Background: from public access to restricted access
Before the CJEU ruling, Directive (EU) 2018/843 of 30 May 2018, amending Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, allowed full public access to RBE data. The Luxembourg law governing the RBE introduced into national law the provision of the directive debated by the CJEU.
The CJEU ruling invalidated the provision of the directive, citing privacy infringements under the EU Charter of Fundamental Rights. On the date of the CJEU ruling, Luxembourg authorities suspended online public access to the information on beneficial owners collected by the RBE.
Luxembourg authorities promptly restored access to the RBE data but under stricter conditions:
- In December 2022, online access to the RBE was reestablished for professionals subject to the Luxembourg amended law of 12 November 2004 relating to AML/CFT (such as professionals from the financial and insurance sectors, auditors, real estate agents and developers, persons carrying out a family office activity, notaries and lawyers) and to press representatives who have a legitimate interest in consulting the RBE for their journalistic research.
- In February 2023, the Luxembourg Business Registers (LBR) introduced a confidential access procedure for entities to retrieve their own RBE data using a code sent to their registered office.
Throughout this period, national competent authorities have continued to benefit from dedicated access through an intranet portal, allowing them to carry on their work in the fight against money laundering and terrorist financing.
Key benefits for businesses and professionals
Legal and financial professionals now have explicit rights to access RBE data for client due diligence, which facilitates compliance with evolving AML/CFT regulations.
Additionally, potential transaction parties benefit from enhanced transparency, enabling them to make informed decisions and mitigate the risk of association with illicit activities.
Key practicalities
A. Restricted access to protect confidentiality
The Law has been supplemented by a redefinition of the list of entities and individuals who can access the RBE data.
Who has access to which information?
- National authorities
- Who
- Attorneys general, state prosecutors, investigating judges
- Financial Intelligence Unit
- Approved judicial police officers
- Commission de Surveillance du Secteur Financier (Financial Sector Supervisory Commission), Commissariat aux Assurances (Insurance Commission), Customs and Excise Administration, Registration Duties, Estates, and VAT Authority, Direct Taxation Administration, State Intelligence Service, etc.
- Accessible information and access modality
All information listed in Article 3 relating to the beneficial owners is accessible by the national authorities: full names, nationalities, date and place of birth, country of residence, accurate private or professional address, national/foreign identification number, and nature and extent of beneficial interests held.
Access is made via secure electronic systems.
Information on national authorities accessing the data is not communicated to the concerned registered entities or beneficial owners.
- Professionals subject to AML/CFT law
- Who
- Credit and financial institutions
- Notaries
- Lawyers
- Accountants
- Other professionals required to apply customer due diligence measures
- Accessible information and access modality
The professionals subject to AML/CFT law can only access the following information in relation to the beneficial owners: full names, nationalities, date and place of birth, country of residence, and nature and extent of beneficial interests held.
Access is made via secure electronic platforms with strong authentication. Access must be logged, including the user's identity, information consulted, date, time and reason for consultation. Logs are retained for five years and are inaccessible to the registered entity or beneficial owners concerned.
- Self-regulatory organizations and public services and administrative bodies
- Who
- National self-regulatory organizations responsible for supervising compliance with AML/CFT obligations
- State services, public administrations and public establishments, where access is provided by law as part of their legally defined missions
- Accessible information and access modality
These entities can only access the following information in relation to the beneficial owners: full names, nationalities, date and place of birth, country of residence, and nature and extent of beneficial interests held.
Access is made via secure electronic platforms with strong authentication. Access must be logged, including the user's identity, information consulted, date, time and reason for consultation. Logs are retained for five years.
- Persons demonstrating legitimate interest
- Persons deemed to have a legitimate interest according to the Law include:
- Professional journalists established in the EU
- Nonprofit organizations focused on combating money laundering and terrorist financing
- Individuals seeking to verify the identity of beneficial owners of entities in the context of potential transactions
Persons who are likely to enter into a transaction with a legal entity or legal arrangement and who wish to prevent any link between such a transaction and money laundering, its predicate offenses or terrorist financing have been included in the list of persons who will be deemed to have a legitimate interest. By doing so, the Law has preemptively aligned the Luxembourg legislation with Article 12(2)(c) of Directive (EU) 2024/1640, the so-called sixth Anti-Money Laundering Directive.
- National authorities and administrations involved in combating money laundering or terrorist financing offenses, insofar as they do not already have access to this information
- Other persons justifying a legitimate interest
- Accessible information and access modality
The persons demonstrating legitimate interest can only access the following information in relation to the beneficial owners: full names, nationalities, date and place of birth, country of residence, and nature and extent of beneficial interests held.
For persons wishing to identify the beneficial owners in the context of a transaction, access to information is further limited to the persons with whom they are likely to enter into transactions.
Access is made via secure electronic platforms with strong authentication for the persons deemed to have a legitimate access.
A justified request must be submitted to the LBR for the other persons justifying a legitimate interest. Requests must detail the entity being investigated, the legitimate interest related to AML/CFT efforts and the intended use of the information.
The LBR reviews and validates or rejects the request, possibly consulting an advisory commission.
If the LBR issues a favorable decision, an extract containing the following information in relation to the beneficial owners is sent to the applicant within three working days of the LBR's decision: full names, nationalities, date and place of birth, country of residence, and nature and extent of beneficial interests held. The LBR will only process the entities determined by name or registration number that are the immediate subject of the applicant's research and investigations.
B. Stronger compliance measures for registered entities
The Law grants the LBR expanded enforcement powers to ensure the reliability of the RBE data, including the following:
- Administrative measures include reminders, notices and coercive actions.
- Severe cases of noncompliance or deliberate breaches may be referred to the public prosecutor.
- Criminal sanctions remain available for the most egregious violations.
