🇪🇺UBO Registers: From Public Access to "Legitimate Interest"

A beneficial ownership register identifies which natural person ultimately owns or controls a company, trust or foundation. Over the past decade such registers have appeared almost everywhere, from London to Tortola and Abu Dhabi, and the main argument has moved from collecting the data to access: to whom the state shows the beneficial owner, how much of the record, and on what basis. In 2022 the EU Court of Justice closed unrestricted public access to European registers, in 2024 the EU rewrote the access rules, in 2025–2026 the United States all but wound down its own register, and Switzerland went the other way and is launching a federal one from 1 October 2026.

For a licensed institution the register is one source in customer due diligence, with duties attached: reconcile it, report discrepancies, and never let it stand in for the institution's own checks. For the client the register is where authorities, banks and part of the public see his or her name, and where any mismatch between a declaration and reality surfaces at the next onboarding.

Concept

A beneficial ownership register (UBO register) is a central database of information on the natural persons identified as beneficial owners of legal entities and legal arrangements such as trusts. The legal owner of the shares may be a holding company, a trustee or a nominee; the register requires the chain to be followed to its end and a natural person named. Concealing funds through an anonymous company is difficult if a specific natural person is recorded for every company and the recorded information is verified.

The beneficial owner is identified in three steps, and the structure is almost identical from the FATF down to national statutes. The first is ownership: a direct or indirect interest, usually 25% or more (in the UK and Hong Kong, more than 25%). The second is control through other means: the right to appoint a majority of directors, vetoes, contractual rights, family and informal ties; this test runs in parallel with ownership. The third is the fallback: if no one is found through ownership or control, the register records the senior managing official, a member of executive management. Trusts have their own scheme: settlor, trustees, protector, beneficiaries or their class, and anyone else with effective control.

The FATF cites the 25% threshold only as an example. The EU Regulation already allows the Commission to lower it to 15% for higher-risk categories of company, and the BVI collects data from a 10% threshold.

Key parameters of the system:

See also: beneficial ownership and nominee structures.

Why Registers Exist: the FATF Standard

Registers grew out of the FATF Recommendations. Recommendation 24 deals with legal persons, Recommendation 25 with trusts and similar arrangements. Both require competent authorities to have timely access to beneficial ownership information that is adequate, accurate and up-to-date. FATF assessors test this in mutual evaluations: both whether the rules exist and how quickly authorities actually obtain accurate data.

In March 2022 the FATF rewrote R.24. The central change is the multi-pronged approach: a country must combine several mechanisms for collecting the data. The company itself holds the information, and in addition there is a public beneficial ownership registry or an alternative mechanism giving authorities equally rapid access. At the same time the FATF required countries to assess the risks of their own legal persons and of foreign ones with sufficient links to the country, to prohibit the issue of new bearer shares and bearer share warrants, to tighten controls on nominee shareholders and directors, and to give public procurement authorities access to the data.

In February 2023 the plenary brought R.25 broadly into line with R.24: trustees must hold adequate, accurate and up-to-date beneficial ownership information on express trusts and disclose their status to financial institutions. Guidance followed: on legal persons in March 2023 and on trusts in March 2024. The trusts guidance states plainly that the standard does not require a central trust register; it is sufficient for the information to be held by the trustee and be available to authorities. The legal persons guidance reports a finding from practice: countries combining several sources are more effective than those relying on one.

The FATF does not require public access. The standard speaks of access by authorities and of availability to financial institutions for customer due diligence. Public access is a political choice made by individual countries, and it is precisely that choice which became the subject of litigation in the EU.

Who Is the Beneficial Owner: Companies, Trusts, Foundations

Companies and other legal entities

In the EU, from 10 July 2027 the definition is set by Article 51 AMLR: a beneficial owner is a natural person who has an ownership interest in, or controls through other means, the legal entity, and control through other means is identified independently of and in parallel with ownership. Article 52 sets the threshold at 25% or more of shares, voting rights or other ownership interest, held directly or indirectly. Indirect holdings are calculated by multiplying along the chain and adding the results across chains. A person with 60% of a holding company that owns 50% of an operating company holds 30% and is a beneficial owner. By 10 July 2029 the Commission must assess higher-risk categories. Where a lower threshold is appropriate, Article 52(2) provides for a threshold of at most 15%, unless a higher threshold below 25% is proportionate on a risk basis.

