A family that has held everything in one country for three generations has a privacy position it never had to think about. The bank knows, the notary knows, the accountant knows, and nobody else does. Then a business is sold, the proceeds are deployed across Europe, and within eighteen months there are companies in five or six jurisdictions, each with its own register, its own filing calendar and its own idea of what the public is entitled to see.
Nobody warned them, because each individual step looked routine. The privacy loss is not caused by any one company. It is caused by the arithmetic of holding six of them, in six systems that are increasingly connected to each other. Understanding what is actually visible, to whom, is the first step. Deciding what is worth protecting is the second, and it is the harder of the two.
What actually changes when the map spreads
The first change is the number of places where the family name is written down. Article 30 of Directive (EU) 2015/849, the fourth anti money laundering directive, requires each member state to ensure that corporate and other legal entities incorporated in its territory hold adequate, accurate and current information on their beneficial ownership, and that the information is held in a central register in that member state. Every incorporation therefore adds an entity with directors, an address and a beneficial owner declaration, filed under national rules that decide what is shown and to whom.
The second change is that the entities refer to each other. A holding in one country lists a subsidiary in another. An annual account discloses a participation. A property register names a company, and the company register names the people behind the company. Once there are six of these, an outsider with patience can reconstruct most of the structure without any privileged access at all.
The third change is that the family becomes a subject of cross border processes that were designed for other people. Anti money laundering rules written for banks apply to the family’s own service providers. Tax transparency instruments written for offshore evasion apply to a perfectly ordinary account in a neighbouring member state. None of this is aimed at the family, and all of it captures them.
The beneficial ownership register and the twenty five per cent line
Article 3(6)(a)(i) of the 2015 directive provides that a shareholding of 25 per cent plus one share, or an ownership interest of more than 25 per cent, held by a natural person, is an indication of direct ownership, and that the same holding through one or more corporate entities controlled by the same person is an indication of indirect ownership. Member states may set a lower percentage. The same provision carves out companies listed on a regulated market with equivalent disclosure obligations, which is a limit families overlook when they reason from the listed world to their own.
Families read that threshold as a design parameter and try to structure below it. That is usually a mistake. The definition also captures control via other means, so a person who sits below the percentage but controls the entity through voting arrangements, board appointment rights or shareholder agreements is still a beneficial owner. Structures built to fall just under a line tend to attract exactly the attention they were meant to avoid.
The new package does not soften this. Regulation (EU) 2024/1624 of 31 May 2024 defines an ownership interest, at article 52(1), as direct or indirect ownership of 25 per cent or more of the shares, voting rights or other ownership interest, and article 51 requires control via other means to be identified independently of and in parallel to the ownership test, not as a fallback once the percentage has been checked and found wanting. Under article 52(2) the power to go lower moves to the Commission, by delegated act, for categories of entity associated with higher risk, capped at 15 per cent unless a higher figure is more proportionate and in any event below 25 per cent. The Regulation applies from 10 July 2027, except for football agents and professional football clubs, for which it applies from 10 July 2029. It is accompanied by Directive (EU) 2024/1640 on the mechanisms member states must put in place.
What the Court of Justice actually decided in 2022
The single most misunderstood event in this area is the judgment of the Grand Chamber of 22 November 2022 in joined cases C-37/20 and C-601/20. What the Court declared invalid was narrower than the summaries suggest. It was article 1(15)(c) of Directive (EU) 2018/843, and only in so far as that provision had amended point (c) of the first subparagraph of article 30(5) of the 2015 directive so as to require that beneficial ownership information be accessible in all cases to any member of the general public.
The reasoning matters more than the outcome. At paragraph 44 the Court held that the general public’s access is a serious interference with the rights in articles 7 and 8 of the Charter, respect for private life and protection of personal data. It accepted that preventing money laundering is an objective capable of justifying even serious interferences, then found this one neither limited to what is strictly necessary nor proportionate, not least because the earlier regime, which gave access to any person able to demonstrate a legitimate interest, had been considerably less intrusive. It did not hold that registers were unlawful, or that the objective was illegitimate.
