One year after the EU's top court ended public access to beneficial ownership registers, Transparency International says the bloc still lacks a common fix. The Court of Justice of the European Union ruled on 22 November 2022, in Case C-37/20 (WM and Sovim SA), that public access to those registers violated privacy rights. Now the anti-corruption group says the need for a harmonised approach across member states is clear.

What did the court actually decide?

The case concerned the EU's anti-money laundering framework. That framework required companies to disclose their beneficial owners — the natural persons who ultimately own or control a company — to national registers. Earlier rules had made those registers open to the public.

The CJEU disagreed. It held that general public access constituted a serious interference with the fundamental rights to privacy and data protection under the EU Charter. Access, the court said, must be limited to persons with a legitimate interest, such as journalists and civil society groups in specific circumstances.

Why does one ruling matter so much?

Think of the registers as a company's X-ray machine. Before the judgment, anyone could look through it. After the judgment, most member states switched the machine off for the general public overnight.

The practical consequence is uneven. Some member states kept broad access routes for journalists and civil society. Others tightened the tap hard. Practitioners now face a patchwork: a due diligence check that works in one country may hit a wall in the next. Compliance teams, investigative reporters and NGOs all work with different levels of visibility depending on where a company is registered.

What has changed in the year since?

Not much, according to Transparency International's assessment marking the anniversary. The core problem is structural. The judgment struck down the public-access element but left the rest of the framework standing. Member states interpreted the resulting gap differently, and the EU has not yet filled it with uniform rules on who counts as a legitimately interested party.

The group's core message is blunt: one year on, the need for a harmonised approach is clear. Without it, the same data point — who really owns a shell company in Riga or Nicosia — remains easy to find in one jurisdiction and near-impossible in another.

What does this mean for lawyers?

For practitioners, three practical takeaways:

• Know-your-customer checks (the legal obligation to verify a client's real owners) now often require a formal request to the register, not a simple lookup.
• Cross-border work demands jurisdiction-specific advice on access rules, because member states diverge.
• Litigation risk sits with data protection authorities on one side and transparency mandates on the other, and the CJEU ruling gives cover to restrictive readings.

What happens next?

The pressure now sits with EU legislators. Any fix must balance two competing legal goods: the privacy rights the court protected, and the anti-money laundering transparency the registers were built to deliver. A harmonised definition of legitimate interest would restore a measure of predictability.

Until then, the registers stay half-open. One court, one case, twenty-seven different answers. That is the state of play Transparency International wants to end.