CJEU ¦ WM et al. v. Luxembourg Business Registers (LBR)

CJEU Strikes Down Public Access to UBO Registers: What the 22 November 2022 Grand Chamber Judgment Means for AML Transparency and Data Protection

Introduction

The Court of Justice of the European Union (CJEU), sitting as Grand Chamber, ruled on 22 November 2022 in Joined Cases C‑37/20 (WM) and C‑601/20 (Sovim SA) that the provision of Directive (EU) 2018/843 (5th AMLD) mandating unrestricted public access to beneficial ownership (UBO) registers is invalid. The Court found that allowing “any member of the general public” to access UBO data constitutes a serious interference with the rights to private life and data protection under Articles 7 and 8 of the Charter of Fundamental Rights, and that such interference is not strictly necessary or proportionate to the AML/CFT objective.

Background: From “Legitimate Interest” to Full Public Access

Under the original Article 30(5) of Directive (EU) 2015/849 (4th AMLD), UBO information was accessible to competent authorities, obliged entities, and persons or organizations demonstrating a “legitimate interest”. The 2018 amendment replaced that third category with “any member of the general public,” aiming to enhance transparency and deter misuse of legal entities. Luxembourg implemented this via its 2019 law establishing the Register of Beneficial Ownership (RBO), allowing broad public access and providing a case-by-case exemption in exceptional circumstances.

Two disputes reached the Luxembourg District Court:

1. WM (an individual UBO) challenged LBR’s refusal to restrict access due to personal safety risks;
2. Sovim SA challenged the compatibility of general public access with the Charter and the GDPR.

The referring court asked the CJEU to assess the validity of the EU law change and interpret several GDPR and AML provisions.

The Court’s Core Finding: Public Access Is a Serious, Unjustified Interference

The Court held that making UBO data available to the general public interferes with Articles 7 and 8 of the Charter. The interference is serious because:

• Identity and economic data (nature and extent of interests) can profile the individual’s wealth and investments.
• Internet publication makes data accessible to an unlimited audience, including for purposes unrelated to AML/CFT.
• Once disclosed, data can be copied, retained, and disseminated, making control and redress difficult.

While preventing money laundering and terrorist financing is a legitimate and weighty public interest, the Court found the measure failed key proportionality tests:

• Strict necessity: The EU legislator argued that general access avoids disparate national definitions of “legitimate interest,” but the Court ruled that definitional difficulty is no basis for maximal disclosure. Press, civil society actors working on AML, potential counterparties, and financial institutions already have or can have access grounded in legitimate interest or under other access channels (authorities and obliged entities). The Commission’s impact assessment and recital-level assertions (“can contribute,” “would help”) did not prove that full public access is strictly necessary.
• Proportionality: The 2018 regime is a “considerably more serious” interference than the prior “legitimate interest” model and the benefit over that model was not shown to justify the increased intrusion. Optional guardrails (online registration, case-by-case exemptions) could not fix the fundamental imbalance. Moreover, the law’s use of “at least” for the accessible data list lacked the clarity and precision required for rules limiting fundamental rights.

Transparency as an EU Principle? Not Here

The Court rejected reliance on the EU’s general principle of transparency (Articles 1, 10 TEU and 15 TFEU) as a justification. That principle primarily targets public institutional activity and the use of public funds, not blanket disclosure of private persons’ ownership data.

Bastian Schwind-Wagner_Follow "The CJEU invalidated the EU rule mandating unrestricted public access to beneficial ownership registers, finding it a serious and unnecessary interference with privacy and data protection rights. AML transparency must now be achieved through targeted access with clear safeguards rather than blanket disclosure."

GDPR Landscape: Questions Rendered Moot

Because the Court annulled the general public access mandate, it did not address the referred GDPR questions on lawfulness, purpose limitation, data minimization, security, data protection by default, and international transfers. The judgment nevertheless reiterates that any processing under the AML directives must comply with the GDPR.

Immediate Consequences for Registers and Firms

• Member States can no longer rely on the 2018 mandate to offer unrestricted public UBO access. Many registries have already restricted portals to authorities, obliged entities, and (where permitted) those able to show a legitimate interest.
• The pre‑2018 access logic resurfaces as the baseline: competent authorities and FIUs have unrestricted access; obliged entities access for CDD; others may access only under a legitimate interest model or narrower national access designs consistent with the Charter.
• Case-by-case exemptions remain pertinent where national law permits, but are now a backstop rather than the primary means to protect UBOs against the risks of public disclosure.

What Compliance Teams Should Do Now

• Monitor national transposition updates: Expect amendments reinstating “legitimate interest” or equivalent filters, tightening data fields available to non-authorities, and strengthening audit trails of access requests.
• Align onboarding and KYC workflows: Continue to obtain UBO information directly from customers and official sources available to obliged entities. Do not rely on public portals being open.
• Reassess data-sharing practices: Ensure that any onward sharing of UBO data is necessary, proportionate, and GDPR-compliant, with clear purposes and access controls.
• Update risk and privacy impact assessments: Consider the reduced public visibility of counterparties’ ownership structures and potential upticks in documentary verification burdens.
• Prepare for divergence within the EU: In the absence of a uniform “legitimate interest” definition, national models and gatekeeping criteria may vary; map requirements across jurisdictions where you operate.

Policy Outlook

The ruling pushes the AML transparency framework back toward a targeted-access paradigm. Any future EU reform that aims to widen access must provide:

• A demonstrable necessity case over narrower alternatives.
• Clear, precise definitions of who may access what, when, and why.
• Robust safeguards: registration and logging of requestors, notice mechanisms, redress rights, and data minimization.

Until then, authorities and obliged entities remain the main channels for accessing and validating UBO data, and civil society and media may need to rely on legitimate interest gateways or other legal avenues.

Conclusion

The Grand Chamber has reset the balance between AML transparency and fundamental rights. Unrestricted public access to UBO data is out; targeted, legally justified access with strong safeguards is in. Compliance functions should adapt quickly to a more controlled access environment while maintaining rigorous UBO verification through established AML/CFT channels.

Dive deeper

• CJEU ¦ Judgment WM et al. v. Luxembourg Business Registers ¦ Link