Because the replacement was left to national design, the position of a family with entities in several countries cannot be stated in one sentence. A family whose entities were registered before that judgment should work on the assumption that their information was, for a period, openly accessible in at least some of those jurisdictions, and that copies taken then still sit in commercial databases.
The register is narrower now, not closed
What replaced open access is access by category, and Directive (EU) 2024/1640 frames it at European level. Article 11 gives competent authorities, including tax authorities, immediate, unfiltered, direct and free access to the interconnected registers without alerting the entity, and requires that obliged entities have timely access when taking customer due diligence measures, subject to a fee that may not exceed cost.
Article 12 is the provision families should read. It gives access to any natural or legal person who can demonstrate a legitimate interest in preventing and combating money laundering, its predicate offences and terrorist financing, and it fixes what that person sees: name, month and year of birth, country of residence and nationalities, and the nature and extent of the interest held. Journalists, civil society organisations including academia, and persons likely to enter into a transaction with the entity are deemed to have that interest rather than having to argue it. Articles 11, 12, 13 and 15 had to be in force by 10 July 2026, a year before the deadline for the rest of the directive. So the counter has not closed; it has become a door with a keeper. A structure that would embarrass the family in a newspaper is not protected by the end of public access, because journalists are inside the category. It is protected only by the structure not being embarrassing.
One further mechanism comes from the same directive the Court cut down, and survived it. Point (9)(a) of Directive (EU) 2018/843 added a sentence to article 14(1) of the 2015 directive requiring an obliged entity, whenever it enters into a new business relationship with a corporate or other legal entity, or a trust or similar arrangement, that is subject to registration of beneficial ownership information under article 30 or 31, to collect proof of registration or an excerpt of the register. What the 2022 judgment invalidated was a different provision of that directive, point (15)(c), so this obligation stands. Every new bank account, notarial deed and professional engagement is another point at which ownership is documented in a file kept for years.
Six countries, six different answers
The European framework sets the outer limits. What a family experiences is decided country by country, and none of these six can be inferred from a neighbour.
In the Netherlands, article 15a of the Handelsregisterwet 2007 records beneficial owners only of entities that are themselves registered in the Dutch trade register, so it never resolves a foreign ownership chain for anyone. It splits the data in two: on one side name, month and year of birth, country of residence, nationality, and the nature and band of the interest; on the other the day of birth, place and country of birth, residential address and citizen service number. Article 22a opens only the first set, and opens it to institutions performing mandatory customer due diligence under the money laundering act or obligations under the sanctions act. Legitimate interest access sits in paragraph 2 of the same article, but only for categories of persons to be designated by general administrative order, so its reach depends on that decree rather than on the statute alone. Paragraph 3 then requires the chamber of commerce, where such a request is granted, to tell the beneficial owner that it was granted and for what purpose.
In Germany, section 23 of the Geldwäschegesetz allows inspection by authorities and courts, by obliged entities that show the inspection serves their due diligence, and by anyone who proves a legitimate interest. For that third group the data set is cut down: besides the name and the nature and extent of the economic interest, only the month and year of birth, the country of residence and all nationalities may be seen, so the full date of birth and the place of residence stay closed. Section 23(2) gives the beneficial owner a shield, but one that must be applied for in advance and that is tightly conditioned. It is available where inspection would expose the person to the risk of fraud, kidnapping for extortion, hostage taking, extortion, an offence against life or limb, coercion or threat, or where the person is a minor or lacks legal capacity. It does not operate against authorities, courts, credit and financial institutions or notaries, and it is unavailable where the same data already appear in the registers listed in section 22(1). Section 23(8) then lets the owner ask for a report of the legitimate interest inspections, giving the dates, an anonymised list of the individuals who looked and the names of any legal persons.
In France, article L561-46-2 of the Code monétaire et financier, created by the law of 30 April 2025 and in force since 3 May 2025, opens a wider set: name, name in use, pseudonym, first names, month and year of birth, state of residence, ownership chain, historical data and nationality, with the nature and extent of the interests. Thirteen categories are presumed to have the interest, from journalists and academic researchers to public procurement buyers and members of parliament. The request goes to the keeper of the national register of undertakings or the competent court registrar, who verifies and rules on it, free of charge. Paragraph III then requires consultations to be logged and allows the beneficial owner to ask who consulted, except that where the consultation was by a journalist, a non profit body or an academic researcher the answer gives only that person’s profession. The personal home address, although declared to the register under article L561-46, is not among the information opened on the legitimate interest route.