If, after exhausting all means, no beneficial owner is identified through ownership or control, Article 63 AMLR requires the details of all senior managing officials: executive members of the management body and those responsible for day-to-day management. This fallback comes with a caveat: an obliged entity that records a director as beneficial owner must document why the real owner could not be found. Registrars and supervisors treat such a record as a prompt for further questions.

Separately, Article 66 AMLR governs nominee shareholders and nominee directors: they must disclose to the entity their nominee status, the identity of the nominator and the nominator's beneficial owners, and the entity passes this on to the central register and to obliged entities.

Trusts and similar arrangements

Under Article 58 AMLR the beneficial owners of an express trust are all the settlors, trustees, protectors (if any), beneficiaries and any other person exercising ultimate control. Where a legal entity holds one of these roles, its own beneficial owners go on the register. No ownership threshold applies: settlor and trustees are disclosed regardless of the size of their interest. Arrangements similar to trusts (Treuhand, fiducie, fideicomiso and the like) must be identified by member states and notified to the Commission, with trust-equivalent roles defined for each.

Private foundations are treated as legal entities in most jurisdictions, but their beneficial owners are often identified by analogy with a trust, through the roles of founder, council, protector and beneficiaries. The choice between a trust and a foundation from a disclosure perspective is covered in the map of trust jurisdictions.

Maintaining a Register Entry

Whatever the country, a beneficial ownership entry passes through the same stages:

1. Filing on formation. The entity identifies its beneficial owners and files the details with the registrar; in some regimes (the UK, Singapore) the company also keeps an internal register.
2. Updates. Changes are filed at short notice: under Article 63 AMLR without undue delay and in any case within 28 calendar days, in the UAE within 15 days, and in Singapore the central register is updated within two business days of a change to the internal one.
3. Annual confirmation. The AMLR requires the entity to verify annually that its information is current; in the UK the confirmation statement does the same job.
4. Registrar verification. Under Article 10 AMLD6 the register verifies data within a reasonable time of submission and regularly thereafter, may carry out checks including on-site inspections, and may impose sanctions.
5. Discrepancy signals. Banks, lawyers, auditors and authorities report to the registrar where their information does not match the register; the entry receives a discrepancy mention visible to everyone with access.
6. Retention after dissolution. In the EU records are kept for 5 years after the entity ceases to exist, extendable to 10 years for investigations.

European Union: From Public Registers to Legitimate Interest

AMLD4 and AMLD5

The duty to keep central beneficial ownership registers was introduced by the Fourth AML Directive 2015/849 (AMLD4): access went to authorities, obliged entities and persons with a legitimate interest. The Fifth Directive 2018/843 (AMLD5) went further: company registers were opened to any member of the general public, and obliged entities and authorities were required to report discrepancies between the register and their own information. At the peak of openness the owner of a company could be looked up in most EU member states.

The CJEU judgment in C-⁠37/20 and C-⁠601/20

On 22 November 2022 the Court of Justice in joined cases C-37/20 and C-601/20 (WM and Sovim v Luxembourg Business Registers) declared invalid the AMLD5 provision making beneficial ownership information accessible "in all cases to any member of the general public". The Court held that such access is a serious interference with the rights to respect for private life and to the protection of personal data under Articles 7 and 8 of the Charter: the data allows a profile of a person, his or her financial situation and field of activity to be built, and once published it cannot be controlled. Combating money laundering is a legitimate aim, but general access is neither limited to what is strictly necessary nor proportionate. The Court noted that the earlier AMLD4 legitimate-interest regime was considerably less intrusive, and that the benefits of open access did not offset the difference.

The judgment removed public access only. The duty to keep the register, access by authorities and access by obliged entities all remained.

