The interplay between corporate transparency and personal data protection: A new stage in the CJEU’s case law

 

Dr Samira Allioui, Centre d'études internationales et européennes, Université de Strasbourg

Photo credit: Alexas Fotos, via Wikimedia Commons

On 3 September 2026, the Court of Justice of the European Union (the Court) delivered its judgment in Case C-798/24, Jautiva, addressing the compatibility of unrestricted public access to shareholder information with European Union (EU) company law and data protection rules. The CJEU ruled on the conflict between, on the one hand, the right to the protection of personal data and, on the other, national legal provisions—derived from European Union law—requiring the public disclosure of information regarding the shareholders of public limited companies. The Jautiva case addresses precisely where that boundary lies. This approach is not new; it follows on from the WM and Sovim judgment of 2022 (Joined Cases C‑37/20 and C‑601/20), in which the CJEU had already called into question public access to ultimate beneficial owner (UBO) registers and where the judges had already cast doubt on unrestricted public access to beneficial ownership registers.

WM and Sovim SA v. Luxembourg Business Registers (LBR): an ode to business confidentiality?

As a reminder, in the WM and Sovim judgment, the CJEU had already called into question public access to registers of beneficial owners. The judgment represented a serious setback to European Union efforts to promote fiscal and financial transparency and to enhance the effectiveness of the fight against money laundering. Making beneficial ownership registers public was one of the key tools for identifying a company’s true owner and, in doing so, lifting (at least in part) the veil on illicit schemes that facilitate money laundering and tax evasion.

The cases in question concerned the transposition into Luxembourg law of Article 30(5), first subparagraph, point (c) of the 2015 money laundering Directive, as amended in 2018 (the Fifth Anti-Money Laundering Directive or "5AMLD"). In accordance with 5AMLD, the legislation had structured the Luxembourg Register of Beneficial Owners (RBE) so that information regarding the beneficial owners of registered entities could be stored and made available; access to this data was open to any member of the general public. In certain exceptional circumstances and on a case-by-case basis, a beneficial owner or registered entity could request the register administrator—LBR—to restrict access to specific authorities or entities. After a beneficial owner and a company challenged decisions by the LBR rejecting their requests to restrict public access to information concerning them, the referring court—the Luxembourg District Court—considered that the disclosure of such information could entail a disproportionate risk of infringing the fundamental rights of the beneficial owners concerned. It therefore asked the Court, inter alia, to verify the validity of the EU provisions regarding access to information on beneficial owners.

The Court first noted that, since the data in question includes information on identified natural persons—namely the beneficial owners of companies and other legal entities established within the territory of Member States—access to that data by any member of the general public infringes the fundamental right to respect for private life.

Furthermore, making such data available to the general public constitutes the processing of personal data. Such disclosure represents a serious interference with the fundamental rights enshrined in Articles 7 and 8 of the EU Charter of Fundamental Rights (CFR), given the potential for subsequent use of the disclosed information.

Admittedly, the Court had already had the opportunity to point out that certain data processing operations—even those that do not reveal significant information about individuals' private lives—can nonetheless constitute an infringement of their privacy when the data, taken as a whole, expose individuals to a "risk of profiling." However, it is important to point out that in those cases, the Court reached this conclusion either by highlighting the “sensitive nature of the information that such data may reveal” or because the data in question made it possible to draw very precise conclusions regarding the individuals’ daily habits, activities, and social relationships (the Digital Rights judgment, para 27).

However, as Advocate General Pitruzella noted in his Opinion on the case (at para 101), the risk of profiling enabled by the public nature of the registers was limited, both because it was not possible to conduct searches by individual and because identifying a person’s investments provides only a limited insight into their assets.

The concept of "legitimate interest": an inadequate remedy for the lack of public access to registers in WM and Sovim SA

When examining the justification for this interference, the Court confirmed that the provision regarding public access to the information complies with the principle of legality, does not infringe the essence of the fundamental rights, pursues an objective of general interest, and can be considered appropriate for achieving that objective.

However, the Court held that the interference could not be considered limited to what is strictly necessary. In this regard, the Court compared the amended provisions with the previous provision, which required organizations or individuals to demonstrate a "legitimate interest" before gaining access to information on beneficial owners. Furthermore, the Court held that any difficulty in precisely defining the circumstances and conditions under which such a "legitimate interest" arises does not justify the EU legislature providing the general public with access to that information.

In addition, the Court emphasized that the interference at issue is not proportionate stricto sensu. Thus, the optional provisions allowing Member States to make information on beneficial owners available subject to online registration and to provide, in exceptional circumstances, for an exemption from public access to that information are not, in themselves, capable of demonstrating either a fair balance between the general interest objective pursued and the fundamental rights enshrined in Articles 7 and 8 of the Charter of Fundamental Right (CFR), or the existence of sufficient safeguards enabling the persons concerned to effectively protect their personal data against the risk of abuse.

Consequently, the amended point (c) of the first subparagraph of Article 30 of the AML Directive—which requires Member States to ensure that information on the beneficial owners of companies and other legal entities incorporated within their territory is accessible to any member of the general public in all circumstances—is invalid.

The Court emphasized that the EU legislature had not struck the right balance regarding the fight against money laundering. There were fears at the time that this would "have fraudsters rubbing their hands with glee," and these rulings sparked anger among activists, who were shocked that a court would side with the leaders of tax havens at the expense of public transparency. Others, however, maintained that this represented a victory for data protection and the rule of law within a highly politicized context.

While in WM and Sovim SA v LBR, the Court annulled the 5AMLD provision granting the public access to beneficial ownership registers, Jautiva applies the same logic to a different dataset: declarations by shareholders of public limited companies.

Following the WM and Sovim judgment, several registers went beyond what the ruling required by withdrawing entire datasets. In several Member States, this practice remained effectively suspended while national regimes based on "legitimate interest" were being established.

Background of the Jautiva case: a clarification of public access to shareholder information

The Jautiva case arose when 17 minority shareholders of a public limited company challenged legislation requiring shareholder information to be made publicly available online. For natural persons, this information included their identity and contact details, as well as the class, number, and nominal value of the shares held and the associated voting rights. This information was accessible to unidentified users and could therefore be downloaded in bulk.

To justify this disclosure regime, Latvia cited three main objectives: preventing money laundering and the financing of terrorism and proliferation; ensuring a transparent economic environment and protecting third parties; and facilitating compliance with national, international, and EU sanctions.

To determine whether EU company law required such disclosure and whether unrestricted access was compatible with the GDPR (Articles 7 and 8 of the CFR), the Latvian Constitutional Court referred the matter to the Court. In its request, the Constitutional Court, among others, sought clarification, as to whether EU company regulation requires information on every shareholder of a joint-stock company to be made publicly available and whether such disclosure of personal data is permissible under the GDPR.

Article 14 of the Company Law Directive requires the disclosure of information concerning certain persons who represent a company or participate in its administration, supervision, or control. In its reasoning, the Court rejected the argument that this concept extends to any shareholder. Indeed, whereas persons involved in the administration or supervision of a company are appointed to specific roles and exercise corresponding powers, shareholder status derives from holding a stake in the share capital. In particular, minority shareholders do not exercise management or supervisory functions simply by virtue of holding shares, nor do they generally represent the company or bind it in dealings with third parties. The Court therefore concluded that the Company Law Directive does not require information concerning every shareholder to be made available to the public.

Disproportionate access but legitimate objectives

Next, the Court examined whether Latvia could nonetheless provide for unrestricted public access under its national law. While the objectives cited by Latvia could constitute legitimate objectives of general interest, this did not exempt the disclosure regime itself from meeting the requirements of necessity and proportionality laid down in the GDPR and the CFR.

The Court held that such public disclosure constituted a serious interference with the rights protected by Articles 7 and 8 of the CFR. The information made public could enable the creation of a profile regarding a person’s financial situation, the sectors in which they invest, and the companies in which they hold shares. These concerns were heightened by the fact that the information was accessible online to a potentially unlimited number of people and could subsequently be stored and disseminated (§71).

In light of recent events in Latvia, where several public databases were subjected to cyberattacks and large-scale personal data breaches, the observation made by the Court in paragraph 72 is particularly relevant:

"The potential consequences for the data subjects resulting from any misuse of their data are aggravated by the fact that, once such data have been made accessible to the public, they can not only be freely consulted but also stored and disseminated, and that, in the event of such successive processing operations, it becomes increasingly difficult—if not impossible—for those persons to defend themselves effectively against misuse."

Regarding corporate transparency

The Court considered that the disclosure of information concerning all shareholders—particularly minority shareholders who do not exercise management or control functions—did not appear necessary for the protection of third parties.

