Anti-Money Laundering Compliance | Protection of beneficial owners’ personal data

Executive summary

According to the judgment of the Court of Justice of the European Union (ECJ) of 22 November 2022 (cases C-37/20 and C-601/20), the unrestricted access for all members of the public to the transparency register as foreseen for all EU member states in the 5th EU Anti-Money Laundering Directive violates fundamental EU rights of beneficial owners.

A legislation creating legal certainty in line with Union law is expected at EU level at the earliest with the adoption of the 6th EU Anti-Money Laundering Directive (awaited for mid-year 2023 as part of the comprehensive “EU Anti-Money Laundering Prevention Legislative Package”), at the level of the EU member states only with the subsequently still necessary implementation of the required amendments in the respective national anti-money laundering acts.

As a result of the ECJ judgement, the renewed draft version of the 6th EU Anti-Money Laundering Directive as of 5 December 2022 continuously provides for an EU-wide public access to the data on beneficial owners, but (re-) introduces the obligation to demonstrate a “legitimate interest” in this context (draft article 12 para. 1 subpara. 1). According to the current explanatory memorandum for the directive as proposed by the Council of the European Union, such interest shall be limited to a “legitimate interest with respect to money laundering, associated predicate offences such as corruption, tax crimes and fraud, and terrorist financing”.

Until the entry into force of a new legal framework, in Germany the updated administrative practice of the registry authority (The Federal Gazette publishing house) must be observed. As per announcement of 12 December 2022 the German registry authority will examine applications for inspections until further notice “based on an EU law conform interpretation” of the German Anti-Money Laundering Act (sec. 23 para. 1 sent. 1 no. 3 AMLA); in this context the registry authority intends to duly consider the legal situation as foreseen in the 4th EU Anti-Money Laundering Directive, originally applicable in Germany only until 31 December 2019.

Following a temporary complete suspension of access, under the new approach of the registry authority the members of the public are now authorized again to inspect the German transparency register, but only in case they can demonstrate a "legitimate interest".

According to the specification of the new administrative practice by the German registry authority at the end of January 2023 such “legitimate interest” shall be particularly assumed in the following three constellations: 

• "if it is intended to review the own information of the registration (so-called self-inspection),
• for journalists and non-governmental organizations (NGOs) conducting research related to money laundering or terrorist financing, or
• in case any other close connection to money laundering and terrorist financing can be plausibly demonstrated."

As a result, it must be assumed that due to the new administrative practice the public access to the German transparency register is already now considerably restricted, and - considering the currently planned legislative projects at EU level - this situation will not change in the foreseeable future.

It remains to be seen if in contrast to the expansion of inspection rights for German state institutions with entry into force of the so-called “Sanctions Enforcement Act II” (Sanktionsdurchsetzungsgesetz II) on 28 December 2022 the inspection of the general public into the beneficial owners’ data will be de facto excluded in practice for the future. The competent German anti-money laundering supervisory authority (German Federal Administration Office) has not yet issued a public statement on this matter.

In view of the current legal situation being formally in conflict with EU law, beneficial owners are advised to closely monitor the current developments regarding the protection of their personal data. To prevent the misuse of their data appropriate counter-measures should be considered, such as (i) the filing of an application for the restriction of inspection, if justifiable in the individual case (sec. 23 para. 2 AMLA) and/or (ii) the regular use of the beneficial owners’ right to obtain information about inspections in their registered data (sec. 23 para. 8 AMLA).

I. Background

1. Obligation to notify beneficial owners

After so-called “fictions of notification” (Mitteilungsfiktionen) were abolished on 31 July 2021 and latest transitional notification periods in this regard expired on 31 December 2022, entities (i.e. legal entities under private law and registered partnerships) with registered seat in Germany are as of 1 January 2023 fully obliged to immediately notify the information on their beneficial owners for entry into the German transparency register (sec. 20 para. 1 sent. 1 AMLA); this also applies to companies listed on the stock exchange and their subsidiaries (Deloitte Legal | Anti-Money Laundering Compliance | Notification obligations vis-à-vis the German transparency register). Exceptions may apply for registered associations (sec. 20a AMLA).

The same obligation applies to domestic administrators of so-called “trusts” as well as domestic trustees of other “special legal constructions” (sec. 21 para. 1 sent. 1, para. 2 AMLA).

Special regulations that have been significantly tightened with the entry into force of the so-called “Sanctions Enforcement Act II” on 28 December 2022 (sec. 20 para. 1 sent. 2, sent. 3 AMLA new version) exist for entities with registered seat abroad having a connection to real estate located in Germany. In this regard special transitional periods until 30 June 2023 apply for notification obligations in certain cases (sec. 59 para. 13 AMLA new version).

