infringement of fundamental rights.

In that context, the express mention in the provision in question of risks affecting the right to life, the right to integrity of the person and the right to security of person, protected, respectively, by Articles 2, 3 and 6 of the Charter, provides a benchmark for determining how serious the infringement of fundamental rights must be in order to justify exemption.

Risk (WM, Question 2)

On the eight-or-seven-cases question, the Advocate General explained the source of the difficulty: in the French, Spanish and English versions, among others, Article 30(9) refers to “disproportionate risk, risk of fraud, kidnapping …”, which suggests an independent ground, while recital 36 of Directive 2018/843 speaks of “a disproportionate risk of fraud, kidnapping …”; the German and Italian versions show no such divergence (point 257 and footnote 132). Where language versions diverge, the provision is interpreted by its scheme and purpose (point 258). On his reading, disproportionality is a condition applying to each listed risk, but the protection also extends to any disproportionate risk that the beneficial owner’s fundamental rights could be infringed (point 259 and conclusion (8)). The assessment must be case by case, based on a detailed evaluation and on all the relevant facts (point 260).

On relationships with other entities (Question 2(b)), the directive gives no clear indication (point 262). It cannot be ruled out that relationships with other entities must be taken into account (point 263), but, sharing the Commission’s view, only relationships in the nature of beneficial ownership, not relationships of a different type (point 264). The burden is on the beneficial owner or the entity to show that those relationships are relevant and demonstrate or corroborate the risk; otherwise the authorities would have to carry out “unreasonably extensive investigations”, a concern raised by the Austrian Government (point 265). On that view, WM’s other companies would count only if their relevance were proved.

On information available elsewhere (Question 2(c)), the Advocate General agreed with the Commission and the Austrian Government: since exemptions depend on the risks resulting from disclosure, Article 30(9) “implicitly” excludes an exemption where the information is easily available to third parties through other channels (point 267). That is LBR’s argument against WM in substance.

Evidence (Sovim, Question 2(a))

The burden of proof lies with the beneficial owner, and LBR cannot be required to carry out its own investigations, “which would potentially extend world-wide” (point 269). As to the standard:

Accordingly, the mere presence of a remote or hypothetical risk of harm will not be sufficient. Moreover, the perception of the disproportionate risk must not be a subjective one, but must be based on specific, real and current evidence. To that end, the beneficial owner will have to adduce specific, precise and substantial indicia of the threat of infringement of his or her fundamental rights and of the exceptional circumstances.

The beneficial owner must establish the risk and the exceptional circumstances “with a sufficient degree of probability” (point 270). This is close to, but not identical with, the “significant, real and present” threshold in Sovim’s question.

Disproportionality (WM, Question 3)

The referring court had framed the third question as a weighing of transparency against the beneficial owner’s physical and psychological integrity and property, while noting that recital 36 also mentions private life and data protection (point 273). The Advocate General preferred to ask whether exceptional circumstances expose the beneficial owner to a disproportionate risk of infringement of his Charter rights (point 275). Persons who choose to do business through companies can be required to make certain identifying information available, especially as they know of the requirement when they decide to do so (point 277), and in the weighing the public interest should in general prevail, though particular situations may exceptionally justify restriction (point 278). His proposed answer was that the assessment takes into account, on one side, the specific listed risks and the beneficial owner’s fundamental rights, in particular private life and data protection, and, on the other, the interest of the public and society in knowing the identity of beneficial owners in order to prevent money laundering and terrorist financing (point 279).

The judgment of 22 November 2022

What the Court decided

The Grand Chamber took only the first question in Case C-601/20 (para. 34). Its reasoning, which our Dutch review sets out step by step, can be summarised as follows. Public access to data on identified beneficial owners interferes with Articles 7 and 8 of the Charter (paras 38 to 40). The interference is serious: the data can be used to build a profile of a person’s wealth and investments, and become available to an unlimited number of people, including those with no anti-money-laundering purpose (paras 41 to 44). On that point the Court named Luxembourg:

That possibility is all the easier when, as is the case in Luxembourg, the data in question can be consulted on the internet.

