Countdown to new EU beneficial ownership rules: Testing progress on legitimate interest access

Across the EU, watchdogs are told they have a “legitimate interest” in seeing who owns companies. Yet on the ground, Transparency International has faced rejections, delays and avoidable hurdles.

Last week, the European Commission announced that it was initiating infringement proceedings against 11 Member States for failing to “fully notify” how they transposed the 6th Anti-Money Laundering Directive’s (AMLD6) first set of requirements on access to beneficial ownership information – including for persons with legitimate interest – by the 10 July 2025 deadline. Countries now have two months to take the necessary steps and notify the Commission.

AMLD6 is an important piece of EU legislation which – in the aftermath of the court ruling that ended public access to beneficial ownership registers – established access based on legitimate interest. Crucially, for journalists, civil society and academia whose work is connected to anti-money laundering or its predicate offences, AMLD6 presumes legitimate interest and requires generalised access to registers, instead of access on a case-by-case basis. Member States have until July 2026 to further transpose these operational rules.

To take stock of where things stand, Transparency International has road-tested legitimate-interest access across 14 EU countries that already have these regimes in place. The results show why continued attention is needed: in many countries, requests were left pending for weeks, while paperwork, fees and language barriers routinely posed barriers.

We were refused outright in Ireland and Hungary. In Ireland, officials said our request failed to show company links to convicted individuals or assets in high-risk countries. In Hungary, authorities said our legitimate interest could not be established and asked for proof of close links to the company – legal, ownership, business or family ties. While the law lists such ties as examples, it does not exclude other forms of legitimate interest.

With less than a year to go before the July 2026 deadline, we chart the access journey, explaining what each stage revealed in practice.

During our assessment, we identified different methods to request access.

Currently, Belgium, Finland, Ireland (where we assessed the Central Register of Beneficial Ownership of Companies and Industrial and Provident Societies) and Malta require applicants to send an email with their request (they can skip directly to step 2).

Everyone else would have to navigate online procedures that differ from country to country.

The majority of countries have established electronic verification for first-time registering users, with nearly all registration portals requiring a national or an EU electronic identification (eID) to access – a hurdle that excludes media and civil society from non-EU countries. Even for those with an accepted eID, access is not always straightforward. We found that not all national eID systems function reliably: the Italian eID was not operational at the time we tried and Spain’s eID login option was entirely non-functional, regardless of the ID used.

A few countries offer non-eID paths. Germany and France allow registration as an individual or on behalf of a legal entity without eID. In France, however, choosing to register on behalf of a legal entity triggers mandatory requirements for country-specific data, like requiring users to disclose the SIREN number, which is only available to entities incorporated in France.

Instructions provided to the applicants range from clear to confusing. We had to contact register authorities in Ireland, Hungary and Luxembourg because guidance was missing or unclear. In Belgium, the online instructions did not match the actual process, and authorities redirected us to a different channel. In contrast, Finland, France and Sweden provided instructions that were clear and easy to follow.

Even when instructions were available and accurate, and allowed foreign civil society and media to apply, language remained a recurring barrier.

While most countries’ websites offered an English version, in some cases this was unavailable throughout the whole process. Language issues became more pronounced when non-editable PDF forms in national language had to be submitted to request access – as in France and Lithuania. In the latter case, authorities ultimately offered to provide an English version of the contract to be signed for general access. However, reaching that stage required completing two forms in Lithuanian, which we could only manage with machine translation.

On a more positive note, email communication with register authorities in most countries was conducted smoothly in English. The only exception was in Spain, where the register authority answered in Spanish and specified that they won’t accept access requests in other languages than Spanish. They clarified that this is due to a legal requirement that mandates procedures processed by the general state administration to be conducted in Spanish.

The amount and type of documentation requested varied from country to country.

In terms of documentation concerning the individual submitting the request, almost all countries required a copy of the individual’s ID to be able to verify their identity. Finland and Lithuania also demanded a formal power of attorney if the requester lacked legal authority to represent the organisation. France took a slightly less strict approach, requiring only proof of the individual’s affiliation with the organisation instead of a power of attorney. In this case, we sent the employment contract of the person sending the request and it was accepted. Austria also requested the employment contract as a follow-up to our initial request.

As far as the requesting organisation is concerned, some jurisdictions accepted foundation documents or a charter, while others requested an official extract from the registry in which the organisation is registered. Countries in which register access was provided only to information on specific legal entities or arrangements – as opposed to access to the entire register – also requested the name of the legal entity of interest, and in some cases its registration number.

Additionally, all countries reviewed requested documentation to demonstrate legitimate interest, which also varied from country to country. Some asked us why the information is being requested, along with more information on the general work of Transparency International, its research objectives and activities and how they are connected to the fight against money laundering. Depending on the country, this information could be submitted by uploading files, as a cover letter, or simply provided in a dedicated form or text box.