2. Registered (personal) data of beneficial owners

The following information on beneficial owners is subject to notification and currently registered in the exclusively electronically managed German transparency register: first and last name, date of birth, place of residence with country of residence (= place of main residence), type and extent of the beneficial interest and all nationalities (sec. 19 para. 1 AMLA).

In contrast to other EU member states, the notification and registration of further personal data such as place of birth, complete private or business address as well as identification numbers of beneficial owners is currently not required in Germany.

3. Inspection right

By way of implementation of the 5th EU Anti-Money Laundering Directive the German AMLA provides in sec. 23 para. 1 sent. 1 no. 3 AMLA as of 1 January 2020 for an unrestricted inspection right into the German transparency register for “all members of the public” (Deloitte Legal | Transparency register - Latest Developments Due to the 5th Anti-Money Laundering Directive). Despite the ECJ judgment and even after the latest revision of the German AMLA that entered into force on 28 December 2022, the demonstration of a “legitimate interest” is not provided for by German statutory law. The insofar now existing obligation for an “EU law conform interpretation” of the German AMLA by the registry authority remains unaffected hereof (see section III. 2.2). 

In addition, inspection rights are granted to all German public authorities and courts for the purpose of fulfillment of their statutory duties (sec. 23 para. 1 sent. 1 no. 1 AMLA) as well as to “specially obliged“ persons under the German AMLA for the purpose of fulfillment of their own due diligence obligations (e.g. credit institutions, insurance companies, public notaries, lawyers, auditors and real estate agents; sec. 23 para. 1 sent. 1 no. 2 AMLA). Previously applicable limitations at state level, such as an access authorization only for certain governmental bodies, for example financial authorities, law enforcement agencies or the Financial Intelligence Unit (FIU), were abolished with the entry into force of the so-called “Sanctions Enforcement Act II” on 28 December 2022.

4. Beneficial owners’ right to apply for the restriction of inspection

The retrieval of the beneficial owners’ (personal) data within the inspection by members of the public is already limited by law to first and last name, month and year of birth, country of residence, type and extent of the beneficial interest and all nationalities (sec. 23 para. 1 sent. 4 AMLA). The beneficial owner’s date of birth and place of residence are in principle only accessible for German public authorities and courts as well as for under the German AMLA “specially obliged“ persons. 

The German registry authority can also completely or partially restrict the inspection of the German transparency register by all members of the public upon application of the beneficial owner (sec. 23 para. 2 sent. 1 AMLA). The inspection by individual groups of “specially obliged“ persons under the German AMLA (e.g. insurance intermediaries, real estate agents, lawyers and auditors) can also be restricted upon such application. However, a restriction is not possible vis-à-vis public authorities, courts and public notaries (sec. 23 para. 2 sent. 4 AMLA).

For a successful application it is decisive, that the beneficial owner can demonstrate that under consideration of all circumstances of the individual case “prevailing interests”, such as an (abstract) risk of certain criminal offences (e.g. fraud or abduction for purpose of extortion) or the beneficial owner’s minority or legal incapacity require the restriction of inspection rights (sec. 23 para. 2 sent. 1, sent. 2 AMLA).

However, a restriction of inspection is not possible in case the beneficial owner’s data can already be retrieved from other public registers (such as the German commercial register; sec. 23 para. 2 sent. 3 AMLA). This may particularly be the case if the legal representatives of an entity (e.g. managing director in case of a German limited liability company, board of directors in case of a German stock corporation) are notified to the German transparency register as so-called fictitious beneficial owners (fiktiv wirtschaftlich Berechtigte).

5. Beneficial owners’ right to obtain information about inspections

Upon request, the German registry authority must inform beneficial owners about inspections carried out by members of the public (sec. 23 para. 8 sent. 1, sent. 2 AMLA). This information must be provided at least once per calendar year, but not more than once per quarter (sec. 23 para. 8 sent. 4 AMLA).

The information contains (1) the beneficial owner’s inspected personal data, (2) the monthly number of inspections carried out since the last application, (3) the time of the respective inspections, (4) an anonymized list of natural persons that inspected the information and (5) in case of inspections by a legal person, its company name (sec. 23 para. 8 sent. 3 AMLA).

Considering the ECJ judgment of 12 January 2023 (case C-154/21) in a different case regarding the required transparency of data processing by state authorities, it remains to be seen whether aforementioned right of beneficial owners to obtain information about inspections will be extended in such way that full and clear names of the members of the public inspecting the German transparency register must be provided to the beneficial owners in the future.

