Compliance
Language
All updates

Explainers · You asked 11

Who actually owns this company?

A registry that shows a company's directors doesn't show who owns it — and since a 2022 EU court ruling, most of Europe closed the second half to the public. Free, open beneficial-ownership data now means three countries, not twenty-seven.

Published 18 August 2026Last reviewed 18 August 2026
A grid of European country codes colour-coded by beneficial-ownership access: open (UK, Latvia, Estonia), by legitimate-interest application (Norway, France, Belgium), and closed (Lithuania, Poland, Germany, Denmark, Slovakia), illustrating that finding a company in a registry doesn't mean finding who owns it.

You asked

In most of the EU, "the company registry" and "the beneficial-ownership registry" are two different databases, and finding the company tells you nothing about who actually controls it. Until November 2022, most member states let anyone look up beneficial owners online. A Court of Justice of the EU ruling that month struck that down as a privacy violation, and country after country closed public access — Denmark in September 2025, Slovakia in July 2025, most recently. What's left free and machine-readable across the whole EU/EEA is the UK, Latvia and Estonia. Everywhere else, you either file a "legitimate interest" request under the new EU rules, or pay an aggregator. The EU's own fix — full application by 10 July 2027 — reopens access on a narrower, provider-presumed basis, not the old public lookup.

What actually happened in 2022

EU law used to require member states to let any member of the public look up who owned a company — a response to years of investigative reporting on shell companies and hidden ownership. On 22 November 2022, the Court of Justice of the EU (Grand Chamber) ruled that requirement invalid, in the joined cases WM and Sovim SA v Luxembourg Business Registers (C-37/20 and C-601/20). The court's reasoning wasn't that transparency was wrong — it was that opening beneficial-ownership data to literally anyone, for any reason, was a disproportionate interference with the right to privacy and data protection under the EU Charter of Fundamental Rights.

Member states didn't wait for new legislation to comply — most simply switched public registers off or behind a login within weeks. That's the single event behind almost every "this used to be open, now it needs a login" surprise in KYB work across Europe since.

What the EU is replacing it with, and when

The fix isn't a return to public lookup — it's a new package: Regulation (EU) 2024/1624 (AMLR) and Directive (EU) 2024/1640 (AMLD6), in force since mid-2024. Instead of open-to-anyone, access runs on legitimate interest: obliged entities — AML/KYC providers among them — and competent authorities get standing access; journalists, civil society and academics connected to AML work get a presumed legitimate interest instead of a case-by-case fight. The rollout is staggered: the access provisions had a first transposition deadline of 10 July 2025 (a third of member states missed it), the core register provisions and technical standards are due by 10 July 2026, and full application across the package lands on 10 July 2027.

Until then, coverage is genuinely uneven and changes without warning — the atlas we maintain internally gets rewritten every time a country flips. Anyone quoting a fixed "X countries are open" number today is describing a snapshot, not a stable fact.

Where people search now, and why that doesn't fix it

The EU already runs a cross-border search layer: BORIS, the Beneficial Ownership Registers Interconnection System, live on the European e-Justice Portal since 2021. It's tempting to read BORIS as "the EU's open UBO database" — it isn't. BORIS is a routing and search layer, not a data store: it connects to each country's national register and shows you what that register is willing to show, under that register's own access rules. Query a country that's been closed since 2022, and BORIS shows you the same closed door the national site does — it doesn't grant access, it just finds where to ask.

That's also why we don't scrape closed registers or run a headless browser against a Cloudflare or Incapsula wall to get around a login. Beyond the legal exposure of bypassing access controls, it would undercut the one thing that actually works here: as an AML/KYC provider, we sit inside the legitimate-interest category the new rules are built around. Circumventing the gate is the fastest way to lose standing to walk through it properly.

What to know before you promise UBO coverage

  • Free, open, machine-readable beneficial ownership across the whole EU/EEA today means the UK, Latvia and Estonia — everywhere else is legitimate-interest access or a paid aggregator
  • A company registry and a beneficial-ownership registry are usually separate databases — finding the company proves nothing about who owns it
  • BORIS is a search/routing layer across national registers, not an open EU-wide database — it inherits each country's own access rules
  • The EU's AMLR/AMLD6 package fully applies from 10 July 2027 — coverage between now and then keeps shifting, snapshot numbers go stale fast