Ask an adviser today who can see a beneficial ownership register and the answer will usually be a version of the position in 2021. That position has been overturned twice, in opposite directions, in two of the three jurisdictions that matter most to a European structure. What survived is not a compromise between openness and privacy. It is a specific mechanism with categories, data items, deadlines and a certificate, and a structure planned against the older understanding will be planned wrongly.
This piece sets out where access actually stands, in the European Union after the Court of Justice ruling and the legislation that replaced the invalidated provision, in the Netherlands as the domestic implementation now reads, in the United Kingdom, in the United States after a reversal that happened this month, and in the two offshore registers most likely to matter.
The judgment, and what it actually held
On 22 November 2022 the Court of Justice ruled in joined cases C-37/20 and C-601/20, brought by a beneficial owner and a company against Luxembourg Business Registers. It held that article 1(15)(c) of the fifth anti-money-laundering directive was invalid in so far as it required Member States to ensure that beneficial ownership information was accessible in all cases to any member of the general public.
The reasoning is narrower than the headline. The Court accepted that combating money laundering and terrorist financing can justify serious interference with the rights to private life and to protection of personal data. It found the measure disproportionate rather than illegitimate. Public access reveals wealth and investment patterns and exposes the individual to abuse, and the earlier regime, which required a legitimate interest, achieved the objective with materially less interference. That legitimate interest had proved difficult to define was not, in the Court’s view, a reason to abandon it.
The distinction matters because it tells you what the replacement had to look like. Not secrecy, and not general access, but a defined class of persons with a defined interest, receiving a defined subset of the data.
Legitimate interest, defined by category rather than argued case by case
The 2024 directive does exactly that. Any natural or legal person who can demonstrate a legitimate interest in the prevention and combating of money laundering, its predicate offences and terrorist financing has access, and the access is granted without alerting the entity or arrangement concerned.
The legislature then removed most of the argument by deeming ten categories to have that interest. Persons acting for the purpose of journalism or reporting connected with those objectives. Civil society organizations, including non-governmental organizations and academia, similarly connected. Persons likely to enter into a transaction with the entity who wish to prevent a link between that transaction and money laundering. Entities subject to anti-money-laundering requirements in third countries performing due diligence. Third-country counterparts of Union competent authorities, in the context of a specific case. Authorities responsible for company registration and for scrutinizing the legality of conversions, mergers and divisions. Programme authorities for Union funds and for the Recovery and Resilience Facility. Public authorities in procurement procedures, in respect of tenderers and the awarded operator. And providers of anti-money-laundering products, where the product goes only to obliged entities or competent authorities.
Beyond those, Member States must grant access on a case-by-case basis to anyone else who can demonstrate the interest. Member States were required to notify the Commission by 10 July 2026 of the public authorities entitled to consult and of any additional categories they had recognized.
Five items, and what is no longer visible
The subset is short. A person with a legitimate interest sees the beneficial owner’s name, the month and year of birth, the country of residence and the nationality or nationalities, and, for a legal entity, the nature and extent of the beneficial interest held. For an express trust or similar arrangement, the nature of the beneficial interest.
Three categories, journalists, civil society organizations and third-country counterparts of Union competent authorities, also receive historical information, including for entities dissolved in the preceding five years, together with a description of the control or ownership structure.
What is absent from that list is the day of birth, the place of birth, the residential address and any identification number. Those are held by the register and are available to competent authorities, but they no longer travel with a legitimate-interest disclosure. The practical effect is that a legitimate-interest search identifies a person sufficiently to be useful and insufficiently to be actionable against them personally, which is what the Court’s proportionality reasoning required.
Access is a certificate with a lifespan
The procedural layer is where the regime becomes operational. The register verifies the applicant’s identity on every access, using electronic identification where available, and verifies the legitimate interest from documents the applicant supplies.
From 10 November 2026 the register must respond within twelve working days, extendable by twelve more in the event of a sudden high volume and by a further twelve if it persists. Where access is granted, the register issues a certificate granting access for three years, and subsequent requests by the same person are answered within seven working days. A legitimate interest verified by the register of one Member State is recognized by the others for the applicant’s function or occupation.