In Belgium, article 75 of the law of 18 September 2017 lists who may consult the UBO register: competent authorities without restriction, the authorities responsible for embargoes and asset freezes, federal, community and regional authorities charged with tracing or checking beneficial owners, obliged entities in the course of customer due diligence, and any natural or legal person able to demonstrate a legitimate interest. That last category reaches only the data the King determines, so the Belgian answer, like the Dutch one, is completed by a decree. Consultation is free.
In Luxembourg, the law of 13 January 2019 on the register of beneficial owners, in the consolidated version applicable since 1 February 2025 following the amending law of 23 January 2025, opens the register to national authorities, to professionals performing customer due diligence, to self regulatory bodies, to persons demonstrating a legitimate interest, and to state services given access by law. Article 12 sets two data sets: national authorities see everything recorded, while everyone else sees the name, first names, nationalities, dates and place of birth, country of residence and the nature and extent of the interests, stopping short of the precise private address and the identification number. Article 15bis then restricts browsing, but not for everyone: a legitimate interest applicant must confine the request to entities directly connected with its research, searchable only by registration number or name, unless it is a professional journalist, a qualifying non profit organisation or a national authority within article 11(2), and those three reach the whole register under article 12(1). Where the restriction applies, the manager of the register decides on the advice of a consultative commission. Luxembourg then runs opposite to France on who learns that someone looked: article 13(3) provides that no information about such a consultation may be communicated to the entity or to its beneficial owners, and the data subject’s own access request is routed through the national data protection commission, which confirms only that it has exercised the right. Article 15 allows the entity or the owner to ask, case by case and in exceptional circumstances, that access be limited to national authorities, credit and financial institutions, bailiffs and notaries, where access would expose the owner to a disproportionate risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation, or where the owner is a minor or otherwise incapable, for a maximum of three years.
Ireland has moved most recently. The 2019 regulations were amended by the European Union (Anti-Money Laundering: Beneficial Ownership of Corporate Entities) (Amendment) Regulations 2026, made on 4 August 2026 to give effect to articles 11, 12, 13 and 15 of Directive (EU) 2024/1640. Legitimate interest access there is no longer a search but a certificate. The Registrar weighs the documents supplied, the applicant’s function or occupation and, except for journalists and civil society organisations, the connection between the applicant and the specific entity, and if satisfied issues a certificate valid for three years. The holder sees the name, month and year of birth, country of residence and nationality, and a statement of the nature and extent of the interest, with historical information and the ownership structure for journalists, civil society organisations and third country authorities. Refusals and revocations must be reasoned and can be appealed to the District Court. Where the information relates to a minor, a person lacking capacity, or a person who would face a disproportionate risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation, an assistant registrar must require the applicant to justify disclosure in the public interest. As in France, an owner who asks who inspected receives the occupation of a journalist or civil society inspector, not the identity.
Read together, those six answer the same European rules differently on the points a family cares about: which fields are opened, whether the applicant must name the entity it is asking about and which applicants are exempt from that limit, who decides and on what evidence, whether protection must be applied for in advance or is triggered when someone asks, and whether the owner ever learns that a search took place. On that last point the Netherlands notifies, Germany reports on request, France names the searcher with an exception for journalists, Ireland gives the occupation but not the name, and Luxembourg forbids the disclosure. Advice that treats Europe as a single register will be wrong somewhere.
Automatic exchange means the account itself is already reported
Registers describe ownership of entities. A separate system describes the accounts. Council Directive 2014/107/EU of 9 December 2014 extended mandatory automatic exchange of information in the field of taxation to financial account information. Member states had to adopt the implementing measures by 31 December 2015 and apply them from 1 January 2016, with Austria applying them from 1 January 2017 for taxable periods from that date.
