UBO Registers in 2026: Who Can See Beneficial-Ownership Data, and What Owners Should Expect

Last reviewed: 26 October 2026

Since a 2022 judgment of the Court of Justice, EU law no longer provides for general public access to beneficial-ownership registers. The duty to disclose remains, and widens from 10 July 2027. This article sets out who can see the data in the EU, the UK, Switzerland, the UAE, Hong Kong and Singapore as of 26 October 2026. It also covers what owners of cross-border groups should expect.

Filing and access are separate questions

Beneficial-ownership rules answer two questions: who must be recorded, and who may read the record. Since 2022 the EU has narrowed the second answer. From 10 July 2027 the EU Anti-Money Laundering Regulation (AMLR) also widens the first, notably to nominees and some non-EU entities. Every jurisdiction covered here still requires companies to identify their beneficial owners.

What the 2022 CJEU judgment decided

The original Fourth Anti-Money Laundering Directive (2015/849) gave access to authorities, obliged entities and persons showing a legitimate interest. General public access came with the Fifth Directive (2018/843), due for transposition by 10 January 2020.

On 22 November 2022 the Court of Justice (Grand Chamber) ruled in Joined Cases C-37/20 and C-601/20. It declared that change invalid in so far as it opened company beneficial-ownership data to any member of the public. The Court accepted that anti-money-laundering objectives can justify a serious interference with private life and data protection. Public access failed because it was not strictly necessary and was disproportionate compared with the earlier legitimate-interest regime. The Court added that the press and civil-society organisations connected with preventing and combating money laundering and terrorist financing have a legitimate interest. So do persons likely to transact with the company.

Member states adjusted at different speeds:

• Luxembourg began reopening access to professionals and journalists in December 2022. Its law on legitimate-interest access took effect on 1 February 2025.
• The Netherlands closed its register to all requests, including those from obliged entities. A law restricting access took effect on 16 July 2025, and the Chamber of Commerce has since been reopening access, sector by sector, for authorities and obliged entities. As of 26 October 2026, the rules on legitimate-interest access are still being prepared, so journalists and civil-society organisations have no access.
• Austria has offered legitimate-interest inspection since 1 September 2023.
• France has limited access to authorities, obliged entities and legitimate-interest applicants since 31 July 2024.
• Germany applied the test in practice from December 2022 and in statute from 10 February 2026.

The 2024 EU AML package: legitimate interest becomes the rule

The package comprises the AMLR (Regulation 2024/1624), the Sixth Directive (AMLD6, 2024/1640) and the regulation establishing the Anti-Money Laundering Authority (AMLA, 2024/1620). The AMLD6 access rules were due by 10 July 2026:

• Authorities, including tax and sanctions authorities, the European Public Prosecutor's Office and OLAF, have direct and unfiltered access to the interconnected central registers. They consult them without alerting the entity.
• Persons deemed to have a legitimate interest include journalists, civil-society organisations and academia working against money laundering and terrorist financing, prospective counterparties, and third-country obliged entities and authorities. They see the owner's name, month and year of birth, country of residence, nationality and the nature and extent of the interest.

The national register body decides, not AMLA. From 10 November 2026 it must normally answer within 12 working days, with extensions if requests surge or more documents are needed. If it grants access, it issues a three-year certificate. Other member states accept its check of the applicant's function or occupation. Refusals are limited to listed grounds and can be challenged.

Owners can ask who consulted their data through legitimate-interest access. Journalists and civil-society organisations are identified only by function or occupation, and third-country authorities can ask to remain unnamed for a limited period. The rule does not cover access by authorities or obliged entities.

Exemptions are decided case by case. They cover access by obliged entities and legitimate-interest users where it would expose the owner to a disproportionate risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation. Minors and legally incapable owners can also qualify.

On 25 September 2026 the European Commission sent letters of formal notice to 18 member states for not fully notifying transposition of these rules. They include Germany, France, Spain and the Netherlands.

The AMLR applies from 10 July 2027, also the general AMLD6 transposition deadline. Its ownership threshold is 25% or more. Until then, the Fourth Directive treats more than 25% as an indication of ownership. The Commission may set lower thresholds for higher-risk categories of entity. Common filing formats (Implementing Regulation (EU) 2026/2354) apply from 10 July 2027. AMLA, based in Frankfurt, has operated since summer 2025.

On 21 May 2026 the Court of Justice found no ground to invalidate legitimate-interest access to trust beneficial-ownership data (Joined Cases C-684/24 and C-685/24, Across Fiduciaria). It accepted a strict national test of a direct, concrete and current interest. It also held that national law must give owners interim legal protection where an exemption is refused.

United Kingdom: still public, now verified

The Persons with Significant Control (PSC) register remains public. A PSC holds more than 25% of shares or voting rights, can appoint or remove a majority of the board, or otherwise has significant influence or control. Where a trust qualifies, its trustees are registered. Home addresses and full dates of birth are not public. Credit reference agencies and specified public authorities can access them.

The Economic Crime and Corporate Transparency Act 2023 added identity verification. Since 18 November 2025 it has been compulsory for new directors, and for new PSCs within 14 days. Existing directors and PSCs have a 12-month transition. Directors verify with the company's next confirmation statement. PSCs who are not directors verify within the first 14 days of their birth month. A PSC who fails to verify may commit an offence, and Companies House notes the failure against their name on the public register. As of 26 October 2026, Companies House plans compliance action no earlier than the end of 2026.