Objectives related to combating money laundering and complying with sanctions regimes did not justify unrestricted access either. Given the existence of less intrusive solutions—such as limiting access to persons who can demonstrate a legitimate interest and, for sanctions purposes, adopting more targeted disclosure methods—the existence of a recognized public interest objective does not, in itself, justify making personal data freely accessible to everyone.

Necessity and proportionality

In WM and Sovim v LBR, the Court held that unrestricted public access to beneficial ownership information constituted a serious interference with the rights protected under Articles 7 and 8 of the CFR and went beyond what was strictly necessary for AML purposes.

Jautiva applies the same proportionality considerations in the context of registered shareholders which is relevant in particular for minority shareholders who may neither qualify as beneficial owners under applicable thresholds nor exercise control over the company. The judgment does not prevent Member States from maintaining company registers or providing access to shareholder information. However, it does confirm that the manner in which personal data are made available must remain consistent with the GDPR principles of purpose limitation, data minimisation and proportionality. It should be noted that Directive 2024/1640, part of the sixth money laundering package (adopted after the WM and Sovim judgment), already provides for access to beneficial ownership information by members of the public who can demonstrate a legitimate interest, alongside the access available to competent authorities and obliged entities. In other words, the current EU AML framework has already moved towards a more restricted model of access.

Legitimate interest and the limitations surrounding access to ownership-related personal data

Jautiva confirms that access to such information cannot be treated as unlimited and remains subject to the requirements of necessity, proportionality and data protection. Here, the Court reiterates that transparent is not an end in itself by holding that the Company Law Directive does not require the disclosure of information relating to all shareholders, including minority shareholders. In addition to that, it held that the GDPR precludes national legislation making personal data relating to shareholders of public limited liability companies available to the general public where access is not subject to any conditions, such as demonstration of a legitimate interest.

It is surprising that the legitimacy of the objectives provided by Latvian law has not been called into question. More precisely, Latvian law provided for public access to data concerning all shareholders of a public limited company, including minority shareholders, for the purposes of combating money laundering, terrorist financing and the proliferation of weapons of mass destruction, as well as implementing international and European sanctions.  

The dual scope of the decision

First, it should be noted that the tools available to obliged entities to fulfil their due diligence obligations, and to competent authorities, are not called into question by the judgment. Second, the imposition of sanctions or the pursuit of AML/CFT objectives does not justify unlimited public access. Indeed, the Court advocates instead for the implementation of differentiated access regimes based on the objective pursued and the status of the requester. However, it is worth considering who will henceforth be able to claim a legitimate interest justifying access to this information.

By confirming that the disclosure obligations imposed by European Union company law cannot be interpreted as automatically extending to information concerning all shareholders—and that national measures providing for broader public access to such information remain subject to the GDPR as well as the principles of necessity and proportionality—the Jautiva judgment marks a new milestone in Court case law regarding the interplay between corporate transparency and the protection of personal data.

Conclusion

Given that these are distinct legal categories—potentially entailing different obligations regarding access, reporting, and disclosure for investors, international groups, and companies—the judgment underscores the importance of clearly distinguishing between the exercise of corporate functions, the holding of shares, the exercise of control, and the status of beneficial owner.

On the one hand, the judgment clarifies that a national regime authorizing unlimited and unconditional online access to the personal data of all shareholders must meet a strict test of necessity and proportionality. On the other hand, the judgment provides an important clarification regarding corporate transparency: EU law does not require the public disclosure of information concerning every shareholder of a public limited company simply by virtue of their status as a shareholder.

More specifically, the significance of this judgment does not lie in pitting the protection of privacy against transparency as mutually exclusive values. Rather, the judgment requires that any disclosure obligation be based on a legal basis and remain proportionate to the objective pursued.

When art goes virtual: what status for collectible NFTs under the current EU Anti Money-Laundering regime?

 

 

 

Anna Mosna, postdoctoral researcher at the Leuven Institute of Criminology (LINC), KU Leuven and Giulio Soana, Ph.D. candidate at Luiss University and KU Leuven

 

Photo credit: Mario Taddei, via Wikimedia Commons

 

Introduction

 

What if we told you that you can buy a digital image of an ape wearing a crown and heart-shaped glasses for two and a half million? Well, you may find this a bit pricey. This does, however, not seem to be a common feeling as images of funny looking apes have sold, over and over, at stellar prices. This specific project is called Bored Ape Yacht Club (BAYC) and features 9999 images of apes, each one slightly different from all the others. The combined value of the collection is reportedly a dizzying 2.9 billion dollars. This is just one of the many non-fungible token (NFT) ventures that have been flourishing in the last few years.

 

Trade in NFTs represents a new market that features virtual goods at skyrocketing prices and apparently little regulation and oversight. With sums of this magnitude at stake, it is inevitable to think about the repercussions of this new market for illicit financial flows control. And indeed, NFTs receive increasing attention in the financial integrity arena. In its ‘2022 Crypto Crime Report’, Chainalysis, one of the most renowned crypto analytics companies globally, identified a growing relevance of NFTs to pursue money laundering and wash trading. This risk was confirmed by the latest virtual assets (VA) report published by the Financial Action Task Force (FATF) in June 2022. There, NFTs have been recognised as one of the key market developments to keep under close watch.

 

 

What are NFTs?

 

Before delving into the intricacies of the anti-money laundering regulation, a brief introduction on what NFTs are, is in order. Non-fungible tokens are one of the latest implementations of blockchain. They exploit blockchains’ immutability and decentralization to create unique, unalterable, and programmable tokens that can be freely traded among the participants of the network. On the one hand, blockchain’s publicity and immutability safeguards the authenticity and uniqueness of the token while allowing anyone to verify it by, simply, accessing the ledger. On the other hand, blockchain’s decentralization means that there is no single entity that can unilaterally modify or control the status of the token once it is created. The token can both be a digital representation of a physical or digital asset–as a work of art, a song, or a ticket to a concert–or solely exist as a digital token. In this latter case, the value is determined exclusively by the characteristics intrinsic to the token, its rarity, in case of a token series like BAYC, being an important factor.  

 

While NFTs may be used in multiple ways–spanning from the amelioration of the supply chain to the metaverse–there is one type that presents a particularly high risk in terms of financial integrity as it is completely decoupled from any pre-existing digital or physical value: digital art, also referred to as collectible tokens, digital collectibles or crypto-collectibles. These are, furthermore, the prime and largest implementation of this technology.

 

Sharing characteristics with both virtual currencies and works of art, collectible NFTs are difficult to frame into a specific category, difficult to regulate and, thanks to their dynamism, prone to misuse for criminal purposes–including money laundering. It is therefore interesting to examine where–if anywhere at all–NFTs can be positioned among the sectors currently covered by the anti-money laundering (AML) framework applicable in the European Union (EU).

 

 

The progressive extension of anti-money laundering rules – what about NFTs?

 

Over the years, anti-money laundering rules have been continuously expanded to address a growing array of laundering tactics. Control and regulation instruments have come to cover alongside service providers and intermediaries in traditional fields, such as the banking sector, also other entities offering financial services, such as the insurance sector, or operating outside the spectrum of financial businesses, such as the real estate sector. Increasing awareness of the potential misuse for the purposes of money laundering and terrorism financing of virtual currencies, due to the anonymity they ensure, and of art transactions, nurtured by the speculative nature of prices at which they are carried out, has triggered a similar extension.

 

Among others, these risks have been highlighted, in the FATF Updated 2021 Guidance for a risk-based approach to virtual assets and virtual asset service providers and, regarding the art market, already in the FATF 2006 Study on trade-based money laundering. Likewise, consciousness of these concerns is reflected in the most recent EU legal instruments in matters of anti-money laundering. The rules enshrined in Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorism financing as amended by Directive (EU) 2018/843 (Fifth AML Directive) now apply also to entities engaged in exchange services between virtual currencies and fiat currencies or trading in works of art.

 

As obliged entities, virtual currency service providers and art market actors must carry out customer due diligence (CDD) that includes know-your client procedures (KYC). As a result, customers and beneficial owners must be identified and their identity verified. CDD also requires a continuous assessment of the business relationship considering its purpose and intended nature. If these compliance measures cannot be carried out, virtual currency service providers and art professionals must refuse to carry out the transaction. They further have an obligation to submit suspicious transaction reports to their national Financial Intelligence Unit (FIU) and to keep documents acquired in compliance with their due diligence duties along with supporting evidence and transaction records for at least five years after the end of the business relationship or after the end of the occasional transaction. These due diligence duties and record keeping obligations are intended to ensure more transparency and better traceability of transactions and to thereby more effectively prevent and, possibly, enforce laundering activities occurring in the trade with virtual currencies and in the art market.