The limitation was provided for by law, Article 30(9) being part of the legislative framework that sets the conditions for exemptions (paras 47 to 49), and it respected the essence of the rights (paras 50 to 54). Preventing money laundering and terrorist financing is an objective of general interest capable of justifying even serious interferences, whereas the principle of transparency in Articles 1 and 10 TEU and Article 15 TFEU, relied on by the Council, is not (paras 55 to 62). Public access was appropriate (para. 67), but not strictly necessary: the difficulty of defining “legitimate interest” was no reason to open the register to everyone (paras 68 to 72), and the press, civil society organisations connected with preventing and combating money laundering and terrorist financing, prospective counterparties, and financial institutions and authorities have a legitimate interest anyway (para. 74). Nor was it proportionate: the words “at least” and the option of additional information allowed data to be made public that were “not sufficiently defined and identifiable” (para. 82); combating money laundering is “as a priority a matter for the public authorities” and obliged entities (para. 83); and public access is a considerably more serious interference than the legitimate-interest regime, without offsetting benefits (para. 85).

Two passages matter particularly for the Luxembourg restriction procedure. The Parliament, the Council and the Commission relied on Article 30(9) as a safeguard (para. 79). The Court’s answer was that the optional provisions of Article 30(5a) and (9):

are not, in themselves, capable of demonstrating either a proper balance between the objective of general interest pursued and the fundamental rights enshrined in Articles 7 and 8 of the Charter, or the existence of sufficient safeguards enabling data subjects to protect their personal data effectively against the risks of abuse.

The existence of Article 15 of the RBE Law therefore did not save public access. Equally, the Court did not hold Article 30(9) invalid, and nothing in the judgment calls the exemption mechanism itself into question.

The ruling was that Article 1(15)(c) of Directive 2018/843 is invalid in so far as it amended point (c) of the first subparagraph of Article 30(5) of Directive 2015/849 so as to require that information on the beneficial ownership of companies and other legal entities be accessible in all cases to any member of the general public (para. 88 and the operative part).

What the Court left unanswered

The Court then disposed of the remaining questions in three short paragraphs:

The second question referred in Case C‑601/20 and the questions referred in Case C‑37/20 are based on the premiss that Article 30(5) of Directive 2015/849 as amended is valid, in so far as it provides for public access to information on beneficial ownership.

In view of the answer to the first question there was no need to examine those questions (para. 90), nor to adjudicate on the third question in Case C-601/20 (para. 91). The following were therefore not decided: - whether national law may define “exceptional circumstances” only by reference to the listed risks, and what the national court should do if it does (WM, Question 1); - whether “disproportionate risk” is a free-standing ground or qualifies each listed risk (WM, Question 2(a)); - whether relationships with other entities count in assessing the risk (WM, Question 2(b)); - whether information easily available elsewhere excludes a restriction (WM, Question 2(c)); - what interests are weighed in the disproportionality test (WM, Question 3); - the evidential threshold, and the validity of Article 30(9) on that reading (Sovim, Question 2); - all six GDPR questions, including the publication of the day and place of birth, the absence of monitoring and the lack of information to the beneficial owner (Sovim, Question 3).

The Court also said nothing about the validity of the third subparagraph of Article 30(5) as such, which the Advocate General would have struck down; it relied on the “at least” wording and the additional-information option only as reasons why the public-access rule in point (c) failed the proportionality test (paras 81 and 82). Costs were left to the tribunal d’arrondissement (para. 92).

One consequence is easy to miss. The premise of WM’s questions was a public register, against which a restriction under Article 15 was the only protection. Once public access fell, the questions lost their premise as far as the Court of Justice was concerned. They did not disappear from Luxembourg law: Article 15 still exists, and a restriction still matters against those who retain access.

The RBE Law then and now

Our translation is of the consolidation applicable from 1 February 2025. The amendment notes in our French text attribute changes to Articles 2, 5 to 9, 11 to 13, 15bis, 15ter, 16-2, 19quater and 20 to the Law of 23 January 2025, and changes to Article 1 to the Law of 25 March 2020 and the Law of 23 January 2025. No amending act is recorded against Articles 3, 14 or 15.

