May 2026 – The debate surrounding Luxembourg's Register of Beneficial Owners (RBO) is far from over. In an order dated 29 May 2026, the Luxembourg District Court has just decided to refer several fundamental questions for a preliminary ruling on the interpretation of Directive (EU) 2024/1640 back to the Court of Justice of the European Union (CJEU).
A rich case-law background
To understand the significance of this decision, it is necessary to recall the steps that preceded it.
Directive (EU) 2015/849 had introduced into European legislation the concept of a register of beneficial owners, with access restricted to certain designated authorities and entities, as well as to any person or organisation able to demonstrate a legitimate interest. That same directive provided for the possibility of derogating from this access "on a case-by-case basis and in exceptional circumstances, where such access would expose the beneficial owner to the risk of fraud, abduction, blackmail, violence or intimidation, or where the beneficial owner is a minor or is otherwise legally incapacitated".
Directive (EU) 2018/843 subsequently amended this regime by providing for access to the RBO for 'any member of the general public', which was transposed into Luxembourg law by the Act of 13 January 2019, providing that access to certain information contained in the RBO was open to 'any person'.
Following two sets of questions referred for a preliminary ruling by Luxembourg courts in the context of appeals against decisions refusing to restrict access to the RBO, the CJEU, in a Grand Chamber judgment of 22 November 2022 (joined cases C-37/20 and C-601/20), struck down the provision of Directive 2018/843 stipulating that information on beneficial owners must, in all cases, be accessible to any member of the general public. This landmark judgment marked a decisive turning point in the balance between financial transparency and fundamental rights.
In response to this annulment, Directive (EU) 2024/1640 reintroduced the concept of 'legitimate interest' into the European legal framework, with access to information on beneficial owners now subject to the demonstration of a legitimate interest in the prevention of money laundering and terrorist financing. The Luxembourg Act of 23 January 2025 amended the RBO Act to transpose these new access rules.
Who can still access the RBO today – and why does this continue to raise practical issues?
Whilst access for the general public has therefore been removed, it would be wrong to conclude that the RBO is now strictly confidential. Indeed, in addition to national authorities, credit institutions and financial institutions, as well as bailiffs and notaries acting in their capacity as public officials, access to the RBO remains open to any person who can demonstrate a legitimate interest in the context of combating money laundering and terrorist financing – including, in particular, professional journalists, non-governmental organisations, and any person with a legitimate interest in potential transactions with the entity concerned.
However, the concept of 'legitimate interest' is not defined either by the RBO Act or by Directive (EU) 2024/1640. It is a particularly broad and evolving concept, which is likely to be subject to varying interpretations depending on the competent authorities and the courts hearing the case. Consequently, despite the removal of general public access to the RBO, a real risk of disclosure of private information remains. Indeed, there is nothing to prevent a journalist, an NGO or any other natural or legal person from gaining access to data recorded in the RBO by invoking a legitimate interest, the scope of which remains uncertain and insufficiently defined.
In these circumstances, the disclosure of information relating to the data subject is likely to expose them to a disproportionate risk in relation to the objective pursued by the applicant for access. In particular, the potential infringement of their privacy or security, or the adverse impact on their personal and professional circumstances, could far outweigh the benefit derived by a third party whose claimed interest is neither precisely defined nor strictly regulated by the applicable legislation. It is precisely to prevent such a disproportionate infringement that the possibility of requesting a restriction on access to information held in the RBO remains entirely relevant and necessary.
Under Article 15(1) of the RBO Act, a registered entity or a beneficial owner may request, on a case-by-case basis and in exceptional circumstances, that access to the information be restricted solely to national authorities, credit institutions and financial institutions, as well as bailiffs and notaries acting in their capacity as public officials, where such access would expose the beneficial owner to a disproportionate risk, including the risk of fraud, abduction, blackmail, extortion, harassment, violence or intimidation.
In other words, any beneficial owner who considers that the disclosure of their data in the RBO to journalists, NGOs or any other person who can claim a legitimate interest is likely to expose them to a risk has a legal remedy to request that such disclosure be restricted – provided they meet the criteria set out by law. It is precisely these criteria that the CJEU will now have to clarify.
The questions that remain unanswered
Almost all of the questions referred for a preliminary ruling in Case C-601/20 have become moot due to the fact that the RBO is no longer accessible to the general public. However, the questions of interpretation referred to the CJEU in Case C-37/20, with the exception of question 2(a), remain entirely relevant following Directive (EU) 2024/1640 and the subsequent amendment to the Act, whilst the criteria for interpreting the concepts of 'exceptional circumstances', 'risk' and 'disproportionate risk' are defined neither by Directive (EU) 2024/1640 nor by the RBO Act.
These questions do not concern just one particular type of profile: they are in fact relevant to any beneficial owner wishing to restrict access to their data, regardless of their circumstances. The clarification expected from the CJEU will therefore have a general scope, extending well beyond the specific circumstances of this case.
What the CJEU will have to decide
The court has decided to stay proceedings and refer three separate sets of questions for a preliminary ruling to the Court of Justice of the European Union.
On the concept of 'exceptional circumstances', the CJEU will have to clarify whether this concept can be reduced to the existence of one of the risks already listed in the Directive – fraud, abduction, blackmail, extortion, harassment, violence or intimidation – or whether it must have an independent and broader scope. If so, it will need to provide guidance to national courts on the criteria for establishing the existence of such circumstances, and in particular to state whether the national court may disregard this condition or whether it is for the court itself to define its content through case-law. It will also be necessary to determine whether exceptional circumstances can be taken into account only if proof is provided of an exceptional risk, which actually and distinctly affects the specific person of the beneficial owner, and which is genuine and current.
On the concept of 'risk', the court is asking the CJEU whether a restriction on access may be granted where the information in question is already accessible to third parties through other publicly available channels.
On the concept of 'disproportionate risk', the CJEU will first need to identify which conflicting interests must be weighed up, and then decide on a key question: does the granting of an exemption necessarily require the identification of concrete, specific and individualised risks, established in the light of the particular circumstances of each case, or is the fact that the beneficial owner belongs to a category of persons who are particularly vulnerable, in itself, sufficient to establish the existence of such risks, without it being necessary to establish additional factual elements specific to the case in question? Finally, it must determine whether the concept of 'disproportionate risk' refers exclusively to risks affecting the beneficial owner as an individual, or whether it may also cover risks relating, directly or indirectly, to the security of a State, in particular where the disclosure of information concerning the beneficial owner is likely to compromise essential State interests such as national security, international relations or institutional stability.
A ruling with implications far beyond the present case
The significance of this order extends far beyond the circumstances of the present case. The concepts that the CJEU will be called upon to define actually underpin the protection regime applicable to any beneficial owner listed in a national register within the European Union – and will determine in practical terms what must be demonstrated in order to qualify for restricted access. These interpretations are crucial to ensuring the uniform pursuit of the objectives of the various directives on money laundering and terrorist financing.
The CJEU's ruling will have a lasting impact on the balance between financial transparency requirements and the protection of the fundamental rights of the individuals concerned – across all Member States.
BSP, which has had the honour of acting in this case, will follow the progress of these proceedings with the utmost attention and will keep you informed of any future developments.
Share on