Practice after the judgment

Member states reacted differently, and until AMLD6 takes effect practice remains uneven. Germany's Transparenzregister now requires members of the public to demonstrate a legitimate interest in every case and to supply proof; the public receives an extract with a reduced data set, for a fee and after individual review, while obliged entities access the register to fulfil their statutory customer due diligence obligations after registration and confirmation of their status. Ireland's RBO works in three tiers: full access for competent authorities, restricted access for designated persons (obliged entities), and a public search that shows only the number of beneficial owners filed.

AMLD6: Access to Register Data

Directive 2024/1640 (AMLD6) establishes three groups with different access arrangements.

The first group, under Article 11: competent authorities including FIUs and supervisors, together with tax authorities, authorities implementing EU restrictive measures, AMLA, EPPO, OLAF, Europol and Eurojust, receive immediate, unfiltered, direct and free access without alerting the entity. Obliged entities receive timely access when carrying out CDD; fees for them are allowed only up to administrative costs.

The second group is persons with a legitimate interest under Article 12. They can see the beneficial owner's name, month and year of birth, country of residence, nationality, and the nature and extent of the beneficial interest. Full date of birth and address are not part of this disclosure. Access is granted without alerting the entity or trust concerned. A legitimate interest is presumed for the following categories:

Journalists, civil society and third-country authorities also receive historical information: beneficial ownership over past periods, including for entities dissolved in the preceding 5 years, and a description of the ownership structure. Other applicants may obtain access case by case by demonstrating an interest.

The third group is everyone else. For them the register is closed.

Procedure and deadlines

Article 13 AMLD6 sets out the procedure. The register assesses the applicant's function or occupation and connection with the specific entity; identity is confirmed through eIDAS electronic identification. From 10 November 2026 a decision must be taken within 12 working days; in a sudden surge of requests the deadline may be extended by 12 working days, and then once more by the same period. A confirmed legitimate interest earns a certificate valid for 3 years, repeat requests are handled within 7 working days, and a decision by one member state's register is recognised by the others. Refusals must be reasoned and can be challenged administratively or in court; fees may cover costs only.

The calendar is set by Article 78: the general AMLD6 transposition deadline is 10 July 2027, but the register-access provisions (Articles 11, 12, 13 and 15) were due by 10 July 2026, and Article 74 by 10 July 2025. Directive 2015/849 is repealed with effect from 10 July 2027.

Risk-based exemptions

Article 15 AMLD6 requires member states to provide exemptions for exceptional circumstances: where access would expose the beneficial owner to a disproportionate risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation, or where the beneficial owner is a minor or otherwise legally incapable. The exemption withholds all or part of the personal information from legitimate-interest applicants and from obliged entities carrying out CDD; it does not apply to notaries and other obliged entities that are public officials, and competent authorities and FIUs see the data in any event. Decisions are taken case by case after a detailed evaluation, with the right to administrative review and judicial remedy; member states publish annual statistics on exemptions granted. This is the main lawful privacy mechanism inside the European system, and it works only where the threat is demonstrated.

Register interconnection: BORIS

National registers are linked through the European Central Platform, and Article 10(19) AMLD6 expressly requires that interconnection. The user interface is BORIS (Beneficial Ownership Registers Interconnection System) on the e-Justice portal, through which users search for the beneficial owners of companies and trusts registered in other member states, under the same access rules as apply in the register's home state.

AMLR: foreign entities and real estate

For non-EU structures, Article 67 AMLR creates registration duties when the specified foreign entities or trustees enter an EU business relationship, acquire EU real estate, buy vehicles for non-commercial purposes for at least €250,000, or watercraft or aircraft for at least €7.5 million in the transactions covered by the article, or obtain an EU public contract. The medium-high or high-risk limitation in paragraph 2 applies specifically to foreign legal entities entering business relationships; it should not be extended to every trust. Registration is due before the relationship, completion of the purchase or signature of the contract, as applicable. Covered real estate held on 10 July 2027 must be declared by 10 January 2028 if acquired since 1 January 2014. A BVI company holding a villa in Spain must therefore check the acquisition date and the article's scope.

