UBO register access in Europe: a country-by-country reality check

Every EU member state was supposed to have a functioning, accessible beneficial ownership register by now. It is 2026 and most of them do not. Some registers are public. Some are restricted to local parties with local credentials. Some were suspended three years ago and never came back. One charges €500, notifies the target company you asked, and requires you to show up in person to take notes by hand.

If you run KYB checks across borders, the question is not whether a register exists. It almost certainly does. The question is whether you can get data out of it, what that data contains, how current it is, how long retrieval takes, and whether what you receive has been verified by anyone other than the person who filed it.

We mapped access conditions across 40+ European and adjacent jurisdictions.

Two directives, one court ruling

AMLD4 (2015) required member states to create central UBO registers. AMLD5 (2018) mandated public access: anyone could query them without justification. Compliance teams queried registers directly, journalists ran cross-border ownership investigations, data providers built products on top of open data.

On November 22, 2022, the Court of Justice of the European Union ruled in joined cases C-37/20 and C-601/20 that unrestricted public access to UBO data constituted a disproportionate interference with the rights to private life and data protection under the EU Charter. The case came from Luxembourg, and the ruling invalidated AMLD5's transparency provision across the entire EU.

Luxembourg shut its RBE the same afternoon. Belgium suspended access the next day. Ireland locked its RBO. Three years later, several are still dark.

6AMLD (Directive 2024/1640), adopted May 31, 2024, replaces the invalidated model with a legitimate-interest framework. Authorities get unrestricted access, obliged entities get access for due diligence, and everyone else must demonstrate a connection to anti-money laundering. Two deadlines: Article 74 (access rules) had to be transposed by July 10, 2025; Articles 11–15 (register verification and data quality) by July 10, 2026.

Most member states have missed or are struggling with both. In late 2025, the Commission opened infringement proceedings against 11 member states for failing to notify their transposition of the access rules: Belgium, Croatia, Cyprus, Denmark, Estonia, Germany, Greece, Italy, Poland, Slovakia, and Sweden. Eleven out of twenty-seven, and those are just the ones who got caught on the first deadline.

Six access tiers

We classify UBO register access into six tiers based on whether a foreign, EU-based obliged entity can retrieve data today. The legal label matters less than whether the login screen lets you in.

The short version is in the table. The long version follows.

Tier 1: Open registers

No authentication, no legitimate-interest proof, no fee.

Estonia kept its register fully public after the CJEU ruling. The argument: e-governance transparency is a democratic baseline, corporate ownership disclosure included. Anyone can query the e-Business Register and pull UBO data instantly, via web portal or SOAP API. Name, date of birth, nationality, residence, control type, ownership percentage. Free and public. This will probably end by July 2026 under infringement pressure. One of the last open registers in the EU, closing because the EU told it to.

Poland's CRBR (Centralny Rejestr Beneficjentów Rzeczywistych): public, free, instant. Draft legislation may change this. Nothing has changed operationally yet.

Iceland shows UBO data in the "Raunverulegir eigendur" section of every company page on the Skatturinn register (mandated by Act 82/2019). Not EU, not bound by the CJEU ruling, hasn't restricted access.

Latvia's Enterprise Register: free, instant, includes downloadable UBO statements. Caveat: much of the data has not been updated since mid-2024. Amendments to Section 18.3 of the Latvian AML Law (effective July 1, 2026) will let individual UBOs request access restrictions if disclosure threatens their safety.

The UK's PSC Register: fully public, free, REST API, bulk downloads. After the CJEU ruling the UK government concluded the public register complied with the ECHR. Open, yes. Reliable, less clear. Open Ownership found ~20% of PSC entries list no individual beneficial owner, another ~20% show combined ownership above 100%. ECCTA 2023 is rolling out mandatory identity verification for filers. This should help, someday.

North Macedonia's Central Register: free, instant, UBO name and ownership extent. Gibraltar's e-Government UBO search: free since February 2026 (previously £2.50), instant.

