Ruling [CJEU] ¦ Beneficial Ownership Transparency Meets Personal Security: Luxembourg Asks Where AML Access Must Stop

A new test for exceptions to beneficial ownership disclosure

The Luxembourg District Court has asked the Court of Justice of the European Union (CJEU) to clarify when access to beneficial ownership information may be restricted because disclosure would expose an individual to an exceptional and disproportionate risk.

The case sits at the intersection of two objectives that are central to the European Union’s anti-money laundering framework. The first is transparency: authorities, financial institutions and other eligible users must be able to identify the natural persons who ultimately own or control companies. The second is protection: disclosure of ownership information must not create an unreasonable risk of kidnapping, blackmail, extortion, violence or other serious harm.

The dispute concerns a company incorporated in Luxembourg in August 2025. Its beneficial owner was registered in December of that year, together with a request that access to the ownership information be limited. Luxembourg Business Registers rejected the request, finding that the evidence did not establish a significant, real and current risk specific to the individual.

The applicant argues that the beneficial owner’s senior political and representative functions, international profile and ownership of foreign assets are sufficient to demonstrate an elevated threat. Luxembourg Business Registers maintains that status alone cannot replace the individual assessment required by Luxembourg law and EU legislation.

The outcome could affect how Member States assess requests by politically exposed persons (PEPs), senior public officials and other high-profile individuals who seek to shield their ownership details from eligible users of beneficial ownership registers.

Why beneficial ownership registers matter to money laundering controls

Beneficial ownership information is a core element of the EU’s anti-money laundering and counter-terrorist financing system. Corporate structures can obscure the person who ultimately controls assets, receives profits or directs transactions. This opacity can facilitate the placement, layering and integration of proceeds derived from criminal activity.

A company that appears to be an ordinary holding vehicle may, for example, own real estate, securities or operating businesses on behalf of a person who does not appear in the company’s legal ownership records. Without reliable information about the ultimate beneficial owner, banks, lawyers, accountants, trust and company service providers (TCSPs) and other obliged entities may struggle to assess the origin of funds and the purpose of a transaction.

The register therefore supports several parts of the preventive framework. It can help identify undisclosed control, expose conflicts of interest, support enhanced due diligence (EDD) and assist authorities investigating suspected laundering. It may also reveal connections between companies, assets and individuals that are not apparent from a company’s immediate shareholder information.

This function is particularly important where the assets are held through cross-border structures. In the Luxembourg case, the company was reportedly established to hold almost all of the shares in a French real estate company, which owned a residential property in France. The ownership chain itself may be lawful, but its transparency remains relevant to assessing control, source of wealth and the economic rationale for the structure.

Bastian Schwind-Wagner _Follow

"Beneficial ownership registers are essential to detecting money laundering, tracing criminal proceeds and identifying the predicate offenses behind suspicious assets and transactions. At the same time, access restrictions may be justified where disclosure creates a concrete and disproportionate risk of kidnapping, extortion, violence or intimidation.

The Luxembourg reference asks whether politically exposed persons can rely on their status alone or must provide specific evidence of an individual, significant and current threat. The Court of Justice’s preliminary ruling may determine how Member States balance financial transparency and effective AML enforcement with personal security and data protection."

The significance of the predicate offense

Money laundering is not an independent source of wealth. It involves dealing with the proceeds of an underlying criminal offense, commonly known as a predicate offense. Depending on the applicable legal framework, predicate offenses may include fraud, corruption, bribery, trafficking, tax crimes, embezzlement, extortion and participation in an organised criminal group.

Beneficial ownership transparency assists in tracing the proceeds of those offenses. If illicit funds are converted into real estate or placed into a corporate vehicle, identifying the person who controls the company can help investigators connect the asset to the underlying crime. It can also support confiscation proceedings and the reconstruction of financial flows.

The case raises an important distinction. The risks cited in support of restricted access include fraud, kidnapping, blackmail, extortion, harassment, violence and intimidation. These are principally risks allegedly faced by the beneficial owner as a result of disclosure. They are not automatically predicate offenses connected to the company’s assets or to any suspected laundering activity.

That distinction matters. The purpose of an exception to register access is to protect a person from harm, not to determine whether the person’s wealth derives from criminal conduct. At the same time, any restriction must be designed so that it does not frustrate legitimate efforts to identify the proceeds of a predicate offense. A system that grants secrecy too readily could make it more difficult to detect hidden ownership, follow criminal proceeds and establish links between assets and unlawful conduct.

The Court of Justice may therefore need to balance personal security against the effectiveness of financial crime investigations without treating either interest as absolute.

From public access to legitimate-interest access

The legal framework has changed significantly since the Court of Justice’s judgment of 22 November 2022 in Luxembourg Business Registers, involving Cases C-37/20 and C-601/20. The Court held invalid the rule that made beneficial ownership information available in all cases to any member of the general public.

Directive 2024/1640 subsequently replaced that broad model with a more limited access regime. Access is no longer generally available to everyone. Instead, the person or body seeking information must demonstrate a legitimate interest, within the conditions established by EU and national law.

The change responds to concerns about privacy, data protection and the exposure of beneficial owners to misuse of personal information. It also changes the practical assessment of risk. A request for restricted access is no longer being considered against unrestricted public availability, but against access by defined categories of users whose searches must be authenticated and traceable.