A detailed walk-through of the package is in the article on the EU AML package.

Discrepancy Reporting

Register data that is not reconciled soon becomes outdated. Every modern regime therefore assigns banks and other obliged entities responsibility for data quality.

From 10 July 2027, Article 24 AMLR generally requires an obliged entity to report register discrepancies without undue delay and within 14 calendar days. Paragraph 2 permits customer clarification instead for minor errors that do not affect identification, or outdated information where the owner is known from a reliable source and concealment is not suspected; that exception does not apply to higher-risk cases. If the entity concludes the register is wrong, it asks the customer to correct it within 14 days and reports an uncorrected discrepancy. Paragraph 4 separately protects specified information obtained by legal and other professionals when determining a client's legal position or acting in judicial proceedings, subject to its exception. Under Article 10 AMLD6, the register takes appropriate action within 30 working days; a discrepancy mention remains visible until resolved.

In the United Kingdom the equivalent duty sits in regulation 30A of the Money Laundering Regulations 2017. Reports are due before a business relationship is established and during it; since 1 April 2023 only material discrepancies reasonably linked to money laundering, terrorist financing or concealment of the customer's business details need reporting. The duty extends to the register of overseas entities. Companies House does not tell the company who raised the report.

The practical consequence for the client: a structure chart in the bank's questionnaire that does not match the register is a reason for a report to a third party, and a discrepancy mention is visible to the next bank.

United Kingdom: Public Access Plus Verification

The PSC register and identity verification

The UK has kept a public register of People with Significant Control since 2016 and has not given up public access. A PSC is a person who holds more than 25% of the shares or voting rights, can appoint or remove a majority of the directors, or has significant influence or control; where control runs through a trust or a firm without legal personality, the trustees or partners are registered. The data is visible to any user of Companies House. The home address is not published, a correspondence address is shown instead, and a person at risk can apply to protect the information from disclosure.

With the Economic Crime and Corporate Transparency Act 2023 (ECCTA) the emphasis moved to reliability. From 18 November 2025 identity verification is mandatory: new directors and PSCs verify on appointment or incorporation, existing directors confirm verification in the next confirmation statement, and the company cannot file that statement unless all directors are verified. Each PSC has a 14-day window to provide a personal code; when the window opens depends on whether the PSC was registered before 18 November 2025 and whether he or she is also a director. Verification is done free through the government's One Login service or for a fee through an Authorised Corporate Service Provider. Non-compliance risks prosecution, fines, a note on the register and a bar on new appointments.

Register of Overseas Entities

The register of overseas entities that own UK property was created by the Economic Crime (Transparency and Enforcement) Act 2022 and came into force on 1 August 2022. Overseas entities must register if they own land or property bought in England and Wales on or after 1 January 1999, in Scotland on or after 8 December 2014, or in Northern Ireland on or after 5 September 2022. Registrable beneficial owners with more than 25% of shares or votes, and other controllers, are disclosed; a UK-regulated agent supervised under the Money Laundering Regulations verifies the information, and the entity files an annual update statement. Without registration, property transactions are restricted.

Where a trustee is a beneficial owner, trust information is filed: the trust's name, date of creation, beneficiaries, settlors and other interested persons. Since 31 August 2025 Companies House releases this information on application. For a single overseas entity an applicant receives the trust information without showing a legitimate interest, provided it contains no details of a minor; for several entities, or where a minor is involved, a legitimate interest is required: investigating money laundering, tax evasion, terrorist financing or sanctions breaches. The fee is £55 per entity. Name, month and year of birth, nationality, correspondence address and role are released; day of birth and home address are not.

Trust Registration Service

Trusts with a UK connection register with HMRC's Trust Registration Service. The register is closed to the public, but third parties may make a trust data request on two grounds. The first is legitimate interest: the requester is involved in an investigation into money laundering or terrorist financing and explains why a specific trust may be implicated. The second is the "offshore company" route: the trust holds more than 50% of the shares or voting rights in an entity outside the UK and the EEA, and no link to a specific suspicion is needed. What is released is the name, month and year of birth, country of residence, nationality and the nature and extent of the interest of each beneficial owner; the trust's name and details of its assets are not released.