Refusal is available only on stated grounds, including failure to supply the required material, failure to demonstrate the interest, a reasonable concern that the information will be used for an unconnected purpose, and the exemption regime. That regime allows a Member State to withhold all or part of the personal information in exceptional circumstances where access would expose the beneficial owner to a disproportionate risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation, or where the beneficial owner is a minor or otherwise legally incapable, granted case by case with administrative review and a judicial remedy.
The registers also record who accessed what, and must disclose that to the beneficial owner on a data subject access request. The identity of a journalist or civil society organization is protected there, replaced by the function or occupation.
The Netherlands, and a design choice worth noticing
The Dutch implementation is already in the statute book. Article 15a of the Handelsregisterwet 2007 records, for each beneficial owner, the citizen service number or a foreign tax identification number, the name, month and year of birth, country of residence and nationality, the day, place and country of birth and the residential address, and the nature and extent of the economic interest held, expressed in classes fixed by decree. Copies of the documents verifying that information are deposited.
Article 22a splits access. Institutions subject to the anti-money-laundering act performing customer due diligence, and institutions under the sanctions act, may inspect the name, month and year of birth, country of residence and nationality, together with the nature and extent of the interest. Categories of persons with a demonstrable legitimate interest designated by decree may inspect the same items on request.
One feature of the Dutch text is not obvious from the directive. Where such a request is granted, the chamber of commerce must inform the beneficial owner whose data was requested, and inform them of the purpose the request serves. The directive requires access to be granted without alerting the entity or arrangement, and separately protects the identity of journalists and civil society organizations when a beneficial owner exercises a data subject access right. How the notification duty interacts with those provisions is a question for the facts of a given case, and advisers to a Dutch holding should have a view on it before it arises.
The United Kingdom went the other way
The British position is often described as an unchanged public register, and the description is right in effect and wrong in mechanism.
Part 21A Chapter 3 of the Companies Act 2006, which required a company to keep its own register of people with significant control and gave rights to inspect it, was omitted by the Economic Crime and Corporate Transparency Act 2023, fully in force from 18 November 2025. The obligation and the public visibility now sit at the central register maintained by Companies House rather than at the company.
That is a consolidation, not a retreat. It also moves the point of contact: a person seeking information no longer approaches the company, and the company no longer learns who asked.
The United States reversed, and it did so this month
The most recent movement is the largest. On 11 August 2026 the Financial Crimes Enforcement Network issued a final rule, effective 14 August 2026, making permanent the exemptions first introduced by an interim final rule published on 26 March 2025 and extending them further.
Under that rule, United States companies are exempt from beneficial ownership information reporting and are no longer required to file. Only certain foreign companies registered to do business in the United States must report, and those companies need not report beneficial ownership information for United States person beneficial owners or company applicants. United States persons need not provide their information to reporting companies, and those holding an identifier are not required to update or correct what they previously submitted.
For a European group with a United States subsidiary, the American leg of the transparency architecture has largely been switched off while the European leg is being switched on. Planning that assumed convergence now has to assume divergence.
What this means for a structure
The register question is no longer a single question with a global answer, and three habits should change with it.
Assume the European data is reachable by anyone with a category rather than by anyone at all, which includes a counterparty who is merely likely to enter into a transaction with the entity. That is a wide door, and it is the one most likely to be used against a live negotiation.
Assume the historical data is reachable too. Journalists, civil society organizations and third-country authorities see five years of history and a description of the ownership structure, so a chain unwound last year is still visible. Restructuring on the eve of a transaction does not clear the record.
And assume divergence rather than harmonization. A structure that touches the Union, the United Kingdom and the United States now sits across three regimes moving on different timetables and in different directions, with the Union’s own deadlines running from July 2025 to July 2029.
The offshore registers move on a fourth timetable, and no longer together. The British Virgin Islands opened a legitimate interest route on 1 April 2026. The registered agent is notified of a request, has five days to file an objection and five more to oppose disclosure, and the appeal route runs from there, so the entity learns it was asked about and can contest the answer. The Cayman Islands has not gone that far. Its Act opens the search platform to a listed set of authorities, with narrower fields for financial institutions and obliged businesses, and leaves public access as a power the Cabinet may exercise by regulations approved in Parliament, which it has not.