Tier 2: Legitimate interest, low friction

6AMLD model implemented, digital infrastructure that foreign obliged entities can use. With effort.

France restored access to the RBE on July 31, 2024, under the Loi DDADUE (Law No. 2024-364). Create an INPI account and submit AML-status documentation. Access is free. The problem is the SIREN: the portal requires a French corporate identifier to complete the application. Foreign fintechs need a local presence or a workaround. Transparency International called this discriminatory, and yes, a cross-border mandate that requires a local registration number kind of defeats itself. Once approved, data comes via the DATA INPI API: name, month/year of birth, nationality, country of residence, ownership percentage. Exact date of birth and address are restricted to entities with INPI credentials carrying ROLE_RBE_BENEFICIAL_OWNERS.

Denmark shifted to legitimate-interest on September 1, 2025. The Register over Reelle Ejere is part of the CVR (PDF, web, and JSON API), free and instant for authenticated users. Authentication requires MitID, which foreigners cannot get. So you email the DBA (erst@erst.dk) and wait three weeks.

Tier 3: Legitimate interest, high friction

Framework exists. Process is manual, slow, expensive, or just out of reach for non-domestic parties.

Sweden's Registret över verkliga huvudmän at Bolagsverket. Swedish BankID for online access, manual email request for foreigners (days, not seconds). No UBO API. PDFs at SEK 120 that you parse yourself. One thing to know: the Swedish register reports "Omfattning" (control extent), not ownership percentage. Multiple UBOs can each show 100%. The field measures control paths, not economic stake.

Finland's PRH extract: data-use contract, €200 upfront, €0.90/extract, 2–3 days, no API, one company at a time. Only covers private limited companies (Oy). If the entity is an Oyj, association, foundation, or sole entrepreneur, the PRH does not have UBO data for it.

Germany's Transparenzregister. Register, explain the legal need, apply online (in German), wait. Official guidance says "several weeks." We applied through a partner. That was over a year ago. Still pending. The data exists, the register is real; the bottleneck is purely procedural. Fines for entities that fail to file: €100,000 (simple) to €5M / 10% of turnover (systematic).

Luxembourg. Access suspended the afternoon of the CJEU ruling (fair enough, the case came from there). The RBE was partly restored for Article 2 professionals via Circular LBR 22/01. Everyone else: case-by-case, manual, one at a time, €5/request. The January 2025 reform finally gave the LBR teeth: €40/day penalties capped at €3,600, late-filing fees from €50 to €500. Only took three years.

Austria's WiEReG has the best-designed portal in this tier. Legitimate-interest access restored September 1, 2023. €4–€10/extract, mostly automated, foreign entities apply by email (wiereg-registerbehoerde@bmf.gv.at), and rejections must be formalised as administrative decisions, so you can appeal. The system flags discrepancies between declared UBO data and commercial register calculations (a "Completeness Status" indicator). The FATF Mutual Evaluation (February 2026) praised the system but flagged Treuhand opacity.

Slovenia's register: legitimate-interest application with supporting documents, free, manual.

Norway (Brønnøysundregistrene). Register is live (filings mandatory from July 2025) and connected to BORIS, but API-only, no web portal, restricted to authorities and OEs. The business registry's public API does not expose UBO data. So the register exists, the data is in there, and you just can't get to it.

Tier 4: Locked behind national credentials

What does "accessible" mean if the login requires credentials you can't obtain?

Ireland. Locked since the CJEU ruling. The RBO now has two paths: "Designated Persons" (Irish AML-obliged entities, BOR 4 Form) and legitimate-interest applicants (BOR 5 Form, extensive justification). In practice, TI found that Ireland refused civil society requests outright, requiring proof that the target company was connected to convicted money-laundering individuals. You need evidence of the crime to access the tool that helps you find the crime.