British Overseas Territories, the Crown Dependencies and Seychelles

British Virgin Islands

The BVI has operated BOSS (Beneficial Ownership Secure Search System) since 2017, a closed system through which authorities obtain information held by registered agents. In addition, the Beneficial Ownership Regulations 2024 have applied since 2 January 2025: beneficial ownership information on BVI Business Companies and limited partnerships is filed with the Registry, and all existing companies had to file by 30 June 2025. The filing threshold is 10%, while 25% applies to disclosure to competent authorities. Non-filing for more than six months may lead to strike-off. Since 1 April 2026 the Registry has accepted legitimate-interest access requests through the VIRRGIN system; decisions of the Registrar can be appealed, with an intent to appeal filed within three days and the notice of appeal within 21 days.

Cayman Islands

Cayman operates the Beneficial Ownership Transparency Act 2023 with a threshold of 25% or more. Third-party access is governed by the Beneficial Ownership Transparency (Legitimate Interest Access) Regulations 2024: members of the public who meet the criteria apply through the Registry and receive information from the competent authority's search platform. In parallel, the Access Restriction Regulations 2024 allow a beneficial owner to ask for the data to be withheld where disclosure would place him or her at serious risk.

Jersey

Jersey has maintained a beneficial ownership register since 1989. New beneficial ownership filing requirements under COBO took effect on 1 January 2017. Companies and partnerships file on registration and keep the information current. The Financial Services (Disclosure and Provision of Information) (Jersey) Law 2020 defines the beneficial owner by ultimate effective control, including control through a chain or by means other than direct ownership, and leaves any percentage to the Commission's guidance. Disclosure is closed by default: article 10 lists permitted recipients such as law enforcement and local competent authorities, and since the 2025 amendment article 8B lets the Commission release register data to a supervised business for its customer due diligence, with a criminal bar on using it for anything else. False or misleading information is punishable by a fine and up to seven years' imprisonment, and an entity that does not file can be struck off after a three-month notice.

Guernsey

Guernsey's register sits with the Guernsey Registry under the Beneficial Ownership of Legal Persons (Guernsey) Law 2017. The Registry's guidance flow charts apply three tiers, the first being an individual holding more than 25% of the shares, and changes must reach the Registry within 14 days. Access widened in August 2025: in addition to public authorities, supervised businesses may now request data from the Registry for due diligence. A consultation of 27 February 2026 proposes legitimate-interest access for persons engaged in preventing, detecting or investigating money laundering, in coordination with Jersey and the Isle of Man; it closed on 10 April 2026 and no regime is yet in force.

Bermuda

Bermuda moved its register from the Monetary Authority to the Registrar of Companies under the Beneficial Ownership Act 2025, which the government set to enter into force on 3 November 2025. The threshold is 25% or more through direct or indirect ownership or control. Section 18 lists the authorities entitled to disclosure and adds two further channels: prescribed information for businesses subject to the AML Regulations, for due diligence and discrepancy reporting, and prescribed information for persons who show a legitimate interest connected with preventing or detecting money laundering, terrorist financing or proliferation financing. The Registrar may restrict or refuse disclosure in any case.

Gibraltar

Gibraltar kept a public register after the CJEU judgment. Regulation 26 of the Register of Ultimate Beneficial Owners, Nominators and Appointors Regulations 2017 gives any member of the public the owner's name, month and year of birth, nationality, country of residence and the nature and extent of the interest, while authorities and the FIU see everything; ownership of more than 25% is the marker. A protection procedure lets an owner at risk of violence or intimidation apply to have the data withheld. The government announced on 23 February 2026 that searches would become free of charge for any individual.