 

The considerations that led to the inclusion of these two sectors within the scope of application of AML rules suggest that there is a comparable need to do the same with the trade in NFTs. NFTs are similar in nature to virtual assets and, at times, to works of art. These tokens even combine and magnify the respective risk factor of each of these two categories. Like virtual assets, NFTs are immaterial and can be exchanged globally and instantaneously in a pseudonymous fashion. Like works of art and collectibles, NFTs have a variable and subjective price that can be artificially inflated.

 

Against this background, the question about the extent to which existing AML rules are already applicable to the trade in NFTs imposes itself. The answer, which is likely to differ according to the use made of the NFTs considered, will depend on the possibility to actually subsume NFTs under the concept of goods whose trade is already regulated. In short: virtual assets, virtual currencies or works of art.

 

 

Non-fungible tokens as virtual assets and virtual currencies

 

The link between NFTs and virtual assets is an obvious one. With virtual assets, NFTs share the technology they both predominantly employ, the blockchain. Most NFT projects are even rooted in an infrastructure–Ethereum–that issues a coin–the Ether–that is classified as a VA. It is, then, natural to wonder if these tokens are themselves virtual assets and, thus, if they fall within the scope of the same financial integrity regulation as VAs.

 

Virtual assets have been, since 2014, object of a progressively stringent regulation. Through ad-hoc guidelines, the FATF has extended to numerous players in the VA world–such as exchangers, wallet providers–registration and compliance duties. According to the FATF glossary, virtual assets are ‘a digital representation of value that can be digitally traded, or transferred, and can be used for payment or investment purposes’. Notwithstanding the distinct similarity to such assets, according to the FATF, NFTs are, in principle, not considered to be virtual assets. As provided by the above-mentioned 2021 Guidance, ‘[d]igital assets that are unique, rather than interchangeable, and that are in practice used as collectibles rather than as payment or investment instruments […] depending on their characteristics, are generally not considered to be VAs under the FATF definition’.

 

This exclusion does however not imply that NFTs are entirely exempt from the application of anti-money laundering rules. As the FATF Guidance clarifies, this definition of ‘virtual assets’ must be interpreted broadly and functionally–meaning: through the analysis of the concrete function of the analysed asset. First, the FATF specifies that the exclusion only covers tokens that are used as collectibles. If NFTs are used in practice as means of payment or investment, they would still fall within the definition of VA and, one could add, also within that of ‘virtual currencies’ as coined by the Fifth AML Directive. The Directive defines virtual currencies as ‘a digital representation of value that is not issued or guaranteed by a central bank or a public authority, is not necessarily attached to a legally established currency and does not possess a legal status of currency or money, but is accepted by natural or legal persons as a means of exchange and which can be transferred, stored and traded electronically’.

 

Second, the exclusion of NFTs from the scope of the VA regulation does not preclude collectible NFTs from falling, depending on their concrete use, within a different category of regulated asset. This would, for instance, be the case where NFTs are digital representations of other financial assets that are already covered by FATF standards. Also in this case, the AML regime governed by the Fifth AML Directive may apply.

 

 

Non-fungible tokens as works of art?

 

What if NFTs are not used as means of payment or investment, but indeed only used as collectibles? Parallels between NFTs and works of art are, unlike those between NFTs and VAs, not structural but content-related. Collectible NFTs encapsule (digital) art. Can they therefore be defined as ‘works of art’ within the meaning of the Fifth AML Directive?

 

The Fifth AML Directive does not provide for a definition of the concept of ‘works of art’. Even without considering digital contents, this raises the question as to whether only those who trade in so-called ‘fine art’ are subject to the EU AML regime or whether these rules apply also to those who trade, more generally, in cultural objects including, hence, antiquities. As was foreseeable, national implementation laws reflecting different sensitivities towards the need to protect cultural heritage have based their provisions upon different understandings of what ought to be considered a work of art.

 

Member States with considerable wealth of antiquities and a long-standing tradition of strict cultural heritage protection laws, such as Greece or Italy, have adopted a broad notion of works of art and extended national anti-money laundering rules to those trading in fine art and to those trading in antiquities. States that are mainly market countries for cultural objects, such as Germany and the United Kingdom–where the Fifth AML Directive was implemented before Brexit–have opted for a narrower concept of ‘works of art’. Aligning their definition to the one provided in their respective laws on value added tax, they apply their AML regime to those who trade in paintings, drawings, engravings, sculptures and other objects that can be entirely executed by hand. The trade in antiquities is included insofar as the antiquities traded qualify as paintings, drawings, engravings, sculptures. This understanding excludes antique furniture, coins and stamps collections from the concept in question.

 

A workable definition of ‘works of art’ based on the lowest common denominator that has informed national implementations comprises objects that are individually conceived and executed by a person by hand or, one could reasonably add, with the help of different techniques and technologies, as long as the creative process remains human-initiated. Revolving around the two focal points of human creativity and uniqueness this definition excludes objects that are the result of automated reproduction of a potentially unlimited series of identical items. The question now is whether, applying this criterion to digital art, it would allow to identify collectible NFTs, such as those containing an image of an algorithm-generated Bored Ape, as a work of art as envisaged by the Fifth AML Directive.

 

The societal perception of NFTs such as the Board Apes is already that of iconic images, of art. This is confirmed by the fact that collectible NFTs are sold in digital galleries and at digital auctions–as was the case with the NFT ‘Everyday: The First 5000 Days’ by Mike Winkelmann, known as Beeple, that was sold for 69.3 million dollars with fees at Christie’s in early 2021–and, most importantly, by the fact that many artists that have been creative outside the Web3.0–Marina Abramović being an eminent example–consider this kind of NFTs as a new, attractive form of artistic outlet.

 

From a legal standpoint, the concept of ‘work of art’ included in the Fifth AML Directive seems equally to allow for such an inclusion: NFTs are by definition unique and those who are relevant as collectibles–let’s think about the Bored Ape collection, about Beeple’s ‘Everyday: The First 5000 Days’ or about Marina Abramović’s ‘Hero 25FPS’–are the result of human ingenuity and creativity. That being said, as the concrete application of the AML regime designed by the Directive in question depends on national legal instruments implementing its provisions and given that many national laws, like the relevant German framework, identify works of art through lists of categories of objects, it is likely that legislative adjustments may be necessary at that level before the current AML rules are capable to govern the trade in collectible NFTs as well.

 

 

Concluding remarks

 

The general exclusion of collectible NFTs from the purview of the VA regulation does not equal an automatic exclusion of the trade in NFTs from the scope of application of AML rules. Depending on the concrete use that is made of NFTs, they may still be considered virtual currencies or fall within the scope of a different category of regulated assets. This is particularly meaningful in regions, like the EU, where a more stringent regulation than the one envisaged by the FATF has been adopted: it suffices to think of the application of the travel rule to unhosted wallets.

 

Furthermore, the EU AML regime extends also to the trade in works of art–a  category, as has been argued above, under which collectible NFTs could be subsumed. Collectible NFTs appear, indeed, to fulfil the basic requirements of ‘works of art’ as identified by laws implementing the Fifth AML Directive. An extension of the AML regime is therefore possible and, perhaps, not entirely inappropriate in light of the very nature of collectible NFTs: as digital art, they are susceptible to highly subjective, at times arbitrary price-setting. This feature is exacerbated when NFTs exist only as digital tokens. In that case, they do not have any relation to a pre-existing digital nor to a physical artistic expression that could act as a possible parameter for such pricing.

 

Wherever prices can be modified at will and single transactions exceed several millions of dollars–or euros, or pounds–there is an inherent and, arguably, quite sensitive risk of money laundering. Introducing regulation and control appears therefore to be a sensible consideration. As a matter of fact, the policy discourse surrounding NFTs of the last year shows how both the private and the public sector are eager to discuss such measures for the trade in NFTs. This also shines through the Proposal for a Regulation on markets in crypto-assets (MiCA) that is currently undergoing the ordinary legislative procedure. While it does not seem that NFTs will be included in the definition of ‘utility token’ nor, in principle, in the scope of application of MiCA–in line with their positioning regarding FATF standards–Recital 8b that has been newly added to the Proposal for the Regulation refers to the need to reflect on a separate legislative proposal of an EU-wide regulatory regime for NFTs.

New EU Directive on Whistleblower Protection

Vigjilenca Abazi, Assistant Professor of EU Law, Maastricht University & Fellow, Yale Law School

*The author is the co-author of the model Directive presented at the European Parliament in May 2016.

