A lot of founders still hold one of two beliefs, and both are wrong in 2026. The first is «anyone can Google my ownership, » the second is «it is completely private.» In 2026, the truth is in the middle.
The Court of Justice of the EU ended blanket public access in 2022, and AMLD6 replaced it with a controlled legitimate-interest regime that comes with hard response deadlines. This article compares who could see your name before, who can see it now, and what the new access model means in practice for you, your bank, and the journalist who files a request.
Before: The General-Public Model the CJEU Struck Down in 2022
Until late 2022, several EU member states ran UBO registers on an open-access basis: in principle, any member of the public could look up who beneficially owned a company. The logic was that sunlight deters money laundering. The problem was proportionality — unrestricted public access exposed the personal data of every beneficial owner to anyone at all, for any reason or none.
In November 2022, the Court of Justice of the EU ruled that general public access to beneficial-ownership registers was invalid, holding that it interfered disproportionately with the rights to privacy and data protection. That ruling did not abolish the registers; it removed the «anyone can look» layer. Now to what replaced it.
After: Competent Authorities, Obliged Entities, and «Legitimate Interest»
The post-2022 model is tiered, not closed. Competent authorities — financial-intelligence units, supervisors, tax and law-enforcement bodies — retain full access, because they need it to do their jobs. Obliged entities, which most importantly for a founder means your bank, access the register to perform customer due diligence before and during a relationship. And a third tier was rebuilt around AMLD6: persons who can demonstrate a legitimate interest.
AMLD6 makes legitimate-interest access the EU-wide standard, extending access to authorities, to AMLA, and to persons with a demonstrable legitimate interest — a category that expressly includes journalists and civil-society organisations working on anti-money-laundering. Nevertheless, «legitimate interest» is a gate: a requester has to show why they qualify, rather than simply asking. The register is neither open to all nor sealed shut.
Cyprus as a Worked Example of the Closed-To-Controlled Model
Cyprus shows the sequence cleanly. Reacting to the 2022 CJEU ruling, Cyprus closed public access to its UBO register on 3 January 2023, and access is now limited to competent authorities and obliged entities. For a period, that made the register look effectively private to outsiders — the general public could no longer search it.
But «closed to the public» is not «closed to the people who matter to you commercially.» Your Cypriot company’s beneficial owners are still visible to the regulator and, crucially, to your bank as an obliged entity carrying out due diligence. But as AMLD6 is transposed, the controlled legitimate-interest layer is added back on top, so a qualifying requester can once again reach the data through a defined process rather than an open search bar. Cyprus is the model in miniature: public access removed, authority and obliged-entity access retained, legitimate-interest access rebuilt.
What «Legitimate Interest» Means for Journalists, NGOs and Counterparties
The practical question is how the legitimate-interest gate operates, and here AMLD6 adds a deadline that cuts both ways. From 10 November 2026, registers must answer legitimate-interest access requests within 12 working days. For a journalist or NGO with a qualifying interest, that is a guaranteed timeframe rather than an indefinite wait. For the beneficial owner, it is a defined window in which lawful disclosure to a qualifying requester can occur.
For a counterparty running diligence on a company it is about to deal with, the legitimate-interest route may also apply, depending on how national law frames the interest. Meanwhile, the key point for founders is that visibility is now conditional and time-boxed: your data is not on public display, but a qualifying requester can obtain it through a process with a clock attached. To sum up, the model is controlled transparency — not the free-for-all it was before 2022, and not the vault some founders imagine.
FAQ
Can the general public see my UBO data in the EU in 2026?
No. The 2022 CJEU ruling ended general public access. Access is now limited to competent authorities, obliged entities such as banks, and persons who can demonstrate a legitimate interest.
Who counts as having a «legitimate interest»?
Under AMLD6, persons with a demonstrable legitimate interest — which expressly includes journalists and civil-society organisations working on anti-money-laundering — alongside authorities and AMLA. The requester must show why they qualify.
How fast must a register answer a legitimate-interest request?
From 10 November 2026, within 12 working days. This applies EU-wide as AMLD6 is transposed.
Can my bank still see my beneficial ownership after the CJEU ruling?
Yes. Banks are obliged entities and retain access to perform customer due diligence, regardless of the end of public access.
Is the Cyprus register private now?
It is closed to the general public since 3 January 2023, but competent authorities and obliged entities still have access, and legitimate-interest access is being rebuilt under AMLD6. «Not public» is not the same as «private.»
Conclusion
Neither extreme is true in 2026: your UBO data is not open to anyone with a search bar, nor is it locked away from everyone. The 2022 CJEU ruling ended blanket public access, and AMLD6 replaced it with a tiered model — full access for authorities, ongoing access for your bank, and a legitimate-interest gate for journalists, NGOs and qualifying counterparties, backed by a 12-working-day response rule from 10 November 2026. Cyprus shows the pattern: closed to the public, open to those who matter. Understand which tier a given requester sits in, and the access question stops being a mystery.
Want to know exactly who can reach your ownership data in the jurisdictions where you operate — and structure legitimately around it? Send us your entities and the countries involved on Telegram or WhatsApp, and we will map the access rules that apply to each so you can plan privacy and compliance together rather than at odds.
🔗 ДЖЕРЕЛО: Harris Kyriakides — Cyprus UBO Register access 🔗 ДЖЕРЕЛО: Baker McKenzie — EU: New UBO Rules Come into Force
Узнайте, как защитить свой бизнес.
Получите ценные юридические консультации для вашего стартапа или IT-проекта, чтобы избежать рисков и сосредоточиться на росте.
Эта статья носит исключительно информационный характер и не является юридической, налоговой или финансовой консультацией. Перед принятием решений обратитесь к квалифицированному специалисту. Редакционная политика.