Seychelles

Seychelles keeps a central beneficial ownership database under the Beneficial Ownership Act 2020, and its threshold is the lowest in this group: the Beneficial Ownership Regulations 2020, as amended in 2025, treat as a beneficial owner any natural person who ultimately owns or controls, directly or indirectly, 10% or more of the ownership interest, including shares or voting rights. The FIU maintains the database; under section 14 of the Act the information is provided to competent and law enforcement authorities, the Registrars of Companies and of Associations, the Central Bank and the court, on written notice or order. The Act provides for no public access, except to the register of extractive companies filed with the Registrar of Companies. Amendments made in January 2025 add banks, other financial institutions, credit unions and licensed corporate service providers to the bodies that may search the database, for customer due diligence and with the written consent of the customer's resident agent authorised by its beneficial owners; they come into operation only on a date the Minister appoints by notice in the Gazette, and no such notice had been published by September 2026.

In all these jurisdictions companies are no longer anonymous. The differences lie in who obtains access and by what procedure, and in the protections available to people facing real threats.

United States: the Corporate Transparency Act and Its Wind-Down

The Corporate Transparency Act required companies to file beneficial ownership information (BOI) with FinCEN from 2024. In March 2025 the regulatory approach reversed. An interim final rule published on 26 March 2025 redefined "reporting company" to cover only entities formed under the law of a foreign country and registered to do business in the United States. All companies created in the US, and their beneficial owners, became exempt, and foreign reporting companies no longer report US-person beneficial owners.

On 11 August 2026 FinCEN issued a final rule making the exemption permanent: US companies and US persons no longer file BOI, and FinCEN will delete information previously reported by US persons from its database. The rule took effect on 14 August 2026, the day of its publication in the Federal Register. Foreign reporting companies still report their beneficial owners who are foreign individuals.

For the client this means a US LLC without a foreign registration does not appear in the FinCEN register. The bank still identifies beneficial owners under FinCEN's customer due diligence rule for financial institutions, a foreign bank does so under its own law, and under Article 67 AMLR the same LLC will be included in a European register if it buys EU real estate.

Asia, the Middle East and Switzerland

Hong Kong

Hong Kong introduced the Significant Controllers Register on 1 March 2018. The company keeps the register itself and does not file it with the Companies Registry. A significant controller is a person with more than 25% of the issued shares, capital or profits, more than 25% of the voting rights, the right to appoint or remove a majority of the board, or significant influence or control, including through a trust or firm. The company appoints a designated representative: a Hong Kong-resident shareholder, director or employee, or a licensed accounting or legal professional or trust or company service provider. The register is open to law enforcement officers on demand; there is no public access. Listed companies are exempt.

Singapore

In Singapore companies keep an internal register of registrable controllers (RORC) and, since 30 July 2020, file the information with ACRA's central register. Companies registered from 16 June 2025 file on the day of registration; updates are due within two business days of a change to the internal register. The fine is up to S$25,000. The central RORC is closed: members of the public can neither view nor buy the information, and access is limited to company officers, corporate service providers and law enforcement agencies. Companies must also keep registers of nominee directors and nominee shareholders (ROND and RONS) and file changes with the corresponding central register.

United Arab Emirates

In the UAE beneficial ownership is governed by Cabinet Decision No. 109 of 2023, which replaced Decision No. 58 of 2020. A beneficial owner is a natural person holding directly or indirectly 25% or more of the capital or voting rights, or controlling the company by other means such as the right to appoint directors; where there is none, a senior management official is recorded. The regime covers companies onshore and in free zones, except financial free zones (DIFC and ADGM have their own rules) and companies wholly owned by government. The company keeps a register of beneficial owners and a register of partners and shareholders, discloses nominee members, and notifies the registrar of changes within 15 days. The Ministry and registrar do not disclose the data without written consent, except for AML/CFT purposes and tax information exchange. Penalties are set by a separate Cabinet Resolution No. 132 of 2023.

Switzerland

Switzerland long managed without a central register, relying on banks' customer due diligence. The Federal Act on the Transparency of Legal Entities and the revised Anti-Money Laundering Act enter into force on 1 October 2026, and the transitional periods for entering existing entities start running from that date. The Transparenzregister is kept by the Federal Office of Justice; the act covers most legal entities — AGs, GmbHs, cooperatives and other forms. Pilot operation started on 16 June 2026.