With an overwhelming majority, the European Parliament on 16 April voted in favour of the new law to protect whistleblowers in the European Union. The Directive sets leading standards and has become a prime example of how a concerted effort by civil society – NGOs, trade unions, journalists, scholars, and whistleblowers – together with the European Parliament can lead to progressive legislation and enhance tools that safeguard the rule of law in Europe.  

‘Promoting Gold Standard Protections’ 

Prior to this Directive, whistleblowers faced a paradoxical situation in Europe: they would be prosecuted at the national level, whilst celebrated for ‘promoting European values’ at the EU level, as in the case of LuxLeaks whistleblower Antoine Deltour. The European Parliament called upon the Commission to propose legislation since 2013, yet the Commission had rejected the calls noting lack of EU competences to legislate. The Council was also sceptical, as many member states do not have national laws in place. A key turning point was the presentation of the model Directive promoted by the Greens & European Free Alliance at the European Parliament in 2016. Protecting whistleblowers became inevitable after the EU witnessed the murder of two journalists, Daphne Galizia in Malta and Jàn Kuciak in Slovakia, who exposed corruption in their respective countries.

     

The Directive provides significant improvement in protecting whistleblowers and moves Member States closer toward an advanced legal framework. Indeed, as noted by the world’s leading NGO for whistleblowing, the Whistleblowing International Network, the EU ‘has raised the bar for all EU governments to lead the world in promoting gold standard protections for whistleblowers’ or as Commissioner Jourová remarked these ‘rules will be a game changer’.

The Whistleblower

The Directive covers workers in the public and private sector. More specifically, it includes civil servants, the self-employed, shareholders, management, administrative or supervisory bodies, volunteers, paid or unpaid trainees, contractors, subcontractors and suppliers, individuals disclosing breaches during a recruitment process and former workers. The Directive does not encompass EU officials. For a worker to be able to invoke the protection granted by this Directive, the worker must have reasonable grounds to believe that the information reported was true at the time of reporting and that the information fell within the scope of the Directive.

Wide Ranging Policies

The Directive has a wide scope of protection not only in terms of who can be a whistleblower, but also in terms of policies that it covers. The Commission drew from many different Treaty provisions to ensure that reporting gaps are not created, although the disclosure should be related to a breach or abuse of EU law in any of the following issues: public procurement, financial services, prevention of money laundering and terrorist financing, product safety, transport safety, protection of the environment, radiation protection and nuclear safety, food and feed safety, animal health and welfare, public health, consumer protection, protection of privacy and personal data and security of network and information systems, protection of the financial interests of the Union, breaches of internal market rules, including competition and State aid rules or tax avoidance issues. Strictly national policies are not covered and neither are violations of worker’s rights and working conditions. The latter exclusion will be reviewed in future.

Disclosure Channels

One of the most contested points since the Commission proposed the Directive last year is whether protection will be made conditional on the whistleblowers first reporting internally. The Commission proposal set out a three tier reporting process, and it envisaged a mandatory disclosure first and foremost internally in the organisation. Not only was such a proposal counter to the case law of the European Court of Human Rights on the issue, but also it would have caused more harm than good, especially in Member States that have legislation in place and do not demand such strict channels.

Indeed, the role of civil society cannot be stressed enough in this regard, as it played an invaluable role in making sure that the European Parliament amended the mandatory internal reporting. EP rapporteur Rozière understood these concerns and ensured that this piece of EU legislation meets the adequate standards rather than create uncertainty in legal protection. Making this her “biggest” priority, she succeeded in defending whistleblowers to choose the best means available for disclosure. The adopted Directive foresees that whistleblowers would be protected for reporting internally or for reporting directly to regulators and competent authorities. Reporting to the public still has strings of conditions, but if there were a risk of retaliation or low prospect of the reported breach to be addressed, whistleblowers would be protected if they reported to the public. 

Applicable to Businesses and Public Administration

The Directive applies both in the private and public sector, including to local authorities. Channels for reporting must be set up by companies with more than 50 employees. Local authorities that have less than 50 employees or municipalities with less than 10,000 inhabitants are exempt from the obligation to set up channels of reporting. More guidance on how local and regional authorities should ensure protection for whistleblowers could nevertheless be found in a Resolution of the Council of Europe, which was also voted with sweeping majority earlier in April 2019 by the Congress of Local and Regional Authorities, laying out in detail recommendations and the most recent data on the matter. 

Implementation and Practice

A good law in the books is of little use if its implementation in practice falls short. It will be of outmost importance that the Member States transpose this Directive in its full spirit and even push higher standards where possible. Member States will have two years to transpose the Directive to national law and civil society will continue to monitor closely and possibly facilitate national debates in how whistleblowers should be protected. After the scandals of LuxLeaks, PanamaPapers and Cambridge Analytica, citizens are becoming increasingly aware that whistleblowers play a crucial role in exposing wrongdoing and should not pay a personal price for defending public interest. National governments should take note of this public opinion and implement the EU Directive to its fullest.

Photo credit: The Guardian Nigeria

Money laundering, customer due diligence and data protection: the CJEU's judgment in Safe Interenvios

Marcin Kotula, Legal Officer at the European Commission

The views expressed are purely those of the author and may not in any circumstances be regarded as stating an official position of the European Commission

Background

The recent judgment of the CJEU in the case of Safe Interenvios was triggered by a preliminary reference from the Provincial Court in Barcelona (Audiencia Provincial). The Court in Barcelona submitted to the CJEU a number of questions related to the interpretation of the third Anti-Money Laundering Directive 2005/60/EC (AML Directive, since replaced by the fourth money laundering Directive, discussed here).

In the case in question, Safe, a company which falls under the definition of a "financial institution" within the meaning of the AML Directive and of a "payment institution" within the meaning of the Payment Services Directive 2007/64 (PSD) has been transferring the funds of its customers abroad through the accounts it held with 3 banks, BBVA, Sabadell and Liberbank. The transfers were to be carried out by agents who were accordingly authorised by Safe and verified by the Bank of Spain (Banco de España). After discovering irregularities regarding Safe's agents the banks, acting under Spanish Law 10/2010 on the prevention of money laundering and terrorist financing^[1] which transposes the AML Directive in Spain requested various information from Safe. When Safe did not provide them with the requested information the banks closed its accounts. Before closing Safe's account BBVA informed SEPBLAC^[2] that Safe might be involved in money laundering activities.

Safe challenged the closure of its accounts before the Commercial Court in Barcelona (Juzgado de lo Mercantil) arguing that the banks have also been transferring funds abroad and that insofar they have been competing with Safe on the same market. In consequence, according to Safe, the closure of accounts was an act of unfair competition. Safe argued further that the information requested by the banks which related to Safe's customers as well as to the origin and destination of the funds could not have been provided without breaching the data protection legislation.

Safe's challenge was largely unsuccessful as the Commercial Court in Barcelona did not find a specific infringement of competition law by none of the banks. It concluded that BBVA closed Safe's account on the basis of checks which showed that nearly a quarter of transactions were not carried out by agents authorised by Safe and verified by the Bank of Spain. As for the closure of accounts by Sabadell and Liberbank, the court in Barcelona partly ruled in Safe's favour concluding that these two banks failed to properly set out the reasons for their closures.

Subsequently Safe, Sabadell and Liberbank appealed against that judgment to the Provincial Court in Barcelona which submitted the preliminary questions to the CJEU. 

The CJEU was asked, first, whether customer due diligence measures, laid down in the AML Directive to respond to the risks of money laundering and terrorist financing, could be applied by a credit institution (in the case at hand, a bank) to a financial/payment institution such as Safe, given that financial/payment institutions are already subject to supervision by competent authorities under the PSD and the AML Directive. The CJEU was then additionally asked what type of customer due diligence measures (standard, simplified or enhanced) could be applied in such a scenario and which circumstances could trigger the application of those measures. Finally, the national court asked if the measures and the provision of certain information requested by the banks from Safe are in line with EU competition law (Safe claimed that the banks compete with it on the payment services market) and with EU data protection law (according to Safe, the banks requested the identification data of its customers and of the recipients of the funds which Safe transferred).

The AML Directive sets out the legal framework for measures aimed at preventing and combatting money laundering and terrorist financing. Its provisions are to a great extent inspired by the recommendations of the Financial Action Task Force (FATF), the main international body in the area of combatting money laundering and terrorist financing.  Article 3 of the AML Directive defines which institutions and professions are to apply the anti-money laundering measures. The list in Article 3 includes credit institutions such as banks and financial institutions such as Safe. Chapter II of the AML Directive, which deals with customer due diligence, distinguishes between 3 types of such diligence, i.e. simplified, standard and enhanced.

As far as standard due diligence is concerned, Articles 7 and 8 of the AML Directive describe in which circumstances due diligence should be applied and what measures this might involve. The latter provision underlines that the extent the due diligence measures can be determined on a risk-sensitive basis depending on the type of customer, business relationship, product or transaction.

