On 22 November 2022, the European Court of Justice (ECJ), ruled that the provision included in the Directive 2018/843 (aka 5th AML Directive) under which Member States must ensure that the information on the beneficial ownership of companies incorporated within their jurisdiction should be accessible in all cases to any member of the public, is invalid.
The judgement of the ECJ mainly focused on the right of access to the beneficial owners’ registers to the public and stressed that such right seriously interferes with the fundamental rights to respect for privacy and to the protection of personal data in accordance with the EU Charter of Fundamental Rights.
The ECJ went on to state that the information made available to the public enables a potentially unlimited number of persons to find out about the material and financial situation of a beneficial owner. Furthermore, the potential consequences for the beneficiaries resulting from possible abuse of their personal data are worsened by the fact that, once data has been made available to the general public, it can be freely consulted, and disseminated.
As an immediate reaction to the above decision of the ECJ, certain Members States and in particular Cyprus, Luxemburg and the Netherlands, have suspended public access to their UBO Registers.
In the case of Cyprus, obliged entities (as defined in the Cypriot AML Law), which among others include lawyers, independent legal consultants, administrative service providers providing fiduciary services, banks, auditors, tax consultants etc., can request the Registrar of Companies to provide them with such information in the context of performing customer due diligence, for example when onboarding a client. The said obliged entities, in order to obtain such information, will need to submit a declaration to the Registrar of companies, confirming that the reason for requesting this information is for compliance with their legal obligation to perform due diligence on their clients/beneficial owners in accordance with the requirements of the law. The declaration will in turn be examined by the Registrar of Companies who will decide whether to disclose or not the said information. In essence, the request for the provision of such a declaration by the obliged entities, ensures an additional level of protection of the data, ensuring that these are released only to those who are legally allowed to have access to it.
In effect, the information as to Beneficial Owners will continue to be recorded to the Registrar of Companies BUT the information will not be accessible to the general public as it was used to be until now, which is ultimately a win for the right to privacy.