Belgium suspended public access the day after the CJEU ruling. The UBO register reopened under a three-condition legitimate-interest test (Royal Decree of February 17, 2023), but only obliged entities with a legal presence in Belgium can consult UBO data. Foreign entities without a Belgian office do not qualify. Belgium built ForReg to address the authentication gap, but ForReg was designed for foreign directors to file UBO declarations for their own Belgian companies, not for third-party due-diligence lookups. Even with ForReg credentials, access requires a separate FPS Finance whitelist registration, document submission, and a video call. No API access exists. TI tested the process and classified Belgium's register as "closed," noting that the official instructions did not match what the registry actually required. Belgium was among the 11 member states facing infringement proceedings for failing to transpose 6AMLD access rules by the July 2025 deadline.

Portugal's RCBE: Cartão de Cidadão required. LIA decree (October 2025) published but not deployed. Croatia's FINA register: NIAS credentials. Lithuania's JADIS/JANGIS: Lithuanian ID card or mobile signature (bulk: €0.03/query for those who clear the barrier). Spain's Registro de Titulares Reales: DNI/NIE, Spanish only.

Czechia's ISSM portal closed in December 2025, reverting to a court-application model. Romania's ONRC: electronic signature, fee, API resale restricted. Bulgaria's Registry Agency shows basic UBO data publicly but locks detail behind local auth. Malta's MBR: open to EU citizens, API applications (€450/year) pending validation.

Tier 5: Suspended or authorities-only

Register exists, nobody outside government can actually use it.

The Netherlands shut its UBO register the day of the ruling. As of April 1, 2026, access expanded: Wwft/Wtt institutions can now order certified UBO extracts via the KVK website and the KVK API (using e-Herkenning authentication), not just through the KVK Dataservice subscription. The register is reopening, but it's still just institution-by-institution via sector organisations, not a general search tool. The July 2025 Draft Implementation Act will repeal the national Wwft entirely when the AMLR takes effect in 2027.

Italy. Register frozen. LIA decree issued January 2026, followed by a preliminary decree on March 10, 2026 introducing Articles 21-bis through 21-septies (defined access categories, accreditation procedures, UBO protection mechanisms). The legal framework is taking shape, but no access exists yet; the register remains suspended pending a CJEU ruling on trust-related access that will set precedent for all member states. Slovakia's RBO: suspended on July 10, 2025 (exactly the 6AMLD Art. 74 deadline). The public-sector RPVS remains open but covers only a subset. Hungary's NAV: requires demonstration of family, legal, or ownership ties to the target entity. Four months processing. To check who owns a company, you need to already know who owns the company. Cyprus and Greece: authorities and local OEs only, national authentication, local language.

The Crown Dependencies (Guernsey, Jersey, Isle of Man): non-public, local law enforcement and local OEs only. All three ran LIA consultations in 2025–2026 (Guernsey closed April 10, 2026; Jersey January 30, 2026). Still nothing operational.

Liechtenstein. Register exists since April 2021 (VwbP), but only the AJU and competent authorities query it directly. Banks apply per-entity. The AJU warns that extracts carry no "public reliance" (they don't verify the data; you do).

Also restricted: Andorra, San Marino, Montenegro, Bosnia-Herzegovina, Turkey (MASAK only), Belarus.

Tier 6: No centralised register

Switzerland. No register. The LETA (adopted September 2025) will create one, restricted to domestic authorities and Swiss banks. No public or LIA access. Expected autumn 2026 via EasyGov, with over 500,000 companies required to file. Non-filing penalty: CHF 500,000.

Monaco. The register exists on paper. €500 per consultation. Two-month notification period (the target entity and UBO are told you asked). On-site viewing only, under civil-servant supervision. No documents; you take notes by hand. More a deterrent than a compliance tool.

Ukraine. USR register technically public, intermittently down. Kosovo and Moldova: under construction.