Article 9 of the AML Directive specifies the checks that need to be undertaken before the establishment of a business relationship or the carrying-out of a transaction. It also indicates when a business relationship must be terminated or a transaction cannot be carried out.

Article 11 sets out the simplified customer due diligence measures which inter alia apply in situations where the customers are credit institutions or financial institutions. Such customers are already covered by the scope of Article 2 of the AML Directive and need to apply due diligence measures towards their own customers. Enhanced customer due diligence is dealt with in Article 13.

Pursuant to Article 37 of the AML Directive the compliance with the requirements of the Directive by the institutions and persons that need to apply it is supervised by competent authorities. Credit institutions and payment institutions are also covered by the PSD.

Payment institutions get authorised to provide payment services by competent authorities designated by the Member States. These authorities are also empowered to supervise the compliance with the requirements that are applicable to payment service providers.

The CJEU's analysis

The CJEU first dealt with the question if financial institutions such as Safe can be the addressees of standard or enhanced customer due diligence measures despite the derogation in Article 11 of the AML Directive which foresees the application of simplified due diligence measures towards financial institutions.

The Court underlined that Article 11 of the AML Directive does not derogate from Article 7(c) under which standard customer diligence measures must be applied when there is a suspicion of money laundering or terrorist financing. Thus, a national provision which authorises the application of standard due diligence measures vis-à-vis financial institutions in such circumstances of suspicion is compatible with the Directive.

In a similar vein, Article 11 of the AML Directive does not derogate from Article 13 thereof. The latter requires enhanced customer due diligence measures to be applied in situations where the risk of money laundering or terrorist financing is higher. Paragraphs (2) to (4) of Article 13 contain a non-exhaustive list of such situations which by their nature present a higher risk. Whilst this list does not include the transfer of funds abroad the Member States have a margin of discretion in applying a risk-based approach and identifying other situations which are, by their nature, associated with a greater risk of money laundering or terrorist financing. In the case at hand, the transfer of funds abroad was included by the Spanish legislator in Law 10/2010 (Article 11) as one of the higher-risk situations which trigger enhanced customer due diligence.

The CJEU then dealt with Article 9 of Spanish Law 10/2010 which on the one hand allows the non-application of standard customer due diligence towards financial institutions but on the other hand empowers the Minister of Economic Affairs and Finance to exclude the application of simplified due diligence towards certain customers. On this point, the CJEU noted that the AML Directive only lays down the minimum level of EU harmonisation with Article 5 of the Directive envisaging the possibility of adopting or retaining in force stricter provisions in the EU Member States. This conclusion was supported by an earlier CJEU judgment in Jyske Bank Gibraltar. The stricter provisions which can apply in the Member States need to serve the purpose of strengthening the fight against money laundering and terrorist financing. They may thus also relate to additional situations which, according to the Member State, present a risk of money laundering or terrorist financing  even if the AML Directive does not prescribe any type of customer due diligence for those situations.

The second group of questions before the CJEU related to the extent of powers which credit institutions may exercise in the context of customer due diligence and to the relation between those powers and the powers of the supervisory authorities under Article 37 of the AML Directive and under Article 21 of the PSD. Here, the Court noted that an institution covered by the AML Directive cannot establish a business relationship or carry out a transaction through its account or must terminate an existing business relationship when it is unable to obtain the various items of information that are defined  in Article 8 of the Directive. These items include the verification of the customer's and the beneficial owner's identity (in the latter case pursuant to a risk-based approach) as well as the information on the purpose and intended nature of the business relationship. The inability of the institution to obtain these types of information might be due to the customers' refusal to cooperate (as in the case at hand) or to other factors.

The CJEU went on to identify the limitations that need to be applied when taking a measure such as the termination of a business relationship or the refusal to carry out a transaction through the bank account. The measure must be proportionate to the risk of money laundering or terrorist financing and thus cannot be taken in the absence of sufficient information which point out to that risk.

The Court then stated that the powers exercised in the context of customer due diligence and the supervisory powers of the competent authorities under the AML Directive and the PSD are rather to be seen as separate and complementary. In consequence, a credit institution may take account of the due diligence measures which its customer had to apply towards its own customers but the extent of the credit institution's due diligence measures in such a scenario must be appropriate to the risk of money laundering and terrorist financing. In addition, a credit institution must in that case neither compromise the supervisory tasks of the competent institutions under the PSD nor replace those supervisory authorities.

Next, the CJEU spelled out the conditions in which the national legislation can authorise or require standard or enhanced customer due diligence measures towards a financial institution. The CJEU's reply to the first group of questions indicated already that such measures can be applied vis-à-vis financial institutions pursuant to Article 13 of the AML Directive (enhanced due diligence) and Article 5 (stricter provisions). In this part of the judgment however the Court examined how the Member States (when prescribing such measures) or the credit institutions (when authorised by the Member State to apply such measures) can exercise the powers under Article 5 and 13.

The CJEU started by recalling its case-law on the freedom to provide services and on the permissible restrictions of that freedom (Art. 56 TFEU). It reminded that in Jyske Bank Gibraltar the prevention of and fight against money laundering and terrorist financing was recognised as a legitimate public interest objective which could justify a barrier to the freedom to provide services. It then turned to the question if Article 11 of Spanish Law 10/2010 which identifies the transfer of money abroad as a situation which always presents a higher risk of money laundering and terrorist financing (and in consequence triggers enhanced customer due diligence) is appropriate for attaining this legitimate public interest objective. In that regard, the Court stressed that both the national legislator (when prescribing standard or enhanced due diligence measures towards a financial institution) and the credit institutions (when authorised by the Member State to apply such measures) must carry out a complete risk assessment prior to deciding on the measures to take. Such measures must furthermore be proportionate to the risk so identified. The final element of this part of the CJEU's judgment was thus dedicated to the proportionality of Article 11 of Spanish Law 10/2010. Here, the Court concluded that the restriction of the freedom to provide services laid down in Article 11 would be proportionate if no less restrictive means were available and if the restriction was compatible with the fundamental rights and freedoms under the Treaties and the Charter e.g. with the right to protection of personal data (Article 8 of the Charter) and with the principle of free competition. Whilst, in principle, leaving the protection of personal data aspects for the last part of the judgment the Court found that a less restrictive measure was available in this case. In the case at hand the Spanish legislator generally presumed that all transfers of money abroad present a higher risk of money laundering and terrorist financing whereas it could have provided a possibility of rebutting that presumption in individual cases which objectively do not present such a risk.

The last group of preliminary questions put before the CJEU focussed on the compatibility of the enhanced due diligence measures with the EU data protection law, as set out in the Data Protection Directive (Directive 95/46). The Provincial Court in Barcelona asked if Safe can be obliged to provide the banks with the identification data of its customers and in particular those from whom the transferred funds originated as well as with the identification data of the recipients of the funds. In the reply to the previous group of questions the CJEU has already indicated that the due diligence measures taken pursuant to Articles 5 and 13 of the AML Directive need to be compatible with Article 8 of the Charter, i.e. with the right to the protection of personal data. The reply to the last group of questions could have thus elaborated on this statement and clarified which personal data of the customers and recipients can be validly requested by credit institutions. However, in the case at hand BBVA denied that it requested the identification data of Safe's customers and of the recipients of the funds. It merely requested the identification data of Safe's agents who used BBVA's accounts. Moreover, the CJEU found the last group of questions not to be sufficiently precise because they only referred generally to the Data Protection Directive without specifying any of its provisions which could be relevant in this context. The part of the preliminary questions which related to the Data Protection Directive was therefore considered inadmissible.  

Comments

The replies of the CJEU to the preliminary questions point out in the direction of giving a certain degree of flexibility to the national legislators and to the institutions and persons which apply customer due diligence measures. On the other hand, the measures prescribed or authorised by the national authorities and the measures applied in individual cases by banks and other institutions and persons covered by the AML Directive need to be preceded by comprehensive risk assessments. Those risk assessments should lead to the definition of measures which are appropriate to the identified level of risk. The measures can vary depending on the type of customer, business relationship, product or transaction.

This kind of well-balanced approach seems in line with the objectives of the AML Directive and with the CJEU's case-law which recognised preventing and combatting money laundering and terrorist financing as an overriding reason in the public interest.

The CJEU added a further safeguard at the later stages of the judgment: the proportionality of the customer due diligence measures depends not only on the results of the risk assessment but also on their compliance with the fundamental rights and freedoms and general principles of law. The Court specifically mentions the principle of free competition and the right to the protection of personal data enshrined in Article 8 of the Charter.

