In a landmark decision on the 22/11/2022, the Court of Justice of the European Union (ECJ), in the Luxembourg cases C-37/20 and C-601/20, ruled the provision of the 4th Anti-Money Laundering Directive (EU) 2015/849 (AML Directive) granting access to the general public to private information regarding the ultimate beneficial owners of entities under Article 30(5) as well as the interpretation under the Article 30(9) on the protection of personal data, invalid.

Referring to the Charter of Fundamental Rights of the European Union (EU Charter), the ECJ ruled that the provision of the 4th AML Directive requiring Member States to ensure that the information published on the beneficial owner registers, be accessible in all cases to any member of the general public, is invalid.

The ECJ ruled that the above provision seriously intervenes to the fundamental rights that are protected under Articles 7 and 8 of the EU Charter, namely, the right for the respect of private life and family and the right to the protection of personal data. The ECJ noted that the availability of such information to the general public could enhance the information on the beneficial owner available to the public creating an extended corporate profile and information on their investment activities. This could result in extensive exposure, increasing the risk of vulnerability and abuse of personal data, while the AML provision fails to offer sufficient safeguards.

The ECJ reached its decision by applying the principle of "proportionality", ruling that allowing public access to information on beneficial owners is not limited to what is strictly necessary, and as such, inevitably, disproportionately harmful to the benefit may bring.

How does the decision affect Member States:

Member States have enacted and continue to update national law adopting the 5th AML Directive. It is expected that this decision will prompt the European Commission to give further guidance;

The European Commission, the Luxembourg Government and the Chambre des Députés, in response to the decision have reportedly stated they will "now draw conclusion on this decision" by reference to the implementation of the 5th AML Directive. The Luxembourg Ministry of Justice has reportedly stated that it will comply with European case law;

The Cypriot Ministry of Justice is yet to take a position on this development. It is expected this is pending further guidance by the European Commission, however compliance with European case law, is a requirement.

At present, a register of beneficial owners of companies is maintained by the Cypriot Registrar of Companies and Intellectual Property, and a register of beneficiaries of express trust and other settlements, is maintained by the Cyprus Securities and Exchange Commission. These registers implement the Directives (P.I 112/2021 and P.I 317/2021) for the Prevention and Suppression of Money Laundering and Terrorist Financing (Beneficial Owners) of 2021, as updated in July 2022, enacting the operation of the registers of beneficial owner of corporate and other legal entities.

As of the date of this article, and as reported in the Financial Times (https://www.ft.com/content/e4b31a4e-a79d-40f7-8a19-c1e451a95c4b) the online registers of beneficial owners in Luxembourg and the Netherlands, appear to be temporarily suspended.

On 28/11/2022 the Cypriot Registrar of Companies issued an announcement suspending public access to the beneficial owners' register with effect as of 23/11/2022, a day following the ECJ's landmark decision.

What type of information is required to be disclosed in the public registers?

The balancing act which the ECJ was called to achieve, was to align the fundamental freedoms, safeguarded by the EU Charter, i.e. the right for the respect for private life and family and the right to the protection of personal data with the AML's requirement to protect the public against money laundering for tax evasion and terrorist financing. Both EU legal protections collide given the overlap between the information both laws are set to protect, albeit for different reasons and from different angles. As per the AML directive, amongst the information required to be disclosed in the publicly available registers are the beneficial owners', full names, date of births, nationalities, residential addresses, identification documents and country of issue (i.e. ID cards or passports).

What is to be expected moving forward?

Providers of legal and fiduciary services continue to be under an obligation to disclose the beneficial owners of entities they administer, under the AML requirements. At the same time, beneficial owners' whose personal data have been published may consider resorting to justice for damages suffered as a result of what could be deemed "unauthorised disclosures" or breach of the rights afforded by the EU Charter.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.