Purpose and data: Articles 2 and 3

Article 2 no longer speaks generally of retaining and making available information. It now states three purposes: to register beneficial owners, to keep the data, and to make information available for the fight against money laundering and terrorist financing, for statistical and scientific purposes and for any other purpose laid down by law. Article 3(1) is unchanged: the same thirteen items, including the day and place of birth, the precise address and the identification number, are filed.

Who has access: Articles 11 and 12

The text examined by the Court gave national authorities full access (Article 11(1)) and “any person” the identity and interest data (Article 12). Our current Article 11(1) instead opens the register to five categories: national authorities in the performance of their tasks; professionals applying customer due diligence under the AML Law, including with regard to entities with which their customers may enter into a transaction; national self-regulatory bodies; “persons who demonstrate a legitimate interest in the fight against money laundering and terrorist financing”; and State services, public administrations and public establishments for which access is provided by law.

Article 11(2) lists those with a legitimate interest, “in particular”: professional journalists, whether under the Law of 8 June 2004 on freedom of expression in the media or established in another Member State; non-profit organisations, associations or foundations established in an EU Member State whose object is preventing and combating money laundering and terrorist financing; persons who wish to know the beneficial owners of a company because they may enter into transactions with it and want to avoid any link with money laundering; and national authorities involved in combating those offences, to the extent that they do not already have access. The list follows paragraph 74 of the judgment closely, down to the proviso about authorities that “do not already have access”.

Article 12(1) distinguishes breadth of access. Authorities, professionals, self-regulatory bodies, State services, journalists, the non-profit bodies and the authorities in Article 11(2), point 4°, have access to information on all entities; other persons only to the entities that are the direct subject of their searches or with which they may enter into transactions (our translation notes that the cross-reference to “paragraph 2, point 3°” must be read as Article 11(2), point 3°). Article 12(2) then gives national authorities all the Article 3 information and every other user the information in Article 3(1), points 1° to 8°, 12° and 13°. That is the same set that the old Article 12 opened to “any person”. The day of birth and the place of birth therefore remain visible to every user other than national authorities. Sovim’s Question 3(c) challenged exactly those items, and the Court did not answer it.

How access works: Articles 13, 15bis, 15ter and 19quater

A legitimate-interest applicant now goes through Article 15bis. The application may concern only entities directly connected with the applicant’s research or investigations, not all registered entities, and may search only by RCS number or name (Article 15bis(1), which excepts the persons in “paragraph 2, points 1°, 2° or 4°”, read, as our translation notes, as Article 11(2)). It must identify the applicant, the entities and the basis of the application and the uses intended, with supporting documents, on pain of nullity (Article 15bis(2)). LBR decides on the opinion of a consultative commission established by Article 15ter and must take into account “the protection of the fundamental rights of persons, in particular the right to privacy and the right to the protection of personal data” (Article 15bis(3)). The applicant may not use the information for purposes other than those stated and accepted (Article 15bis(4)), and a refusal can be challenged by a recours en réformation before the Tribunal administratif (Administrative Tribunal) within one month (Article 15bis(6)).

Article 13(2bis) requires access by anyone other than national authorities to be secured by strong authentication and to be traceable: who searched, what was consulted, the date, time, file reference and “the precise reason for the search”, with logs kept for five years. These provisions respond on their face to several of Sovim’s complaints (no account, no monitoring, no justification, no purpose control), and to the Advocate General’s view that the register keeper must know who consults it. They go further than the Advocate General in one respect and less far in another. Further, because access now depends on a legitimate interest, a condition whose removal the Advocate General thought strictly necessary (point 177). Less far, because Article 13(3) forbids LBR to tell registered entities or beneficial owners anything about searches by authorities, professionals, self-regulatory bodies and legitimate-interest users, and requires consultation without alerting them. A beneficial owner’s right of access under Article 15 GDPR to information on those searches is deferred and limited, and must be exercised through the National Commission for Data Protection, which confirms that it has done so “without giving any further details” (Article 19quater(2)). That is consistent with the Advocate General’s view that notification could deter access and alert suspects (point 179), but it means the recital 38 option of telling the beneficial owner who asked has not been taken up for those categories.