In Safe the CJEU did not however provide any specific indications on the issue which personal data can be requested from the customer in the context of due diligence measures and in which circumstances. This was so because the last group of preliminary questions was based on facts which were disputed in the proceedings and eventually this last group was declared inadmissible by the Court.

The AML Directive does not really address the matter how the measures it designs relate to the protection of personal data. In fact, there is only one point in the text of the Directive which touches upon that issue. It is Recital 33 which refers to the applicability of national data protection laws and of the international transfers rules of the Data Protection Directive in the context of the transmission of information to the Financial Intelligence Units (FIUs) and the disclosure of information about such a transmission.

On the other hand, the new fourth Anti-Money Laundering Directive 2015/849 is much more outspoken in this respect. Its Chapter V implicitly states that Article 7(e) of the Data Protection Directive constitutes the legal basis for processing personal data for the purpose of the prevention of money laundering and terrorist financing by recognising, in Article 43, that such processing is a matter of public interest. The same Chapter deals also with the issue of the information that needs to be provided to the customer before establishing a business relationship or carrying out an occasional transaction. Finally, it lays down more precise indications with regard to the transmission of information to FIUs and to the disclosure of that fact to the customers. According to Article 41(4) this issue should be regulated in national laws which must strike the balance between the access of the customer to the personal data and the interests of the proper functioning of the anti-money laundering procedures and investigations.

The provisions on the different kinds of customer due diligence are also more precise in the new Directive. There is no longer a derogation from standard due diligence for financial institutions. The Directive is now accompanied by three annexes. The first of these annexes contains a non-exhaustive list of risk variables that shall be taken into account when determining the extent of customer due diligence measures. The second annex includes a non-exhaustive list of factors which point out to a potentially lower risk of money laundering and terrorist financing, i.e. the degree of risk that might trigger the application of simplified customer due diligence. Finally, the third annex is a non-exhaustive list of factors suggesting a higher degree of risk which requires the application of enhanced customer due diligence. Generally speaking, the factors included in the three annexes relate to types of customers, geographic areas, and particular products, services, transactions or delivery channels. In addition, Articles 17 and 18 of Directive 2015/849 envisage guidelines on the risk factors and the measures to be taken in situations of simplified customer due diligence and enhanced customer due diligence respectively. Such guidelines shall be issued by ESAs, i.e. the European Supervisory Authorities (EBA, EIOPA and ESMA) by 26 June 2017.

Photo credit: gfintegrity.org

---

[1] Ley 10/2010 de prevención del blanqueo de capitales y de la financiación del terrorismo.

[2] The Executive Service of the Commission for the Prevention of Money Laundering and Financial Crime of the Bank of Spain - Servicio Ejecutivo de la Comisión de Prevención de Blanqueo de Capitales e Infracciones Monetarias del Banco de España.

The new EU Anti-Money Laundering legal framework: the race has started again…

by Dalila DELORENZI (FREE Group Trainee)*

After two years, the process of revision of the new EU Anti-Money Laundering (AML) framework finally came to an end on 20 May, when the European Parliament at its second reading adopted the Fourth AML Directive  (Directive (EU) 2015/849) along with the new Regulation on information on the payer accompanying transfers of funds (Regulation (EU) 2015/847).

The revision was triggered by the necessity to adapt the legal framework to counter new threats of money laundering and terrorist financing and to reflect recent changes due to revised Financial Actiont Task Force (FATF) Recommendations. The following blog post presents the new legal framework, including some crucial measures which could represent a real step-up in the fight against money laundering, financing terrorism and tax evasion.

1.      Introduction of an European register of beneficial ownership

The creation of an European register of beneficial ownership was one of the sticking points of the negotiations, and was the reason why the text attracted much more political attention than the previous directives and why the negotiations took much longer than was expected.

1.1 Definition of beneficial ownership and the problems caused by “phantom firms”

A beneficial owner  is a natural person – a real, live human being and not another company or trust – who stands behind a company (or trust) as the ultimate owner and controller, directly or indirectly exercising substantial control over the company or receiving substantial economic benefits (such as receipt of income) from the company. If the true owner’s name is disguised, we deal with “anonymous companies”. In a majority of countries, keeping unknown the true owner’s name is perfectly legal and there is typically no requirement to disclose that the names listed are merely front-people.

Such anonymous companies can be created by using “nominees”, people who front the company in place of the true owner, or by incorporating one or more of the companies in a country which does not make details of the beneficial owners publicly available. Also called “phantom firms”, they exist only on paper, with no real employees or office. While it’s certainly true that such entities can have legitimate uses, the untraceable company can also be a vehicle of choice for crimes such as money laundering, tax evasion and financing of terrorism.

1.2 The role of anonymous companies in money laundering

Although there are countless ways to launder money, money laundering can be broken down into three stages:

§  Placement: the initial entry of illicit money into the financial system. This might be done by breaking up large amounts of cash into less conspicuous smaller sums that are then deposited directly into a bank account.

§  Layering: the second step consists in the process of separating the funds from their source. This purpose is often followed by using anonymous shell companies: for instance, wiring money to account owned by anonymous shell company.

§  Integration: money re-enters the legitimate economy, for instance, by investing the funds into real estate and luxury assets.

That being said, it is clear that these secretive “shell” companies and trusts play a central role in laundering and channelling funds, concealing behind a veil of secrecy the identity of corrupt individuals and irresponsible businesses involved in activities, including tax evasion, terrorist financing, and the trafficking of drugs and people. More precisely, it is impossible for law enforcement officials go back to the real individuals ultimately responsible for the company’s actions and to track the origin of illicit funds.

§  1.3 The importance of central registers

Broadly speaking, with a view to facing the risk of money laundering (along with financing terrorism and tax evasion), the solution may be to know who ultimately stands behind a company: the real owner or controller.

For this reason – and also following the FATF’s recommendations, as discussed here  – the Commission’s proposal for the 4th AML directive introduced a new chapter, titled Beneficial Ownership Information. The aim was to strengthen the information relating to the beneficial owner, making such information available to competent authorities and obliged entities in an adequate, accurate and timely manner. After all, only few EU jurisdictions require structures to share such information with their national authorities and the need to fill these gaps (a key loophole for money launderers) was strongly felt.

1.4.      Access to central register information…

Taking the first steps from the Commission’s draft proposal, the European Parliament and the Council went even further. Even though this was not envisaged in the initial proposal, the negotiators agreed on the necessity of establishing central registers of beneficial ownership information in every European State. This was not without difficulties inside the Council: the main sticking point was administrative issues more than political ones. Indeed, the fact that no Member State already has a central register entails that they all have to create one, which is very costly at the administrative level.

However, even though they agreed on storing information on beneficial ownership, the European Parliament and the Council had a divergent point of view on another issue: whether details of beneficial owners have to be publicly accessible or not.

In particular, in March 2014, the European Parliament approved a version of the Directive that would have required every EU Member State to establish ownership registers and make the information freely available to the public. “The public registers will make life more difficult for criminals trying to hide their money. Our economy currently loses huge amounts to tax evasion”, said Civil Liberties Committee rapporteur Judith Sargentini (Greens/EFA, NL).

Instead, the Council released its own draft in June 2014, that would also have mandated central registers, but without requiring public access. The Council’s approach was to restrict the access to competent authorities, Financial Intelligence Units (hereinafter FIUs) and, if allowed by Member States, the obliged entity, e.g., banks and legal professions.

1.5. …a compromise was reached

The final text struck a compromise between these initial positions: on the one hand those who demand full transparency (such as the European Parliament, which voted 643-30 in favour of public registries and some Member States as UK, France, Netherlands and Denmark); on the other hand those who defend some secrecy for beneficial owners (some Member States led by Germany).

The compromise reached requires EU countries to provide access not only to law enforcement and financial institutions like the FIUs, but also to members of the public who can demonstrate a “legitimate interest” in the information. They will be able to access beneficial ownership information – such as the beneficial owner’s name, month and year of birth, nationality, residency and details on ownership –  and the access may be subject to online registration of the person and to the payment of a fee to cover administrative costs. Any exemption to the access would be possible only on a case-by-case basis in exceptional circumstances.

In conclusion, the collection of ownership information is certainly a big step in the right direction, but not as big as it should have been. In fact, even if the Directive does not prevent countries from going beyond the Directive’s requirements and opening their registries to full public access – as UK and Denmark have already said they will do – “European leaders have missed an opportunity to show that the future of business in Europe is open and transparent”, said Robert Palmer, an anti-money laundering campaign leader at Global Witness, Furthermore, a Commission report on the interconnection of national registers is expected by June 2019.