Data quality

Now you're through the door. The data has problems.

Every country uses a 25% ownership threshold. Four entities at 24% each? Invisible. Below the line by design. When no natural person crosses the threshold, most jurisdictions register senior management as default UBOs. Estonia, Latvia, Lithuania, and Finland all allow this: the CEO gets listed regardless of whether they hold any economic interest. Legally compliant, yet informationally useless.

Self-declaration without verification is still the norm. The UK's PSC register ran on an honours system until the ECCTA reforms. Sweden's BankID verifies who filed but not whether what they filed is true. Germany's Transparenzregister assumed data was accurate because it existed in the commercial register (a "reporting fiction"); the TraFinG transition to active verification created a backlog of unverified entries that is still being worked through. Austria's FATF evaluation flagged Treuhand structures and bearer shares.

Cross-border verification barely exists. Denmark's CPR validates domestic citizens but has no mechanism for foreign addresses or IDs, so foreign UBOs are unverified self-declarations. France redacts personal fields per RGPD unless you hold specific INPI credentials. Norway's UBO register and business registry are separate systems with separate access.

The 6AMLD mandate for register operators to verify data adequacy (Art. 10) is barely operational. Who's checking? Luxembourg's January 2025 reform was the first to give a register real policing powers. Most others just haven't built the infrastructure yet.

What this means for KYB

No single access strategy covers Europe. Onboarding a corporate group with subsidiaries in France, Germany, the Netherlands, and Estonia means four access regimes, four authentication systems, processing times from instant to over a year, and fields that don't match across borders.

Declared UBO data (the registry filing) is what auditors expect. It carries legal weight. But structured, queryable declared data only exists in about a third of the jurisdictions we mapped. The rest: closed, suspended, restricted, or unreachable.

Derived UBO fills the rest. Trace the shareholder chain across company registries (which have lower access barriers than UBO registers), compute ownership algorithmically: entity resolution, percentage multiplication along chains, cycle detection for circular structures. You get an ownership picture that does not depend on whether any particular register lets you in.

We wrote about this in Declared UBO vs. Derived UBO: where both exist, cross-checking catches discrepancies before they become audit findings. Where the register is closed, derived UBO is the only path. Where the register is open, the UK's PSC quality problems show why you still want a second source.

The AMLR (2027) will harmonize some rules. Access portals, authentication, and processing stay national, though. Belgium built ForReg. Denmark uses MitID. France requires a SIREN. There's no real overlap. Some standardisation is coming: from November 10, 2026, Art. 13 requires registers to respond within 12 working days, and entities with approved LIA status get a 3-year certificate with a 7-day response guarantee. Art. 14 mandates mutual recognition of LIA access across member states (a "UBO Blue Card," in effect) and standardised request templates. Whether this actually materialises on schedule, the track record on deadlines would suggest caution.

BORIS connects national registers for cross-border queries (Denmark, Estonia, Latvia, Norway, Iceland, Austria, Luxembourg, Belgium, France, Liechtenstein participate). It helps, though it still requires access through your own national system first. If your country's register is gated, BORIS has the same problem.

Jurisdictions outside the EU matter too. CSDDD Art. 2 covers non-EU companies above €450M EU revenue. AMLR covers non-EU OEs with EU operations. Ownership chains pass through Switzerland, the Crown Dependencies, offshore centres regularly. A Maltese holding with a Guernsey trust layer and a Swiss parent company; we see this in real onboarding queues.

How Topograph handles this

We adapt to each jurisdiction. Open registers with structured data, we query directly: Estonia via the RIK SOAP API, Denmark via CVR "Reel ejer" relations, Latvia from the Enterprise Register, Iceland from the Skatturinn registry, UK from the Companies House PSC API.

Registers that sell documents, we buy and parse. Sweden: UBO extract PDF from Bolagsverket, AI-extracted. Finland: PRH contract client.

