Case study: Alleged lack of legitimate interest to access Register of Beneficial Owners

Case study: Alleged lack of legitimate interest to access Register of Beneficial Owners

Published April 23, 2026

The complaint

Complainant felt aggrieved by the stance taken by the Malta Business Registry to restrict access to the Register of Beneficial Owners to competent authorities and subject persons following the decision of the Court of Justice of the European Union (CJEU) in the Joint Cases C-37/20 and C-601/20 where the CJEU gave a preliminary ruling under Article 267 TFEU to the Luxembourg District Court in the case of WM and Sovim SA versus the Luxembourg Business Registers on the 22 November 2022.

The facts

Complainant stated that having been engaged by a third party for due diligence services, the Beneficial Owner Registrar at the Malta Business Registry (MBR) was asked for information. Complainant alleged that in spite of the fact that the Companies Act (Register of Beneficial Owners) Regulations (S.L. 386.19) requires information on the Beneficial Owner Registry to be accessible to the public, the MBR not only denied this access without providing a valid reason but unnecessarily delayed the process. He added that complainant’s request for information by the MBR was denied because it had not been made by a subject person.

Following enquiries by this Office, the MBR started by informing complainant who had requested information asking for access "to conduct due diligence on a client and identify owners within the client’s structure". This request was brief and indicated that the complainant himself was not a subject person. The MBR observed that complainant did not specify the company on which information was being requested and, moreover, did not include the director or directors of this company. This last detail was important because the Registry cannot issue an Ultimate Beneficial Owner (UBO) Certificate without at least the consent of a director of the company. It was explained to this Office that a UBO Certificate can only be issued following the knowledge and consent of the directors’ and/or the beneficial owners themselves. 

Complainant did not specifically indicate that the requested information was for the beneficial ownership of a company held by the Registry. He failed to provide sufficient explanation of what this request consisted of exactly. The MBR held, inter alia, that the request did not even include the beneficial owner criteria and the legal basis to enable complainant to obtain information on the beneficial owners. Therefore, access was denied.

The MBR countered complainant’s contention that the Register was open to the general public or to anyone who asks for information. The MBR was following the dicta in Joint Cases C-37/20 and C-601/20, where the CJEU considered that since the Register of Beneficial Owners includes information on identified individuals, that is the beneficial owners of companies and other legal entities incorporated in the Member States, access of any member of the general public to this data would affect the fundamental right to respect for right of privacy of these individuals.

The Court opined that making personal data available to the general public in such a manner constitutes a serious interference with the fundamental rights enshrined in Articles 7 and 8 of the European Convention for Human Rights regardless of the subsequent use of the information communicated. The Court further required persons requesting information to have a “legitimate interest” before any access to the information on beneficial owners could be granted. The Member States had the right to lay down certain conditions for access and even to restrict access to the general public if necessary. Following this judgement and given that the CJEU declared Article 30(5)(c) of Directive (EU) 2024/1640 (public access to beneficial ownership information) invalid, the Registrar decided to restrict the Register’s access to the general public. Any access by the general public necessitates “legitimate interest”. 

Following the judgement referenced above, the regime regulating public access to the beneficial ownership was restricted to those persons having a legitimate interest similar to what the Fourth Anti-Money Laundering Directive (Directive (EU) 2015/849) contemplates. Though this latter directive does not have a definition of “legitimate interest”, the Directive leaves it up to the Member States to interpret and implement. 

The MBR maintained that complainant did not satisfactorily provide the Registrar with a solid basis of having a legitimate interest to gain access to the Register of Beneficial Owners because he failed to:

•  indicate specifically the name and registration number of the company on which he required beneficial ownership information;
• indicate his relationship with the entity which commissioned him to carry out this exercise;
• indicate the business relationship or point out the involved parties of the commissioning entity or even to
• link his “legitimate interest” to the beneficial owners and the prevention of money laundering and terrorist financing regime; and
• give assurances that the beneficial owners would not be exposed to harm or disproportionate risk.

Conclusion

The Ombudsman did not sustain this complaint. The Malta Business Registry acted correctly in not allowing access to the Register of Beneficial Owners. Complainant did not have a legitimate interest for this and did not provide the information necessary to garner this legitimate interest.

This case was published in the Case Notes 2025 publication