By a decision rendered on 22 November 2022, the European Court of Justice (the Court) invalidates the provision of the anti-money laundering directive (AMLD)1 whereby the information on the beneficial owners of corporate and other legal entities established in the EU must be made accessible to the public2. The Court decided that such public access to personal information constitutes a “serious interference with the fundamental rights to respect for private life and to the protection of personal data” which “is neither limited to what is strictly necessary nor proportionate to the objective pursued”.
This decision has practical implications, not only in Luxembourg but also in the other EU Member States:
- The decision has a direct effect, which means that public authorities and national courts need to abide by the conclusions of the Court.
- The Luxembourg Business Register (LBR) immediately decided to provisionally suspend the public access to the Register of Beneficial Owners (RBE). Equivalent registers in a number of other European countries have followed suit in the meantime.
- The invalidation of the accessibility rules set out in article 30 (5) (c) AMLD does not abrogate the amended Luxembourg law of 13 January 2019 on the creation of the register of beneficial owners (the RBE Law).
- Furthermore, this decision does not relieve professionals in scope (the Professionals) of the Luxembourg law of 12 November 2004 on the fight against money laundering and terrorism financing, as amended (the AML Law 2004) from their obligation to identify and verify the identity of their clients’ beneficial owners.
- The LBR is already working on a solution for professionals to have a dedicated access to the RBE.
- The AMLD should now be amended to reflect the Court’s decision.
1. The decision has a direct effect at national and european level
The decision at hand comes in response to a request for a preliminary ruling introduced by the Luxembourg District Court in the context of two cases opposing on the one hand a Luxembourg company and its beneficial owner (the Claimants), and on the other hand the LBR, following a decision by the latter to reject the Claimants’ request to restrict public access to the beneficial ownership information published in the RBE. Further to the Court’s decision, both cases will be brought back before the Luxembourg District Court which will have to consider this public access provision as invalid for the purpose of the decision to be rendered as to the substance of the cases.
Insofar as the decision was issued by the Court, it has a direct effect, which means that public authorities in all EU Member States have to draw the consequences in their legal order from the declaration of such invalidity. The ruling is also binding on all the national courts of the Member States.
The decision of invalidity is furthermore retroactive, which means that the provision of the AMLD on the public access to beneficial ownership information is deemed to be invalid as from the time it was adopted in 2018.
2. The access to the luxembourg rbe is already suspended
The RBE is an official business register in which relevant information on the ultimate beneficial owners of corporate and other legal entities incorporated in Luxembourg, as exhaustively referred to in the RBE Law, (the Obliged Entities) must be registered. The RBE enables the national authorities, Professionals and more generally the public to have access to information on such beneficial owners.
The Court recognises that such public access pursues an objective of general interest which could justify even serious inferences with the fundamental rights guaranteed in Articles 7 and 8 of the Charter 3. Article 30 (5) (c) of the AMLD, by rendering a certain amount of information public and thus increasing the transparency, creates an environment less likely to be used for money laundering or terrorist financing. However, the Court concludes that the information disclosed is accessible in all cases to the public and consequently anybody can obtain information on the identity and financial situation of a beneficial owner which “is neither limited to what is strictly necessary nor proportionate to the objective pursued”.
Following the decision, the LBR and the Ministry of Justice announced in a press release that public online access to the RBE is suspended until further notice. It should be noted that this suspension does not apply to the competent national authorities which benefit from a dedicated access via an intranet portal, allowing them to continue to carry out the tasks incumbent on them in the fight against money laundering and terrorism financing.
3. Obliged entities must still comply with their obligations under the rbe law
As mentioned above, the decision of the Court does not abrogate the RBE Law and all obligations contained therein remain applicable for the time being. Consequently, all Obliged Entities must continue filing the relevant information and documents with the RBE (new entities, updates, etc.). The filing functionality has not, to our knowledge, been suspended.
4. Professionals must still comply with their obligations to identify and verify the identity of their clients’ beneficial owners under the aml law 2004 and to notify discrepancies in beneficial ownership information under the rbe law
All obligations under the AML Act 2004 remain applicable, which includes the obligation for each Professional, when facing a client which is a legal person established in a Member State having a register of beneficial owners in place, to obtain proof of registration or an excerpt of the relevant register and to compare this information with the information it has in its files. 4
As the access to the RBE is currently suspended, Professionals cannot, for the time being, obtain an extract of the RBE for their Luxembourg clients subject to a registration obligation under the RBE Law (and we understand that similar restrictions currently apply in a number of other European jurisdictions). In the meantime, Professionals should obtain proof of registration or a copy of the RBE extract (if available) from their clients.
Finally, in addition to the obligation to collect proof of registration/an RBE extract, Professionals must notify the RBE where there are inconsistencies between the information in their KYC file and the information filed in the RBE. As the RBE Law is still in force, Professionals must continue complying with this obligation, although this verification will be carried out on the basis of the extracts received from the client rather than directly from information contained in the RBE.
5. The LBR is already working on a solution for professionals to have a dedicated access to the rbe
Further to the Parliamentary Justice Committee meeting, the Ministry of Justice, the LBR and the State Information Technology Center (CTIE) announced working on a technical and legal solution which would be in line with the European case law. It can be expected that the solution would allow easy access to the register to Professionals5. The proposed solution will need to comply with the conditions laid down in the decision and in particular provide sufficient safeguards enabling data subjects to protect their personal data effectively against the risks of abuse.
It will be noteworthy to see if the proposed solution will allow access not only to Professionals but also to persons capable of demonstrating a legitimate interest in accessing this information (as was the case under the previous regime). Our reading of the Court’s decision is that “legitimate interest” access should not violate the proportionality test explained above and should therefore still be permissible. Granting that type of access (eg to journalists or specialised ONGs) may however be challenging in practice in the absence of adapted legislation providing for a detailed definition of the circumstances and conditions under which a legitimate interest exists. The difficulty to determine and regulate “legitimate interest” access was one of the reasons for the European legislator (now found to be insufficient by the Court) to finally decide to settle for general access to public.
6. The AMLD should be amended to comply with the court’s decision
The Luxembourg Ministry of Justice and the LBR have stressed that the Court’s decision concerns a provision of the AMLD and not the RBE Law as such (which merely implements the AMLD). This means that the issue at hand is not only relevant to Luxembourg but also to all EU Members States which have implemented article 30(5)(c) of the AMLD in their national laws.
In this regard, the European Commission already indicated that it is thoroughly analysing the implications of the decision and that legislative changes to the AMLD can be expected – in particular, we believe, on the tricky topic of “legitimate interest” access. Once the AMLD is amended, it will be up to the national authorities to implement the necessary changes to comply with European law.
Pierre Schleimer
Partner
Catherine Di Lorenzo
Partner
Carole Schmidt
PSL-Counsel
Jacques Graas
Partner
Footnotes
1. Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC (OJ 2015 L 141, p. 73), as amended by Directive (EU) 2018/843 of the European Parliament and of the Council of 30 May 2018 (OJ 2018 L 156, p. 43).
2. Article 30 (5) (c) of the AMLD.
3. The Charter of Fundamental Rights of the European Union (the Charter)
4. Article 3 (4) of the AML Act 2004
5. As defined by Article 2 of the Luxembourg law dated 13 January 2019 establishing the RBE