1.6. A “legitimate interest” is required to access…

As result of the final compromise, the members of the public have the right to access registers only if they have a legitimate interest, narrowing in this way the number of people having the right to access registers.  So, to those who have pointed out that this does not go far enough in terms of the EU’s ambitions on transparency, the co-rapporteur Judith Sargentini assured that they made sure that the proposal says that it’s up to the authority to prove that applicants do not have a legitimate interest.

Nevertheless, there is an important issue left open: there is no indication of what interests will be considered legitimate. Indeed, the concept of “legitimate interest” itself is quite vague and the lack of a clear definition entails that it lies with Member States to decide what a legitimate interest should be.

1.7. A different regulation for trusts…

A different regulation is provided for trusts, regarding in particular three aspects:

§  the regulation expects that information will be collected in closed centralised registries available only to government bodies. This information includes the identity of the settlor, the trustee(s), the protector (if any), the beneficiaries or class of beneficiaries, and of any other natural person exercising effective control over the trust. Clearly the fact that such information will not be available to the public can create a loophole in the system which could significantly weaken the new directive, frustrating then the aim of improving transparency. This loophole was due to the UK, where trusts are quite common, and it was justified by the co-rapporteur Timothy Kirkhope saying: “I heard some concerns and if I may just say on the issue of trusts and wills: trusts and wills contain some of the most private and personal information that there is about a person, and we are a parliament that respects data privacy, hence disclosure for trusts has to be proportionate within our proposals.”.

§  the registration of beneficial owners of trusts only when a trust “generates tax consequences”: such wording is arguably too broad and highly susceptible to evasion risk

§  the central registration of beneficial ownership information will be used where the trust generates consequences as regards taxation (Article 30). Regarding legal persons, instead, Article 29 of the Directive foresees that the location of the beneficial owner register shall be the country by whose laws the legal person is governed. This is a key issue because if it is not made clear that trust registers need to be located in the countries by whose laws the trust is governed, there is a high risk for that any other location would not serve the purpose of enforcing transparency, especially considering the fact that trusts are not recognized in the majority of Member States! (See also the declaration by Austria expressing concern about trusts).

1.8.            EU as a model to follow?

In closing on beneficial ownership information, we may say that even if the EU institutions could have gone even further in terms of transparency, the agreement reached sharply contrasts with the lack of progress in the United States. The U.S. is, indeed, notorious internationally for allowing anonymous companies to be formed.

“So let us make this an example for other countries in the world. Would it not be fantastic if the USA were to follow us, would it not be marvellous in our fight against tax avoidance and tax evasion? I want everyone to help us reach that.”, said the co-rapporteur Judith Sargentini at the end of her intervention at the MEPs debate in plenary session.

2.      The Risk-Based Approach

The risk-based approach is another hot topic and a new element of the 4^th AML directive. The idea is that the risk of money laundering is not exactly the same in every situation. It’s then important to be able to understand what the risks of money laundering and financing terrorism are in order to adapt customer due diligence (CDD) measures to different situations: focusing resources on those areas where is demonstrated that risks are higher and giving the possibility to apply simplified due diligence when risks are lower.

In other words, introducing a risk-based approach means that countries, competent authorities and reporting entities are expected to identify, assess and understand the money laundering as well as terrorist financing risks they are exposed to, so that they can develop the appropriate measures to mitigate and better target these risks. This activity will be supported at four different levels:

1.   European Union: supranational risk assessment, carried out by the Commission, aimed to pinpoint risks related to the internal market.

2.   Member States: national risk assessment to understand exactly where the risk appears or may exist within their specific jurisdictions.

3.    Institutions and persons covered by the Directive

4.   Supervisors: supervisory authorities such as ESMA and EBA (the EU’s financial services regulatory agencies).

Certainly, this is a main change compared to the third AML Directive where we had three scenarios: simplified, normal and enhanced CDD rules. In the fourth Directive, instead, CDD-rules are more risk sensitive: it all depends on what kind of risks exist, discerning between enhanced measures where risks are greater and simplified measures where risks are demonstrated to be less. Nevertheless, there are some particular cases where obliged entities shall be required to apply Enhanced Customer Due Diligence. More precisely, this applies: when dealing with clients in third country identified as “high risk”; in cases of cross-border correspondent relationships with third countries; in transactions involving Politically Exposed Persons (and family members); and in complex and unusually large transactions which have no economic or lawful purpose. In any other case, the risk-based approach is applied, removing the automatic entitlement to apply Simplified Customer Due Diligence when dealing with specified customers and products.

3.      Politically Exposed Persons (PEPs)

3.1. What is a Politically Exposed Person and what are the risks associated?

The Third AML Directive defines “politically exposed persons” as natural persons who are or have been entrusted with prominent public functions such as Heads of State or of government, senior politicians, senior government, judicial or military officials, senior executives of state owned corporations, important political party officials. Immediate family members or persons known to be close associates of such persons are included in the definition.

Due to the position they hold, it is recognised that many PEPs are in positions that potentially can be abused for the purpose of committing money laundering offences and related predicate offences, including corruption and bribery, as well as conducting activity related to terrorist financing. So, in case of business relationships with PEPs, it was felt necessary to put in place preventive measures, especially anti-money laundering and counter-terrorist financing measures.

3.2. The third AMLD and the FATF standards

To address such potential risks associated with PEPs, in 2003 the Financial Actions Task Force released obligatory requirements for foreign PEPs (whether as customer or beneficial owner). In particular, in addition to normal customer due diligence measures, financial institutions should be required to:

§  have appropriate risk-management systems to determine whether the customer or the beneficial owner is a politically exposed person;

§  obtain senior management approval for establishing (or continuing, for existing customers) such business relationships;

§  take reasonable measures to establish the source of wealth and source of funds;

§  conduct enhanced ongoing monitoring of the business relationship.

Following the international standards, the third AML Directive envisaged that obliged entities are required to apply enhanced customer due diligence measures with respect to PEPs, only regarding to PEPs who reside in another Member State or in a third country (i.e. foreign PEP).

3.3. Fourth AMLD enlarges PEPs regime…

Taking account of the FATF recommendation adopted in 2012 and following the aim of enhancing due diligence, the fourth AMLD extends the requirements provided for foreign politically exposed persons to domestic PEPs and PEPs of international organizations. The difference between different type of PEP depends on who has entrusted the individual with the prominent public function, i.e. the country in question or another country or an international organisation.

In particular, in cases of a higher risk business relationship with a customer or beneficial owner who is a domestic PEP or a person who is or has been entrusted with a prominent function by an international organisation, financial institutions should be required to apply the same measures as those that are applied to foreign PEPs. It should be also noted that a domestic PEP is subject to the foreign PEPs requirements if that individual is also a foreign PEP through another prominent public function in another country. In brief, the fourth AML Directive does not make such a distinction, and automatic enhanced due diligence measures will be required in the case of any PEP, regardless of where they originate from.

4.      Coverage of the gambling sector

Casinos and gambling services are often a target for money launderers, attracted by their nature of “cash intensive business”, where the majority of transactions are cash based. Therefore, another essential topic discussed concerns whether the scope of the Directive will cover all gambling operators (even those viewed as low risk) or only casinos and online gambling operators.

With a view to facing new emerging threats, it was felt the need to extend the scope of the third AMLD, in which only casinos were required to apply Customer Due Diligence (CDD). The new directive indeed brings into the scope all providers of gambling services when dealing with transactions of at least €2,000.

Nevertheless, in the final compromise a proportionate risk-based approach was introduced. If, after conducting a risk assessment, EU Member States find that there is a “proven low risk” of money laundering and terrorist financing, because of “the nature and, where appropriate, the scale of operations of such services”, they are able to exempt certain gambling operators – although not casinos – from some or all requirements, in strictly limited and justified conditions.

5.      A new Regulation on the traceability of fund transfers

In parallel with the revision of the money laundering Directive, a Regulation on the transfer of funds was also approved. The two legislative measures pursue the common objective of revising the existing anti-money laundering and counter terrorist financing EU framework in order to improve its effectiveness while ensuring its compliance with international standards. In particular, the new Regulation is based on Recommendation 16 on wire transfers adopted by the Financial Action Task Force.

Besides, the choice of a Regulation aims to ensure that this international standard is transposed uniformly throughout the Union and, in particular, that there is no discrimination between situations involving national payments within a Member State and cross-border payments between Member States.

5.2 What is it about?

The Regulation is about tracking transfers of funds, in any currency, sent or received by a Payment Service Provider (PSP) established in the Union. The tracking is implemented by placing certain requirements on the information that accompanies transfers and applies to all the PSPs involved in the payment chain. The basic logic behind is: the higher the amount and the higher the risk of irregularity, the more checks and controls we should have in place. Indeed, collecting basic information on the transfers may help appropriate law enforcement and/or prosecutorial authorities in detecting, investigating, prosecuting terrorists or other criminals and tracing the assets of terrorists. For this reason, it is essential ensuring that transfers of funds contain complete, accurate and meaningful information on the payer.