II. ECJ judgment on the protection of beneficial owners’ fundamental rights

In its judgment of 22 November 2022 regarding two requests for a preliminary ruling (article 267 TFEU) submitted by the District Court of Luxembourg, the ECJ declared the legal base of unrestricted access for all members of the public to the transparency registers of the EU member states as foreseen in the 5th EU Anti-Money Laundering Directive (article 1 no. 15 lit. c) EU directive 2018/843) invalid. The invalidated provision of the 5th EU Anti-Money Laundering Directive previously replaced the corresponding provision of the 4th EU Anti-Money Laundering Directive (article 30 para. 5 subpara. 1 lit. c) EU directive 2015/849) that required an undefined “legitimate interest” for the access of the general public to the transparency registers of the EU member states.

In the reasons for its ruling the ECJ states that the access by all members of the public to the information on beneficial owners constitutes a severe infringement of their fundamental rights to respect for private life and protection of personal data (articles 7 and 8 of the Charter of Fundamental Rights of the European Union). This results primarily from the fact that the information available to the public can be used to create a more or less comprehensive profile of the beneficial owner, the information is accessible to an unlimited number of persons, even without any connection to the prevention and combating of money laundering and terrorism, and can be freely retrieved on the internet, retained and distributed.

Such interference could also not be justified by the legal consideration that underlies the abolishment of the “legitimate interest”. It was intended to prevent practical difficulties when interpreting the concept of “legitimate interest” due to the lack of a uniform definition and to ensure a greater control by the civil society. However, according to the ECJ neither of these arguments could justify the unrestricted access for all members of the public to the transparency registers. Particularly the responsibility for the prevention and combat of money laundering and terrorist financing should primarily lie with public authorities and certain institutions such as credit and financial institutions.

III. The ECJ judgment’s legal consequences at national and EU level

1. EU level

1.1 Legal situation

In accordance with the legal opinion published by the German registry authority, it can be assumed that the “invalidity” of article 1 no. 15 lit. c) of the 5th EU Anti-Money Laundering Directive declared in the ECJ judgment leads to a revival of the previous provision of the 4th EU Anti-Money Laundering Directive (article 30 para. 5 subpara. 1 lit. c)) requiring a “legitimate interest” for the public’s access (cf. ECJ, case C-421/06 - Fratelli Martini, recital 57).

The foregoing notwithstanding, for reasons of legal certainty and legal clarity the EU legislator is obliged to amend respectively correct the provision of the directive that has been declared invalid (cf. ECJ, case C-421/06 - Fratelli Martini, recitals 52; 56; ECJ, case 300/86 - Van Landschoot, recital 22).

1.2 Legislative project | 6th EU Anti-Money Laundering Directive

Against this background, the draft version of the 6th EU Anti-Money Laundering Directive updated by the Council of the European Union on 5 December 2022 and thus immediately after the ECJ judgment (Council of the European Union, 2021/0250 (COD), 15519/22) now again provides for the requirement to demonstrate a “legitimate interest” for the public’s access to the member states’ transparency registers (draft article 12 para. 1 subpara. 1).

According to the currently proposed explanatory memorandum of the directive, the concept of a “legitimate interest” should not be interpreted too restrictively (draft recital no. 32) but must have a connection to the combating or prevention of money laundering, related predicate offences or terrorist financing.

Following the consideration of the ECJ judgment (cf. recital 74) the updated draft version of the directive for the first time determines certain cases to apply uniformly across the EU and substantiating the requirement of a “legitimate interest” (draft article 12 para. 1 subpara. 2). Accordingly, a legitimate interest can be particularly assumed for inspections of the following members of the public:

• "the journalists and civil society organisations that are connected with the prevention and combating of money laundering and terrorist financing and 
• persons who are likely to enter into transactions with a legal entity and financial institutions and authorities, in so far as they are involved in the prevention and combat of money laundering, its predicate offences or terrorist financing and do not already have access […].“ 

However, it is not yet clear whether the difficulties of interpretation of the term “legitimate interest” due to the lack of a uniform definition in the 4th EU Anti-Money Laundering Directive (that was referred to also during the ECJ proceeding) can be avoided in the future. This is particularly apparent as the wording of the 2nd case group offers even under consideration of the current recitals considerable potential for divergent interpretations within the 27 EU member states and the case groups are not final and exhaustive.