LIA-gated registers, we hold formal access agreements. France: DATA INPI API (customers with their own ROLE_RBE_BENEFICIAL_OWNERS credentials unlock un-redacted fields, cached for their account only). Belgium: UBO Register via a local partner with mandate-based access. Germany: application in progress. We've been saying that for a while now.

Closed registers (Austria, Netherlands, Luxembourg, Italy, most of Tier 4): we derive UBO from shareholder chains in company registers. The ownership graph is tagged, sourced, and traceable.

Every UBO in our API carries a source tag: declared at register, or derived from the ownership graph. If your current provider doesn't show you which one you're looking at, ask.

Per-country details (data fields, document types, pricing, API examples) are in the country guides.

FAQ

What is a UBO register?

Every EU member state maintains (or is supposed to maintain) a central database of the natural persons who ultimately own or control each legal entity. Mandatory since AMLD4 (2015). Fields typically include name, date of birth, nationality, and nature or extent of ownership. Quality and access vary wildly by jurisdiction (see the table above).

Can I access UBO registers in Europe?

Depends on the country and who you are. Since the CJEU ruling (November 2022), most EU states suspended public access. Under 6AMLD, access is tiered: authorities get full access, AML-obliged entities get access for due diligence, everyone else needs to prove a legitimate interest. A few countries (Estonia, Poland, Iceland, Latvia, UK) still let anyone query freely.

Which EU countries still have public UBO registers?

As of April 2026: Estonia, Poland, and Latvia (all free, instant). Iceland and the UK too, though they're not EU members. North Macedonia and Gibraltar also provide public access. Most others have moved to legitimate-interest models or shut down entirely.

What is the 25% UBO threshold?

Every European jurisdiction draws the line at 25% or more of shares, voting rights, or equivalent control. Anyone above that must be declared as a UBO. Structures that deliberately spread ownership below 25% (four entities at 24% each, for instance) don't trigger the register. When nobody crosses the threshold, the CEO gets listed as a default. This is intentional, but it means the register misses certain structures.

What is the difference between declared and derived UBO?

Declared: filed by the company with a government register. Carries legal weight, citable in a compliance file. Derived: computed by tracing the shareholder chain across company registries and multiplying percentages along the path. When a register is closed or unreliable, derived is often the only source. When both exist, the cross-check is where the value is. We wrote about this in detail in a separate post.

What is BORIS?

Stands for Beneficial Ownership Registers Interconnection System. Connects national UBO registers for cross-border queries. Denmark, Estonia, Latvia, Norway, Iceland, Austria, Luxembourg, Belgium, France, and Liechtenstein participate. Useful, though it still requires you to have access through your own national system first, so if your home register is gated, BORIS doesn't help.

What is the 6AMLD deadline for UBO registers?

Two deadlines, both missed by many. Article 74 (access rules): July 10, 2025, missed by 11 member states per the Commission's infringement proceedings. Articles 11–15 (data verification, register quality): July 10, 2026. From November 10, 2026, Art. 13 mandates a 12-working-day response time for LIA requests, with a 3-year certificate and 7-day response for approved entities. Art. 14 introduces mutual recognition of LIA access across member states.

How long does it take to get UBO data from a European register?

Instant in Estonia, Poland, Iceland, Latvia, and the UK. Days in Sweden and Finland. Weeks in Denmark (for foreigners), Belgium (requires local partner access), and Ireland. Over a year in Germany, that one's from our direct experience. Four months in Hungary. The range is absurd.

Why are some UBO registers still closed three years after the CJEU ruling?

Building a legitimate-interest access framework turns out to be really hard: tiered authentication, approval workflows, data minimisation rules, legal review of each applicant's justification. The Netherlands, Italy, and Slovakia suspended their registers in 2022 and haven't finished the rebuild. The July 2026 6AMLD deadline is supposed to force resolution. The November 2025 infringement proceedings suggest it probably won't happen on time.