5.3. What changed from the previous legislation?

The Regulation which was repealed (i.e. Regulation EC 1781/2006) already required Payment Service Providers to accompany transfers of funds with information on the payer. New rules also require information on the payee (the person who receives the payment) to be included. More precisely, the payer’s PSP must: a) ensure transfers of funds are accompanied by information about the payer (as name, payment account number etc.); b) verify the information on the payer, using “documents, data or information obtained from a reliable and independent source”; c) ensure that transfers of funds are also accompanied by the name of the payee and the payee’s account number.

For its part, the payee’s PSP must be able to detect a lack of presence of information on the payer when receiving transfers and take appropriate steps in order to correct this situation: in this way, transfers of funds received by the payee do not remain anonymous. In addition, the Regulation requires verification of information on the payee (such as his name and his payment account number) when transfers of funds exceed €1000, before the PSP credits the payee’s account or makes the funds available to the payee. Verification of this information is not required in other cases, unless the payee’s PSP has reasonable grounds for suspecting money laundering or terrorist financing.

5.4. Not only recording information but also…

While verifying and recording information, the PSP must exert a special vigilance regarding such transfers and, on a risk sensitive basis and taking into account other pertinent factors, report suspicious transactions to the authorities responsible for combating money laundering and terrorist financing. PSPs should also respond fully and rapidly to enquiries by such authorities.

6.      Cooperation between Financial Intelligence Units (FIUs)

6.1. What are FIUs?

In the early phases of the development of the AML regime it became obvious that skilled personnel were needed to understand trends in money laundering and to make sense of the huge amounts of information being produced by financial institutions under reporting obligations. In response to this need, and to the need for a centre of analysis and dissemination of financial intelligence, FATF Recommendation 26 called for the establishment of entities commonly referred to as “financial intelligence units” or “FIUs”.

Adjusting the EU legal framework to the international standards, the Third AMLD required each Member State to establish specialized governmental agencies to deal with the problem of money laundering and other financial crimes. A FIU, quite simply, is a central, national body responsible for receiving (and as permitted, requesting) financial information, concerning suspected proceeds of crime and potential financing of terrorism, or other information required by national legislation or regulation. A FIU is then responsible for  processing that information in some way and disclosing it to an appropriate government authority in support of a national anti-money laundering effort.

6.2. Strengthening of their role with the fourth AMLD

The Fourth AMLD aims to strengthen the role of FIUs and their cooperation in respect of exchanging information. In particular, the Regulation requires the FIU to be operationally independent and autonomous. In other words, the FIU must have the authority and capacity to carry out its functions freely, including the autonomous decision to analyse, request and disseminate specific information. Also the FIU must be provided with adequate financial, human and technical resources in order to fulfil its tasks.

Moreover, Member States must ensure that the FIU is empowered to take urgent action, either directly or indirectly, when there is a suspicion that a transaction is related to money laundering or terrorist financing, to suspend or withhold consent to a transaction going ahead in order to analyse the transaction, confirm the suspicion and disseminate the results of the analysis to competent authorities.

Nevertheless, it is not made clear, as it wasn’t either in the third AMLD, the manner in which the FIUs can achieve their goals. The text does not clarify their nature which brings to the fact that the organisational nature of FIUs differs across Member States: they can be administrative, judicial, or police structures. The problem then is that having different powers can cause difficulties in exchanging information, including the possibility to access information, with consequences for the effectiveness of cooperation.

7.      Strengthening Data Protection

The last but not least issue discussed during negotiations concerns data protection rules – especially the need to enhance effectiveness of AML prevention while ensuring a high level of protection of personal data. Both public and private stakeholders have pointed to a number of difficulties regarding the compliance of the AML requirements with a high level of protection of personal data. Indeed, under the AML legislation, the requirements to collect and process data (e.g. to monitor transactions and customer relations against sanctions lists, to identify beneficial owners, to maintain records for criminal investigation purposes, etc.) increase the amount of data being collected, along with the possible consequences for data subject.

In the previous AML legislation, there was a lack of clarity about how these requirements were to be reconciled with rules on data protection, in particular at national level, which was leading to incoherent approaches across Member States. So during negotiations for the Fourth AMLD, the European Parliament voted for a significant number of amendments to enhance the protection of privacy. The key points are:

1.      How long can you hold Customer Due Diligence (CDD) data for: the time limit for holding data is five years and after that period you must delete the data. However, you may be able to retain data for a further five years: this possibility depends on Member State legislation and justified on a case-by-case basis (Article 40 of the AMLD).

2.      Informing clients about how the data may be used: the new clients have to be informed of the possible use of their personal data for money laundering prevention purposes before establishing a business relationship.

3.      Only using data for the purpose for which it was obtained: you should only use data for the original purpose and not for any other purpose, without consent.

4.      It has been made clear that data can’t be used for commercial purposes.

A positive feeling on the respect of data comes also from the co-rapporteur Judith Sargentini who said “we cleaned up the data protection […]. So we made sure that the data subject, the person who wants to know something – perhaps they have a feeling that something went wrong with their data – has rights to redress, without tipping off criminals, but they have the right to redress. We respect data retention rules.”.

Besides, Věra Jourová – as member of the Commission and responsible for the data protection reform, going to replace 28 national regimes by one strong pan-European regime for protection of personal data – added: “speaking about data protection in relation to the Anti-Money Laundering Directive and related things in the new legislation, I can say that we pay very high attention to protecting fundamental rights and especially the right to privacy and the right to the protection of personal data. These two pieces of legislation are very compatible and they can work together very well when they are introduced in practice.”.

8.      The impact on legal professions…

Certainly lawyers are involved in many activities which are vulnerable to money laundering, such as: a) use of client accounts; b) purchase of real estate; c) creation and management of trusts and companies. In fact, the implications of this new legal framework for legal professionals are much better than the third AML Directive. Indeed, there has been a fight between law firms (and the legal professions in general) and the Commission for years on these issues, and now most of the provisions of the new Directive come from what the European Court of Justice (as well as the European Court of Human Rights) has said.

The most important judgment is Case C-305/05, OBFG v Council. In this case, the Belgian Bar Association alleged that the extension, foreseen in the third AMLD, to lawyers of the obligations to inform the competent authorities when they come across facts which they know or suspect to be linked to money laundering and to transmit to those authorities additional information which those authorities consider useful, unjustifiably impinges on professional secrecy and the independence of lawyers, principles which are a constituent element of the fundamental right of every individual to a fair trial and to the respect of his rights of defence. So, at the request of the Belgian Cour d’Arbitrage, the Court of Justice was asked to clarify whether the imposition of those obligations on lawyers infringed the right to a fair trial.

The Court’s ruling, incorporated in the 4^th AMLD, stated that the obligations of information and cooperation apply to lawyers only in so far as they advise their client in the preparation or execution of certain transactions essentially of a financial nature or concerning real estate, or when they act for and on behalf of their client in any financial or real estate transaction. As a rule, those activities, by their very nature, take place in a context which has no link to judicial proceedings, and consequently, fall outside the scope of the right to a fair trial.

In any other case, the legal advice is subject to professional secrecy. So, as soon as a lawyer is called upon for assistance in defending a client or in representing that client before the courts, or for advice as to the manner of instituting or avoiding judicial proceedings, that lawyer is exempt from the obligations of information and cooperation, regardless of whether the information has been received or obtained before, during or after the proceedings. An exemption of that kind safeguards the right of the client to a fair trial.

9.      Next priorities…?

As for the next political priorities, certainly it is quite essential to ensure transposition: the AMLD must be implemented as soon as possible. The European Commission, in order to ensure an effective and consistent application of the Directive, will assist Member  States in the transposition of the Directive by organizing workshops and clarifying the interpretation of certain provisions.

It is also worthy to mention the new European Agenda on Security 2015-2020, adopted by the European Commission to support better cooperation between Member States in the fight against terrorism, organised crime and cybercrime. In the Agenda, indeed, there is an AML and a counter-terrorism dimension, so that it may be possible to have some further measures on financing. The Agenda mentions specifically preventative measures regarding freezing assets of EU internal terrorists (Article 75 of the treaty), but also expects some further initiatives at the international level, especially the mandate of FAFT to carry out a revision of initiatives existing in terrorist financing to see the effective application of these existing rules and to come up with potential new initiatives in terrorism financing. FATF may present a report in October this year.

*Reblogged from the FREE Group blog

Photo credit: www.gfintegrity.org