Balancing Transparency And Privacy: The Risks Of Unrestricted Access To Information On Beneficial Owners

In our increasingly interconnected world, calls for transparency and accountability have gained significant traction. An area where such demands are particularly pronounced is the realm of ‘beneficial ownership’ — an expression used to define the individuals who ultimately own or control a company or a legal entity. Despite the unquestioned significance of promoting transparency, unrestricted public access to information on beneficial owners might entail risks for individuals, besides contravening privacy rights.

Transparency initiatives aim at combatting issues that thrive in the shadows of complex corporate structures, like money laundering, corruption, and tax evasion. Shedding light on beneficial owners is meant to hinder illicit activities and foster a more equitable and accountable business environment. Nevertheless, we must admit that unrestricted access to such information may yield unsought consequences. Additionally, access by third parties who do not play any role in fighting those crimes appears totally unnecessary. One can even argue that it would also be unnecessary to give access to this information to tax authorities with FATCA, CRS, and a vast network of information exchange treaties currently in force and effect.

Primary concerns in this respect are the potential misuse and abuse of personal data. Publicly accessible databases on beneficial ownership are at risk of becoming a target for cybercriminals and identity thieves. Sensitive information — including names, addresses and financial details — could be exploited for fraudulent purposes, implying financial losses and the reputational damage of innocent individuals. Striking the right balance between transparency and privacy is crucial in preventing such risks.

Furthermore, unrestricted public access to beneficial ownership information could jeopardise the safety and security of individuals. In contexts such as politically unstable regions, or in areas where crime rates are high, individuals may become the target of kidnapping, extortion, theft, and even more severe crimes, when they are associated with a particular company or asset and that information turns public. It is a risk to their own lives as well as the lives of their families and loved ones. Protecting privacy is therefore essential to safeguard the wellbeing of individuals in vulnerable situations.

We should bear in mind that privacy rights are enshrined in various legal frameworks worldwide, and individuals have a legitimate expectation for their personal information to be carefully managed, with no exposure to undue risks. To maintain the reliability required for the success of transparency initiatives, the respect of privacy is essential.

The conclusion is that while transparency in beneficial ownership is a laudable goal, unrestricted public access to that information implies risks to individuals and might violate privacy rights. The necessary balance between transparency and privacy imposes restricted access to information and the need for robust security measures, as well as the consideration of contextual factors, and the respect for privacy rights.

Now let’s look at what regulators are doing about this in different countries or regions.

The Situation In The European Union

In Europe, the landscape of beneficial ownership transparency varies from one country to another. While some jurisdictions have made significant progress in enhancing transparency and accessibility to beneficial ownership information, in most cases, unrestricted access is fortunately far from being the norm.

The European Union’s 5th Anti-Money Laundering Directive (AMLD5) introduced the requirement for member states to have centralised registers of beneficial ownership information. Even when public access is allowed, member states can impose restrictions or allow limited access upon legitimate reasons alleging privacy and security protection.

As a result, several countries had established registers of beneficial owners with very little or virtually no restrictions at all. Among them was Luxembourg.

On 22 November 2022, in its judgment regarding joint cases WM (C-37/20) and Sovim SA (C-601/20) versus Luxembourg Business Registers, the Court of Justice of the European Union ruled the non-validity of the requirement introduced by Directive 2018/843, amending Directive 2015/849, whereby member states must allow access — in all cases, and to all public — to information on the beneficial ownership of legal entities included in Central Registers.

The Court deemed such indiscriminate public access neither strictly necessary to prevent money laundering and terrorist financing, nor proportionate, and therefore considered it an unjustified serious interference with fundamental rights, namely the right to respect for private life and the protection of personal data enshrined in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union. Following this judgment, the access to the Register of Beneficial Owners was first blocked and then restricted to specific categories of persons.

The Government of Spain, by means of Royal Decree 609/2023 dated 11 July 2023, approved the creation and operating regulation of the Ultimate Beneficial Ownership (UBO) Registry, though including from its inception some very important restrictions concerning the right to access the information registered.

These restrictions are as follows:

•  Prior identification of the applicant for information is required, as well as accreditation of the condition in which access is requested and evidence of a legitimate interest. Such legitimate interest shall be presumed in the case of (i) the media, (ii) civil society organisations involved in the prevention and combatting of money laundering and terrorist financing, (iii) the legal person (trust or similar entity) concerned, and (iv) the beneficial owner.
• Only current information can be accessed (therefore excluding historical data on beneficial ownership).
• Only the name, surname, month and year of birth, country of residence and nationality of the beneficial owners, as well as the nature of the beneficial ownership can be accessed.
• Access to the information may be refused on grounds when it may expose the beneficial owner to a disproportionate risk, or to a risk of fraud, kidnapping, extortion, harassment, violence or intimidation, or others of similar seriousness, or if the beneficial owner is a minor or a person with limited capacity or subject to special protection measures. For these purposes, the interested party must previously request the restriction of access to its information from the person in charge of the UBO Registry.