Summary Table by Jurisdiction

Key dates in 2026–2028:

The Licensee's Obligations: the Register Does Not Replace CDD

A register extract is one piece of evidence, and responsibility for establishing the beneficial owner stays with the obliged entity. This follows from the FATF approach (a multi-pronged approach assumes that information from different sources is cross-checked) and from the AMLR, where the duty to identify and verify beneficial owners rests with the obliged entity and discrepancies with the register must be reported. Supervisors and correspondent banks typically assess several aspects.

First, whether the conclusion can be reproduced. The client file should hold an ownership chart down to natural persons, with percentages at every level, calculation of indirect holdings and the source of each link: constitutional documents, share register, register extract, the trust deed or extracts from it. "Beneficial owner per the register" without the institution's own verification is a standard inspection finding.

Second, control through other means. Shareholder agreements, options, convertible loans, vetoes, a protector with power to replace the trustee can all make a person with a sub-threshold holding a beneficial owner. The register often does not show these links.

Third, handling of senior managing official cases. Where a director is recorded as beneficial owner, the file should explain why the owner was not identified and record a risk decision; wholesale recording of directors in place of owners across a portfolio signals a formalistic approach.

Fourth, the discrepancy reporting process: who in the organisation logs discrepancies, within what time (14 calendar days under the AMLR), how the client is invited to correct the entry, and how a decision not to report a minor mismatch is recorded. In the UK, the materiality test applies since 2023.

Fifth, refresh. Register data ages, so ongoing monitoring should include re-reconciliation on triggers: change of directors, new share issues, sale of a stake, change of trustee. Correspondent-banking questionnaires such as the Wolfsberg CBDDQ ask directly how the institution identifies and verifies beneficial owners and whether it uses registers.

More on corporate client checks in the article on corporate KYC.

Access to Client Information

Access to information about an HNW client differs for three categories of users. The state sees everything filed: full data, history, sometimes supporting documents. Banks and other obliged entities see the register for CDD and compare it with what the client has told them. The public sees different things in different places: in the UK the name, month and year of birth, nationality, correspondence address and nature of control of any PSC (home address and full date of birth are not published); in the EU a reduced data set, and only for those with a legitimate interest; in Hong Kong, Singapore and the UAE nothing at all.

Lawful ways to preserve privacy exist, and all of them operate within disclosure to authorities and the bank:

1. Choice of access regime. A structure in a jurisdiction with legitimate-interest access, or with no public access, discloses the beneficial owner to a narrower circle than a UK company.
2. Risk-based exemptions. Article 15 AMLD6, a protection application at Companies House and the Cayman Access Restriction Regulations allow data to be withheld from the public on a demonstrated threat of violence, kidnapping, extortion or harassment. A general reference to prominence is not enough; evidence of a specific threat is needed.
3. Trusts and foundations. They do not conceal their participants: settlor, trustees, protector and beneficiaries go on the register. But in many regimes trust data is released on narrower grounds than corporate data, and minor beneficiaries receive additional protection.
4. Accuracy of the entry. Precise and promptly updated data protects better than any structure: a discrepancy mention on the register is visible to all users and all but guarantees further questions at every subsequent onboarding.

Onboarding problems tend to arise in the following situations: the chart in the bank's questionnaire does not match the register; a director is recorded instead of the real owner; the trustee cannot quickly provide information on the protector and beneficiaries; the beneficial owner has changed and the register has not been updated; the client relied on the anonymity of a US LLC and is not ready to disclose the owner to the bank. Source of funds and wealth checks are covered in the article on source of funds, and the overall private-client process in the article on AML/KYC.

Beneficial ownership registers connect with tax information exchange: CRS requires disclosure of the controlling persons of passive entities, and a non-transparent legal or beneficial ownership chain is itself a hallmark of reportable arrangements under DAC6 (hallmark D2; see the article on DAC6 hallmarks).