That narrower framework may reduce the likelihood of indiscriminate publication. It does not eliminate the possibility of harm, however. Journalists, non-governmental organisations and potential business counterparties may still qualify for access where they can demonstrate a legitimate interest. The applicant argues that information obtained lawfully by one eligible user could be redistributed or combined with other publicly available information.

The counterargument is that lawful access under a controlled system should not, without more, be treated as a disproportionate risk. Otherwise, the exception could undermine the register’s basic function.

The legal importance of “exceptional circumstances”

Article 15 of Directive 2024/1640 requires Member States to provide exceptions in exceptional circumstances where access would expose a beneficial owner to a disproportionate risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation. The exception may also apply where the beneficial owner is a minor or legally incapable.

The provision requires a case-by-case decision, a detailed evaluation of the exceptional nature of the circumstances and confirmation that the relevant disproportionate risks exist. It does not define the terms “exceptional circumstances”, “risk” or “disproportionate risk”.

That lack of definition is at the centre of the Luxembourg reference. The national court asks whether exceptional circumstances can simply be equated with a disproportionate risk of one of the listed offenses or forms of harm. If not, it asks how a national court should deal with legislation that has not separately defined the concept.

The court also asks whether the risk must be significant, real and present, and whether it must be directed at the beneficial owner as an individual. Those issues are important for the evidential threshold. A general concern that a prominent person may attract unwanted attention may not be enough. A specific threat, a documented security assessment, a known pattern of attacks against similarly situated persons or a credible connection between the disclosed information and a vulnerable asset could carry greater weight.

Does political exposure create an automatic presumption?

The applicant’s central position is that a person’s senior political or representative functions can, in themselves, establish a disproportionate risk. A high-profile official may be a target for hostile states, criminal organisations or politically motivated actors. Disclosure of ownership information could reveal links to property, travel patterns, residences or financial interests and could facilitate intimidation, extortion or coercion.

This argument draws attention to the particular vulnerability of politically exposed persons. Under AML rules, politically exposed persons are subject to enhanced scrutiny because their functions may expose them to bribery and corruption risks. Their status is therefore highly relevant to customer due diligence, source-of-wealth enquiries and transaction monitoring.

The same status does not necessarily produce the same legal consequence in the context of register access. Enhanced due diligence is designed to manage the risk that a person may be involved in corruption or may be used to move illicit funds. Restricted access is designed to prevent harm caused by the disclosure of personal information. The two mechanisms serve different purposes.

A presumption that every politically exposed person faces a disproportionate risk could protect individuals who genuinely require enhanced safeguards. It could also make access restrictions dependent on status rather than evidence and create a broad exception for individuals whose positions are politically prominent but whose personal circumstances do not indicate a concrete threat.

The referring court is asking whether membership of a particularly vulnerable category is sufficient or whether additional facts must be established in every case. The answer will be important for the consistent treatment of senior officials across the Union.

Can state security concerns justify secrecy?

The applicant also relies on risks to national security, international relations and institutional stability. The argument is that disclosure of a beneficial owner’s assets could create leverage against the state or expose sensitive relationships connected with official functions.

Article 15 is framed primarily around risks to the beneficial owner as a person. The listed harms include offenses and acts directed at an individual, such as kidnapping, extortion, violence and intimidation. The Luxembourg court therefore asks whether the provision can also cover risks affecting the security of a state where those risks are inseparably linked to the beneficial owner’s official role.

A broad interpretation could recognise that threats against a senior official may have both personal and public consequences. A narrow interpretation would preserve the provision’s focus on personal protection and prevent state interests from being invoked without a direct link to the individual’s safety.

The issue also has implications for financial crime enforcement. Beneficial ownership information can reveal politically sensitive connections, but that sensitivity should not by itself prevent legitimate AML inquiries. Authorities and obliged entities need access to accurate information to investigate corruption, misuse of public funds and the concealment of assets through corporate structures.

What the Court of Justice may clarify

The Luxembourg District Court asks the Court of Justice to provide guidance on the meaning of exceptional circumstances, the nature of the relevant risk and the proportionality assessment. It also raises the question whether information that is already available through land registers, company accounts or other public sources can still justify protection in the beneficial ownership register.

The existence of alternative sources may be relevant, but it may not be decisive. A beneficial ownership register can connect information that is dispersed across several systems. The combined picture may reveal a person’s control over an asset more clearly than any individual record. The practical risk may therefore arise from aggregation, not from the disclosure of a single new fact.

For AML purposes, the key challenge is to maintain meaningful ownership transparency while preventing unnecessary exposure of vulnerable individuals. Restrictions should not become a substitute for a careful risk assessment, nor should the existence of legitimate access be treated as proof that disclosure is harmless.

The Court’s preliminary ruling is likely to shape how Member States distinguish between general status-based concerns and concrete evidence of danger. It may also influence the design of national procedures, the evidence required from applicants and the way authorities reconcile data protection with the investigation of money laundering and its predicate offenses.

Dive deeper

• InfoCuria Case-law ¦ Case C-609/26 Luxembourg Business Registers II ¦ Link
• InfoCuria Search ¦ Case C-609/26 Luxembourg Business Registers II ¦ Link