Another country that provides a good example of the current trends in this field against full access to UBO information by the public is Italy.

In Italy, the Register of Beneficial Owners was first created by Decree 55/2022 enacted on 11 March 2022. Another Decree, in this case dated on 29 September 2022, determined that the deadline for the filing of the information on UBOs was 11 December 2023.

Following the decision of the European Court above mentioned, the Government of Italy decided that access to the information by the public was not going to be allowed, but that access would be rather granted to the authorities as well as to other companies with a relevant interest.

On 7 December 2023, a local Court temporally suspended the Decree which established the 11 December deadline. The Court determined that forcing individuals to file this information without a more in-depth analysis of the situation may cause irreparable damages and called for a public audience on 27 March 2024.

The Case Of The UK And British Overseas Territories

Following the enactment of AMLD5 above mentioned, the United Kingdom (UK), which at the time was still a member of the European Union, became one of the first countries to ever establish a public registry system of beneficial owners, under the name of ‘Persons with Significant Control (PSC) Register.’ This was back in 2016.

One year later, the British Virgin Islands (BVI) implemented the non-public platform ‘BOSS’ (Beneficial Ownership Safe Search System) to share beneficial ownership information with the UK and certain enforcement agencies.

In 2023, BOSS is still one of the best systems in terms of the balance it offers between transparency and privacy, requiring all resident agents in the BVI to maintain a database of all companies and other legal entities for which they act as resident agent.

Although private, BOSS allows the BVI government agencies to search the database for information on any specific entity.

With the UK now out of the European Union, the UK Parliament established that all British Overseas Territories (OTs) must have public company registers established by the end of 2023. The BVI challenged this decision from day one.

According to the BVI’s former Premier, Orlando Smith, the law "raises serious constitutional and human rights issues" and this is why "the British Virgin Islands will not establish a public registry until that becomes a standard throughout the world”. On another occasion, Smith commented that “there is no global standard for accessible public records and such measures are not required by international regulators. The BVI is willing to adopt appropriate global standards because it is committed to eradicating illicit financial activity, but there must be an equal playing field for all. The BVI cannot accept attempts to impose disproportionate measures without considering its relative constitutional status.”

During the Covid-19 pandemic, the subsequent Premier of the BVI, Andrew Fahie, expressed the Territorial Government's support for working with the UK Government in implementing a public register of beneficial owners for companies that would be accessible in accordance with established international standards and best practices as they become available, but with certain reservations.

The question that remains unanswered is which are the current international standards and best practices?

No worries, we’ll get to that.

Personally, I have always defended the BOSS adopted by the BVI as a solution for protecting the privacy of the beneficial owners of entities established in the jurisdiction, while also allowing law enforcers to fight money laundering and the financing of terrorism. It was a great, well-balanced compromise.

I always pointed out that creating public registries of beneficial owners would unnecessarily tip the balance in favour of law enforcement. This, in turn, leads to enormous risks for private citizens, and especially for those living in countries with weak rules of law and high crime. It should also be noted that these are the individuals who most commonly resort to offshore centres.

There would be some very serious privacy issues for HNW and UHNW clients if a public registry of UBOs were to become a mandate in the OTs.

As mentioned earlier in this article, my comment on privacy does not relate to the human rights component of this issue, but rather to the ongoing safety of clients who would be exposed to myriad threats, from kidnapping to robbery and extortion, if their personal details were to be included in a public registry.

This is especially relevant for clients in third world countries, where violence has become part of their everyday life.

In this context, my position remains unchanged: BVI has a great tool to fight financial crime and no changes are needed in registries of members or in the information relative to beneficial owners of BVI entities, perhaps with the only exception of companies owning assets in the UK.

My argument is that there are sufficient mechanisms already in place to ensure a balance between the fight against crime and corruption and every individual’s right to privacy and safety in the jurisdiction. Authorities already have systems in place to request and receive information on individuals when they are suspected of criminal activity.

The framework continues to function satisfactorily, and I see no valid reasons to change it. In my opinion, the downside could in fact prove significant, depriving the BVI from its rank as a leading international finance centre.

The good part in all this is that there have been two relevant developments to support that longstanding position:

a) the enactment of the Corporate Transparency Act in the US, which does not create a registry of UBOs and to that end is quite like the BOSS; and

b) the fact that registries of beneficial owners with public access were declared invalid by the Court of Justice of the European Union.

The Way Forward

There are currently four different approaches towards the issues discussed in this article. They are, from the worst to the best option, as follows:

The first option, which in our view excessively and unnecessarily prioritises transparency over privacy and thus constitutes bad practice, is the establishment of publicly accessible registers of beneficial owners with no restrictions in terms of who could access the information contained therein. This has been the UK’s standpoint, which might have had some logic when they adopted it back in 2016. However, it lost all sense once the Court of Justice of the European Union clarified the scope of AMLD5, on which the UK had based its anti-money laundering laws enacted in 2018.