Restriction of access: Article 15

Article 15(1) and 15(2) in our current text correspond to the provisions quoted by the Court at paragraph 19, and our consolidation records no amending act against Article 15. The French text keeps the structure that troubled the referring court: access must expose the beneficial owner “à un risque disproportionné, au risque de fraude, d’enlèvement, de chantage, d’extorsion, de harcèlement, de violence ou intimidation”. None of WM’s questions on that wording has been answered by the Court of Justice.

Article 15 contains three paragraphs that neither the Court nor the Advocate General quoted. Article 15(3) limits a restriction to the duration of the circumstances that justify it and to a maximum of three years, renewable on a reasoned application sent no later than one month before expiry. Article 15(4) requires LBR to publish in the register a notice of the restriction and the date of the decision. Under Article 15(5), any interested party may challenge a decision under paragraph 2 or 3 within 15 days of publication of the notice, by the appeal in Article 7(3): to the judge presiding over the chamber of the District Court sitting in commercial matters or the President of the District Court sitting in civil matters, decided as in summary proceedings. Article 7 was itself amended in 2025, so our text does not show which route applied when WM and Sovim sued; the sources say only that they brought their actions before the tribunal d’arrondissement and that the challenges for WM’s other companies were before the President of its Commercial Division (footnote 8). By contrast, other administrative decisions of LBR go to the Tribunal administratif within three months under Article 7(5), which excludes decisions under Article 15(2).

The function of Article 15 has changed even though its words have not. When WM and Sovim applied, a restriction kept the data away from the general public. Under the current Article 11, the persons left outside a restriction are those with access who are not national authorities, credit or financial institutions, bailiffs or notaries: other professionals under the AML Law, self-regulatory bodies, State services with statutory access and legitimate-interest users. Article 19 fits that picture: a registered entity must give professionals the information in Article 3, points 1° to 8°, 12° and 13°, on reasoned request within three days, “except where access to the information has been restricted under Article 15”. The provisional restriction under Article 15(2) still limits access to national authorities only, which is narrower than the final restriction.

How the pieces fit together

The judgment and the opinion do not conflict on the exemption system; they never meet on it. The Advocate General treated Article 30(9) as an integral safeguard that, read as an obligation, could save public access (points 223 and 228). The Court held that optional exemptions could not show the necessary balance (para. 86) and invalidated public access without interpreting Article 30(9) at all. His reading of the exemption was a step in an argument the Court rejected, and his answers to WM’s questions remain proposals, not law.

Three tensions follow for Luxembourg practice. First, the Advocate General’s guidance was written for a public register. His strict approach (exemptions as derogations, the public interest in general prevailing, the benchmark of risks to life, integrity and security of person) assumed that every member of the public could see the data. Now that only defined categories of users have access, each of them with a legitimate interest or a statutory duty, the balance he struck may not transfer unchanged; the sources do not say how a Luxembourg court would recalibrate it. Second, his view that information easily available elsewhere excludes an exemption (point 267) was argued in the setting of LBR’s case against WM, a beneficial owner whose role was in the press. Under the current law, a restriction would block access by persons who might otherwise only find the information in the register, so the point may weigh differently. Third, the Advocate General’s view that Luxembourg may define exceptional circumstances by reference to the listed risks (point 249) answers the referring court’s worry in Question 1(a) in Luxembourg’s favour, but it remains his view only.

The Court’s paragraph 74 and the Advocate General’s point 179 both have counterparts in the current text: the first in the categories of Article 11(2), the second in the non-disclosure of searches in Article 13(3). The Advocate General’s proposals on additional information have not: the day and place of birth remain available to every non-authority user under Article 12(2). Whether that survives scrutiny under the GDPR minimisation principle, which Sovim raised and the Court did not answer, is an open question on these sources.

What it means in practice

Filing has not changed. Nothing in the judgment touches the duty to file. Registered entities must still file all thirteen items in Article 3(1) within one month of the time they knew or should have known of the relevant event (Article 4(1)), keep the same information and supporting documents at the registered office (Article 17(2)), and face criminal fines of €1,250 to €1,250,000 for knowingly failing to file or filing inaccurate data (Article 20). Beneficial owners must give the entity what it needs, on pain of the same fine (Article 17(1), Article 21(3)).