Limited exceptions apply where personal security is at risk. A PSC at serious risk of violence or intimidation can apply to have all PSC information withheld from the public register. The application costs £100 and, since 11 August 2026, must be made on paper. The information is protected while the application is processed. Individuals can also apply to suppress details such as a home address previously used as a registered office.

Overseas entities that own UK land must register themselves and their beneficial owners on the public Register of Overseas Entities, in force since 1 August 2022. This covers land acquired since 1 January 1999 in England and Wales and since 8 December 2014 in Scotland. Since 31 August 2025, information on trusts behind those entities can be requested from Companies House for £55 per entity.

Switzerland, the UAE, Hong Kong and Singapore: not public, still disclosed

Update deadlines vary. Switzerland allows one month for changes. Existing Swiss companies have transitional periods of up to six months from 1 October 2026, or two years in some cases. The UAE allows 15 days. In Singapore, the central register must be updated within two business days of the company's own register. Intentional breaches of the Swiss reporting duties can be fined up to CHF 500,000. The UAE decision does not cover entities in the DIFC or ADGM.

Nominees are recorded

• EU: from 10 July 2027, nominee shareholders and directors must disclose their status, their nominator and the nominator's beneficial owners to the entity (AMLR Article 66). The entity reports them to the central register and to obliged entities.
• UAE: nominee board members declare their status to the company within 15 days. Nominee shareholders are recorded with the persons they represent.
• Hong Kong: shares held by a nominee are treated as held by the principal, who is entered in the register.
• Singapore: nominee status appears publicly as "ND" or "NS" in the company's business profile, and nominators are filed with ACRA for law-enforcement access. Since 9 June 2025, nominee directors acting by way of business must be arranged by a registered corporate service provider.

Due diligence does not depend on public access

Obliged entities carry out customer due diligence whether or not a register is public. In the EU, and in Switzerland once full consultation of the new register opens, obliged entities can also consult the central register for due diligence.

From 10 July 2027, AMLR Article 67 extends registration to some non-EU companies. A non-EU company must file its beneficial owners with a member state's central register when it acquires EU real estate or is awarded an EU public contract. The same applies when it buys a car priced at €250,000 or more, or a boat or aircraft priced at €7.5 million or more. Opening a business relationship with an EU obliged entity triggers registration only in higher-risk cases. That is where the obliged entity, or the company's category or sector, is rated medium-high or high risk in the EU or national risk assessment.

Trusts with non-EU trustees already have to register when they enter an EU business relationship or acquire EU real estate. Non-EU entities holding EU real estate on 10 July 2027 must register by 10 January 2028, unless it was acquired before 1 January 2014.

Obliged entities may compare register entries, questionnaires and tax self-certifications, so these should be consistent.

A checklist for multi-jurisdiction groups

• Map the control chain to each natural person, with evidence for every link.
• Apply each test separately: 25% or more in the UAE and Switzerland, and in the EU from 10 July 2027. More than 25% in the UK, Hong Kong and, until then, the EU.
• Keep filings consistent across registers and with the controlling persons declared for CRS and FATCA.
• Diarise update deadlines in every jurisdiction where the group files.
• Check UK identity verification for every director and PSC before the 12-month transition that began on 18 November 2025 ends.
• Identify EU triggers: EU real estate, high-value car, boat or aircraft purchases, EU public contracts and higher-risk EU business relationships (AMLR Article 67).
• Assess eligibility for statutory protection where an owner's personal security is genuinely at risk.

FAQ

Can anyone still search EU beneficial-ownership registers?

EU law no longer provides for general public access. Access is reserved to authorities, obliged entities and persons with a legitimate interest. As of 26 October 2026, national practice still varies.

Will I know who has consulted my data?

Partly. Under AMLD6, registers keep records of access by persons with a legitimate interest and disclose them to the beneficial owner on request. Journalists and civil-society organisations are identified only by function or occupation, and third-country authorities can remain unnamed for a time. Access by authorities and obliged entities is not covered by this rule. Dutch law requires the Chamber of Commerce to inform the beneficial owner, and state the purpose, when it grants a legitimate-interest request. As of 26 October 2026 the eligible categories have not been designated, so no such request can yet be granted.

Is the UK PSC register being restricted?

Not as of 26 October 2026. Reform has focused on verifying identity, and Companies House plans to publish more shareholder information. Individuals at serious risk of violence or intimidation can apply to have their PSC information withheld.

Our group has no EU company. Can EU registration still apply?

Yes. From 10 July 2027, a non-EU company must register if it buys EU real estate or a high-value car, boat or aircraft, or wins an EU public contract. An EU business relationship triggers registration in higher-risk cases (AMLR Article 67). Trusts with non-EU trustees already register when they open an EU business relationship or buy EU real estate.

How Bolster Group works on beneficial ownership

Bolster Group maps control chains for multi-jurisdiction groups and prepares and maintains their beneficial-ownership registers and filings. It reconciles these with the KYC files and the CRS and FATCA documentation used for access to banking. Bolster holds a legal consultancy licence and advises on beneficial-ownership disclosure duties. Where a filing, a formal opinion on local law or court representation must come from a firm authorised in that jurisdiction, Bolster works with firms authorised there.