2. National level

2.1 Legal situation

The regulation in sec. 23 para. 1 sent. 1 no. 3 AMLA, which was adopted by way of implementation of the provision of the 5th EU Anti-Money Laundering Directive now declared invalid by the ECJ, does not comply with EU law. This provision, which formally continuously provides for an unrestricted right to inspect the German transparency register for all members of the public, is incompatible with the current ECJ judgment and the now again applicable provision of the 4th EU Anti-Money Laundering Directive (article 30 para. 5 subpara. 1 lit. c)), which requires a “legitimate interest” for the public’s access.

A new legal regulation by the German legislator is expected at the earliest within the implementation of the 6th EU Anti-Money Laundering Directive as part of the so-called “EU Anti-Money Laundering Prevention Legislative Package”, which is not expected to be adopted before mid-year 2023. Only during the implementation period of 3 years beginning with the entry into force of the 6th EU Anti-Money Laundering Directive (draft article 58 para. 1 subpara. 1) also a legal clarification of the term “legitimate interest” in line with EU-law is expected to be regulated in Germany.

2.2 Current administrative practice

However, in order of a uniform application of EU law the EU member states’ national authorities are obliged to take the necessary measures resulting from the invalidity as declared by the ECJ for its respective national law even before a new legal regulation is adopted (cf. ECJ, case C-421/06 - Fratelli Martini, recital. 53 with further references; ECJ, cases C-231/06 to C-233/06 - Jonkman et al., recital. 38).

Thus, the administrative practice of the German registry authority updated with publication of 12 December 2022 (see above) does not raise significant concerns, at least until a new legal regulation enters into force.

Considering generally approved principles of the EU member state authorities’ rights and duties to interpret national legislation in conformity with EU law (cf. ECJ, case 14/83 - von Colson and Kamann, recital. 26), this particularly applies for the general (re-) introduction of the obligation to demonstrate a “legitimate interest” under consideration of the legal situation applicable in Germany based on the 4th EU Anti-Money Laundering Directive until 31 December 2019.

Since the term “legitimate interest” was neither defined in the 4th EU Anti-Money Laundering Directive nor in the corresponding national transposition law applicable in Germany until 31 December 2019, it can be assumed that the German registry authority will for now revert to the principles of interpretation developed at the time in this regard.

Accordingly, considering the relevant official explanatory memorandum a “legitimate interest” could only be assumed for a member of the public in case it could be qualified as a “reasonable interest justified by the factual circumstances”, subject to the condition of a “relation to the prevention and combating of money laundering, related predicate offences and terrorist financing”. Such interest was particularly to be assumed for the benefit of non-governmental organizations and specialized journalists operating in this field (recital no. 14 of the 4th EU Anti-Money Laundering Directive; BT-Drs. 18/11555, page 133; BVA FAQ of 1 October 2019, section V.2.).

According to the current legal interpretation by the German registry authority a “legitimate interest” should additionally be assumed “if it is intended to review the own information of the registration (so-called self-inspection)”.

It remains to be seen whether the German registry authority exceeded the limits of its intended “EU law conform interpretation” of sec. 23 para. 1 no. 3 AMLA by introducing for the first time a - from a practical point of view to be welcomed - “right to self-inspection” for the entities subject to notification obligations and whether the current administrative practice as substantiated at the end of January 2023 would also fully withstand a judicial review.

IV. Conclusion

The ECJ’s landmark anti-money laundering law judgment leads to a considerable expansion of the protection of beneficial owners’ (personal) data.

Based on Germany’s updated administrative practice following the ECJ judgment as well as upcoming legislative projects at EU level it can be assumed that the legal possibilities for the general public to inspect beneficial owners’ data belong to the past.

Thus, applications of beneficial owners according to sec. 23 para. 2 sent. 1 AMLA aiming to (completely or partially) restrict the German transparency register’s inspection by members of the public with reference to the current ECJ judgment should in doubt only be necessary in exceptional cases. Whether under consideration of the explicit wording of the legal provision the legitimate interest required in this regard can be justified in an individual case, primarily depends (also) on the continuity of the current administrative practice, the content of the still to be adopted final version of the 6th EU Anti-Money Laundering Directive and the respective German national transposition law.

Before this background and under consideration of the current legal situation still being formally inconsistent with EU law, beneficial owners as well as compliance and data protection officers of companies subject to notification obligations are advised to closely monitor the current developments regarding the protection of beneficial owners’ personal data; for prevention of data misuse, besides the above mentioned requests for restriction of inspection the (regular) exercise of the right to obtain information about inspections carried out by members of the public according to sec. 23 para. 8 AMLA should also be duly considered.