What is exchanged is specific, and the specifics have conditions. The account holder is identified by name, address, tax identification number and date and place of birth, and where the holder is an entity with reportable controlling persons, both the entity and those persons are identified. The account number and the reporting institution are identified. The balance or value at the end of the calendar year is reported, or the closure of the account if it was closed during the year. Gross interest, dividends, other income and the total gross proceeds from the sale or redemption of financial assets are reported for custodial accounts; for a depository account it is gross interest; for anything else it is the gross amount paid or credited to the holder. The rules were built to be fully consistent with the Common Reporting Standard developed by the OECD, as recital 9 of the directive records, which is why the pattern is familiar well beyond the Union.
The implication for a family with assets in six countries is blunt. Their country of residence receives, once a year and without anyone asking, a description of the accounts held elsewhere in the network. Privacy planning that assumes a tax authority does not know about a foreign account inside this system is not planning. It is a delay before a correction.
The digital footprint of every company you own
Beyond the formal systems, each entity leaves traces that no directive requires. A registered office address appears in a filing and turns out to be a private home. Annual accounts published in one jurisdiction disclose a shareholding the family assumed was private in another. The register itself may hold back the residential address, as the Dutch and Luxembourg provisions do, while an entirely different filing gives it away.
Commercial data providers aggregate what they can reach. They collect registry data at scale, they retain historic snapshots, and they do not remove information because a national register later restricted access. A family that has been visible for one year is, for practical purposes, findable for many more.
Then there is the operational layer, which is the one that creates risk to people rather than to reputation. Property records that name individuals, vehicle registrations, school addresses, travel patterns visible from social media, and the digital hygiene of the household staff and the family office itself. In our experience the serious incidents in this field begin in that layer, not in a company register.
What is worth protecting and what is not
The useful question is not how to be invisible. It is which specific disclosure would cause a specific harm. Three categories usually justify real effort. Residential addresses of individuals, because they map to physical security. The identity of minors, because they cannot manage their own exposure. And commercially sensitive positions, such as a stake being built, where premature disclosure has a direct price.
Two of those three are recognised by the law itself, but only where a country has written them in and only on that country’s terms. Germany shields an owner who shows a risk of kidnapping, extortion or violence, or who is a minor or lacks capacity, but not against authorities, courts, banks or notaries, and not where the data already sit in another register. Luxembourg allows a comparable limitation for at most three years, still leaving national authorities, banks, bailiffs and notaries with access. Ireland requires an applicant who would reach a minor, a person lacking capacity or a person at disproportionate risk to justify disclosure in the public interest. These are real protections worth using, but none makes a person invisible, and each has to be claimed under the procedure of the country where the entity sits.
Several other categories do not justify the effort, however uncomfortable they feel. The existence of a holding company. The name of a family member on a board. The country in which a portfolio is managed. Attempts to conceal these tend to cost more in professional fees and friction than the disclosure would ever have cost, and they often make the family look as if it had something else to hide.
The legitimate tools are unglamorous. Registered office addresses that are professional rather than residential. Correspondence addresses used consistently. The statutory protection regimes above, claimed where the national register provides one and the facts genuinely support the application. Clean, boring structures with few entities, because every entity removed is a set of filings removed. And a disciplined approach to who inside the family office holds what information.
Total opacity is no longer an available option
Some families arrive with a different question, which is how to hold assets in Europe without appearing anywhere. The honest answer is that the option no longer exists, and that pursuing it now buys the worst of both outcomes: the structure is still visible to authorities and to regulated intermediaries, and it additionally looks evasive.
The regulatory architecture assumes identification. Banks cannot open the account without it. Notaries cannot execute the deed without it. Registers require it. The anti money laundering regulation that applies from 10 July 2027 tightens rather than loosens the requirement. A family adviser who promises invisibility inside the European Union in 2026 is either describing something illegal or describing something that will fail.
What remains available, and what is worth doing well, is control over the shape of the disclosure. Accurate filings, made on time, that say exactly what is required and nothing more. A structure simple enough to explain in one paragraph. Consistent information across six jurisdictions, so that no discrepancy invites a second look. That is not a consolation prize. A family that is visible in an orderly way is far less interesting to everyone than a family that is visible in a confusing one.
This article is informational and does not constitute tax or legal advice. The treatment of any structure depends on its facts and on the law of each jurisdiction involved. Each engagement is subject to scope and applicable regulation.