The second option consists of establishing registries of beneficial owners with public access, while also limiting access to the information by people who have a relevant interest in it, by allowing third parties to only access current information and by providing that further limitations are allowed if a UBO requests privacy by reason of being exposed to a disproportionate risk. This is what Spain did just recently, and what is expected from registries in countries of the European Union. Whether this option is a good one or not will ultimately depend on what is deemed a legitimate interest.

The third option is to create a database of beneficial owners rather than a registry with access restricted to law enforcement. This is not only what the BVI has done with the BOSS, but more importantly what the U.S. is doing right now with its Corporate Transparency Act (CTA). For the first time, the CTA will create a robust and comprehensive database of beneficial ownership information of US entities as well as foreign entities doing business in the US, which is expected to provide essential information to law enforcement agencies with the purpose of preventing corrupt business practices, such as money laundering and the financing of terrorism.

From 1 January 2024, the CTA will require that certain entities file a report at the U.S. Department of the Treasury's Financial Crimes Enforcement Network (FinCEN) identifying those who own, control and incorporated the company. The information will not be accessible to the public and will not be subject to requests under the Freedom of Information Act.

In fact, only the following government agencies will have access to this information:

• Federal agencies engaged in national security, intelligence, and civil and criminal law enforcement.
• The Department of the Treasury in connection with its official duties, including tax administration.
• State and local law enforcement agencies in connection with criminal or civil investigations.

All in, the first option is a terrible one, the second might be a good solution depending on the fine print, and option three is the right one — unless a jurisdiction can avoid creating this registry or database for good, which would be option four. At the end of the day, and as mentioned at the beginning, the best registry of beneficial owners is the one that does not exist.

Independently of what we think is best considering the rights and risks at stake, not having a registry at all, or having one with unrestricted access, will clearly not be the international standard on the matter going forward.

It is noteworthy that in March 2023, the Financial Action Task Force released its guidance on beneficial ownership of legal entities. In the section ‘Access to Information’, the FATF mentioned that while countries may consider facilitating public access to basic and beneficial ownership information, they should also consider data protection rules and other privacy concerns, as well as limiting which basic and beneficial ownership information is made publicly available or applying a tiered approach to information disclosure based on legitimate interest.

It seems clear to me that having a database of UBOs with access to law enforcement or a registry of UBOs that can be accessed only when a legitimate interest arises are quickly becoming the international standard in the matter.

Two rather “last minute” developments reinforce the views I express in this article and make even more compelling the argument that the international standard should include search systems or databases accessible only by enforcement agencies and/or registers, with restricted public access:

• On 8 December 2023, the Ministry of Financial Services, Labour and Trade of the British Virgin Islands issued a press release confirming that “because the decision late last year by the European Court of Justice changed the international context, affirming privacy and data protection as fundamental human rights which must be respected and appropriately weighed when providing such access, the Government has determined that while the Virgin Islands does not fall within the ambit of the ECJ, in light of legal opinions received on the ECJ judgement and the constitutionality of creating a PARBO in the Virgin Islands, it considers that its approach must take into account the ECJ judgement to help minimise the risk of legal challenges on human rights grounds”. In practical terms this means, according to the Ministry, that “the safeguarding of these fundamental human rights necessitates the application of a ‘legitimate interest test’ to determine access for those parties whose request for beneficial ownership information is genuinely aimed at preventing or combatting money laundering and terrorist financing”.
• On 13 December 2023, the Crown Dependencies of Guernsey, the Isle of Man and Jersey have jointly announced that they are withdrawing their previous commitments to allow public access to their registers of company beneficial ownership. “Having carefully considered the CJEU’s decision in WM and relevant European Court of Human Rights case law, the governments of the Crown Dependencies are satisfied that it would not be compatible with the international obligations extended to them, including those enshrined in their domestic laws, to grant access to their beneficial ownership registers to the general public”, says the Crown Dependencies' joint statement.

Hopefully, international agencies or groups such as the European Union, OECD, G-20, and United Nations will allow jurisdictions to freely decide which of these options fits better their interests.

Martín A. Litwak
Lawyer specialised in wealth structuring and investment funds. Martín has focused on providing advice to high net worth (HNW), ultra-high net worth (UHNW) and institutional families domiciled in Latin America. His expertise in setting up and/or managing fiduciary structures designed to tackle issues related to the lack of rule of law, the lack of privacy and the fiscal voracity of the countries in which they reside and/or conduct their business activities, as well as his experience in resolving succession issues and/or to ensure that the family assets are well protected makes him one of the foremost lawyers in this field. He has also assisted several Latin American based fund managers with the establishment and licensing of hundreds of investment funds, the majority of them in the British Virgin Islands and the Cayman Islands. Finally, Martín has been very active in multi-jurisdictional mergers and acquisitions, international financial transactions of several types (i.e. private equity/venture capital deals, project financing, structured finance, IPOs, etc.), tax amnesties and the provision of advice in transactions involving crypto-assets and Blockchain (ICOs, STOs, etc.)