Other countries required a general explanation of why the information was being requested, without focusing specifically on the organisation’s activities. This includes Austria, Belgium and Finland. In Lithuania, obtaining a general access contract involved a more detailed two-step process. After submitting the initial access request form, users seeking access under the legitimate interest provision were required to complete a “legitimate interest balance form”, a detailed document with more than 20 questions.

In Ireland, demonstration of legitimate interest also involved establishing that the entity we were requesting information on is either linked to convicted individuals or holds assets in high-risk countries. These restrictive conditions have attracted significant criticism from Irish parliamentarians, lawyers, journalists and civil society organisations. The threshold set by Ireland goes far beyond the criteria set out by the CJEU and effectively precludes access to beneficial ownership information for journalists and civil society organisations who should qualify as legitimate-interest users.

Out of the 14 countries analysed, eight currently charge – or plan to charge – users for information once access is approved. In 2023, Spain announced there will be fees, but this hasn’t been introduced yet.

Prices vary sharply. Germany offers the lowest fee, charging €1.65 per extract, before VAT. In contrast, a general data access agreement in Finland requires a payment of €200, case-by-case requests cost €7 and an extract in English is priced at €30.12. Austria and Hungary fall in the mid-range, with fees of €4 and approximately €3.80 (1,500 HUF) per extract, respectively.

The following countries do not charge legitimate interest users for accessing the register: Belgium, Denmark, France, Ireland, Slovenia and Sweden.

Among the countries reviewed, just a few countries specify the maximum timeframe for processing a request in national legislation or on the website of the register. Hungary allows up to 30 days and Finland indicates 2-3 days. In Lithuania, the confirmation email we received after submitting a request cited a timeline of up to 20 days.

In practice, the time required to receive approval or rejection of access varied significantly, ranging from immediate response to more than 20 days. Sweden granted instant access via eID. Ireland replied to an emailed request on the same day. Belgium answered in under a week. At the other end of the spectrum, accessing the data in France and Austria took around 20 days. Hungary responded to our request four months later.

In contrast, we are still awaiting a response from Germany since March 2025.

In Spain, while Transparency International could not receive information because non-functional eID prevented us from submitting a request, Transparency International Spain had more luck. Still, it took register authorities about six months to respond to our chapter’s access request from August 2024, which was eventually granted in February 2025.

On a positive note, when we contacted national authorities for clarification or further information, most responded promptly. In several cases – including Belgium, Finland, Hungary and Lithuania – authorities replied within a few days.

Across all countries where we were able to obtain extracts from the register, a core set of details was consistently provided: the beneficial owner’s name, surname and date of birth (usually month and year, though sometimes the full date). The extent of the ownership interest was also included, except in Spain. Similarly, most jurisdictions disclosed both the country of residence and citizenship, apart from France which provided only the former. Austria and Sweden provided the most complete data.

One gap was universal: no jurisdiction provided historical data, such as the dates when a person became a beneficial owner. From July 2026, all EU countries will be required to provide legitimate-interest users with access to companies’ historical data.

Time and again, investigations reveal how EU companies, alternative investment funds, trusts and other legal vehicles are used by corrupt and criminal actors to hide themselves and their dirty money. Civil society, investigative reporters and academics can help expose those links – but only if access works.

AMLD6’s comprehensive requirements on legitimate-interest access cannot come soon enough. At the same time, its gradual implementation has allowed us to test what works and what doesn’t – with lessons for the EU and other countries building similar regimes.

Our review found diverse barriers across countries. Next year’s AMLD6 transposition should harmonise and standardise rules in most respects – with the European Commission in a central role. The Commission is empowered to issue implementing acts that set out how Member States should apply AMLD6 in practice, including standard templates for requests and procedures to recognise legitimate interest.

This gives the Commission an opportunity to remove overly burdensome requirements now imposed on users – such as demands for a power of attorney. To uphold AMLD6’s non-discrimination principle, the Commission should account for third-country users by providing an alternative system to process non-EU identification documents.

Member States have a role to play, too. For example, they have discretion in setting fees for access, as long as these fees are strictly limited to covering their operating costs and do not inhibit effective access. Our review identified that some countries, such as Finland, currently charge fees that could be prohibitive for legitimate-interest users. If fees must be set, Transparency International urges Member States to make consultation of the register free, and charge only for the issue of official documents and extracts.

To make certain improvements, register authorities don’t need to wait for the July 2026 deadline. Our review identified that in many cases, PDF forms and additional information were only available in the national language. Ensuring that forms and guidance are accessible in English will help ensure legitimate-interest users from all countries within and outside of the EU can request access. Moreover, from next year, register authorities will need to adhere to a 12 working days timeline for responses to applications, about half the time it currently takes to receive access in some countries. Authorities should already improve the user experience by providing clear channels for contacting authorities and reasonable response times to enquiries.

Taken together, these steps will help ensure that journalists, civil society organisations and academics, who play a critical role in the prevention and combating of money laundering and its predicate offences such as corruption, can effectively access and use beneficial ownership data.