The Court of Justice of the European Union (CJEU) has ruled that access to a company's beneficial owners conflicts with privacy laws.
A judgment by the Court of Justice of the European Union (CJEU) may have turned back the clock on effective anti-money laundering capability. In a surprise announcement on the 22nd of November, the CJEU closed the doors on public access to company beneficial ownership registers. This decision is counter to the requirements of the EU's 5th EU Anti-Money Laundering Directive (5MLD), which includes several clauses recognizing the need to check beneficial ownership for effective fraud control. 5MLD says, "The need for accurate and up-to-date information on the beneficial owner is a key factor in tracing criminals who might otherwise hide their identity behind a corporate structure."
The court's decision quotes provisions in Articles 7 and 8 of the “Charter of Fundamental Rights of the European Union:” Articles 7 and 8 of the Charter define the “respect for private and family life” and the “protection of personal data,” respectively.
The CJEU ruling attempts to balance AML requirements and privacy enshrined in the GDPR. The ruling states, "...the general public's access to information on beneficial ownership…constitutes a serious interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter." Unfortunately, this new ruling has effectively turned the clock back on anti-money laundering laws that require beneficial ownership checks. Instead, the recent ruling requires that any entity checking for beneficial owners, as part of AML due diligence, must demonstrate a 'legitimate interest.' Protecting privacy is essential to modern digital life, but will this ruling affect efforts to reduce fraud?
What does this mean for financial fraud?
A 2018 FATF study into the concealment of beneficial ownership warned of the consequences of concealment of beneficial ownership. The report states this:
“Schemes designed to obscure beneficial ownership often rely on a “hide in plain sight” strategy. This significantly impairs the ability of financial institutions, professional intermediaries, and competent authorities to identify suspicious activities designed to obscure beneficial ownership and facilitate crime.”
However, in its ruling, the CJEU recognizes the need for AML checks, including beneficial ownership checks, adding the demonstration of legitimate interest into the equation. But privacy vs anti-fraud evaluation will always be a tricky balance to get right. However, access to country registers is already starting to feel the heat, with several countries closing access to beneficial owner registers. The Netherlands Chamber of Commerce (KVK) is one of the first to close access to the registry of beneficial owners with an announcement on its site.
Connecting the fraud dots is an essential tool in the fight against fraud. If one of those dots is removed, the trail of fraud can grow cold; fraudsters always look for loopholes and take advantage of security gaps. By removing access to beneficial owners' public registers, the risk of an air gap opening in anti-fraud measures becomes real.
Intelligent hope for AML
The Basel Institute on Governance has described beneficial ownership transparency as being "directly related to the effectiveness of a jurisdiction's AML systems." Access to this important resource is necessary for anti-fraud measures; fortunately, even without access, intelligent AML checks that use behavioral analysis and AI-driven data analytics can offer a way to plug the gap.
4MLD required legitimate interest to be demonstrated when using publicly held registers of beneficial owners. 5MLD updated this to remove legitimate interest and make access to registers of beneficial owners a key part of AML checks. However, the CJEU has reintroduced legitimate interest in reinstating privacy rights. This see-saw of data rights looks like it will continue, but while this is happening, fraudsters will continue to use the beneficial owner air gap to execute fraud. Intelligent, AI, and behavioral-drive AML technologies look set to plug the gap left by this balancing act.
The press release on the CJEU ruling can be found here.