A restriction application is still worth considering in the right case. A beneficial owner who faces real threats can apply under Article 15(1). Since the Court gave no guidance, the Advocate General’s opinion is the most detailed statement of what an application should contain, while being no more than a non-binding proposal: - specific, precise and substantial evidence of the threat, not a subjective perception or a remote or hypothetical risk (point 271); - evidence that the circumstances are out of the ordinary, with the risks to life, physical integrity and security of person as the benchmark (point 254); - where other holdings are relied on, proof that the beneficial ownership of those entities is relevant to the risk (point 265); - an account of what is already public about the person’s role, since information easily available elsewhere may defeat the application on his reading (point 267).

The burden is on the applicant, and LBR need not investigate on its own (point 269). In WM’s case each of the companies applied separately and the refusals were challenged in more than one set of proceedings (point 18 and footnote 8). Article 15(1) also allows the beneficial owner himself to apply; the text does not say whether one application may cover several entities.

Know what a restriction does now. A restriction lasts at most three years and must be renewed by reasoned application at least one month before it expires (Article 15(3)). A notice of it is published in the register (Article 15(4)), and any interested party may challenge it within 15 days of that notice (Article 15(5)). It does not keep the data from national authorities, credit and financial institutions, bailiffs or notaries, so banks will still see the identity and interest data in Article 3(1), points 1° to 8°, 12° and 13°. While an application or an appeal against a refusal is pending, access is limited to national authorities (Article 15(2)).

Expect searches you will not hear about. Journalists, non-profit bodies, prospective counterparties and others may obtain the identity and interest data if LBR accepts their legitimate interest under Article 15bis(3). The beneficial owner is not told of searches by those users, professionals or authorities (Article 13(3)), and may verify them only indirectly through the National Commission for Data Protection (Article 19quater(2)).

Counterparties and advisers. A business partner who wants to see the beneficial owners of a Luxembourg entity must now apply, identify itself and state the intended use (Article 15bis(2)), and may then use the information only for that purpose (Article 15bis(4)). Professionals consult the register directly in the course of customer due diligence (Article 11(1)) and must report discrepancies within thirty days (Article 8(1)).

Documents to keep. For each beneficial owner: the identity and address documents filed with LBR and kept at the registered office under Article 17; the documents showing the nature and extent of the interest; for any restriction, the application, the evidence submitted, LBR’s decision and the date of expiry; and for any refusal, the notification and the appeal papers, since the time limits run from notification or publication.

Status

The Court of Justice answered the first question in Case C-601/20; the two disputes remained before the tribunal d’arrondissement, which was to decide on costs (para. 92). The sources we used do not show how either Luxembourg case ended, or whether the tribunal d’arrondissement ruled on the Article 15 questions itself.

The legislative changes are visible in our data. The timeline on our act page records that LBR suspended public consultation after the judgment of 22 November 2022, and that the Law of 23 January 2025, in force on 1 February 2025, limited access to authorities, professionals and persons with a legitimate interest and introduced the verification procedure and administrative sanctions now in Article 9. The same timeline records a Grand-Ducal Regulation of 13 March 2025, in force on 24 March 2025, updating the 2019 implementing regulation, and Bill No. 8698 on the transposition of Directive (EU) 2024/1260 on asset recovery and confiscation, before the Chamber of Deputies in 2026, which would amend the RBE Law again. Our act page also notes that Regulation (EU) 2024/1624 applies from 10 July 2027 and, with Directive (EU) 2024/1640, will reshape beneficial ownership rules across the EU. Article 15 itself has not been amended in the consolidation we translate, so the questions WM put in January 2020 about its key terms remain open.

For the parallel Dutch litigation and the Dutch legislative response, see our review of the Dutch UBO register and public access.

Provisions discussed

• RBE Law: Art. 12, Art. 15

Related reviews

How to cite

Case law review by BCA EU, for information. Quotations from the judgments are our translations; only the original texts published by the courts are authoritative. Judgments checked on the official sources on 30 October 2026. This page is not legal or tax advice.