New ECJ Rulings on the Money Laundering Directive

Very recently, the ECJ has dealt with the EU Money Laundering Directive in two high-profile cases.

On the one hand, it declared public access to registers of beneficial owners inadmissible. The ECJ justified this by stating that the underlying provision from the Money Laundering Directive (AMLD4, as amended with AMLD5, in the following AMLD) violates the fundamental right to privacy and data protection (C-37/20 and C-601/20).

On the other hand, the ECJ has dealt with the application of (enhanced) due diligence requirements (EDD), including statements on the much-discussed "KYCC" issue (C-562/20).

We have summarized both decisions for you in the following article.

First decision: ECJ declares public access to registers on beneficial owners inadmissible

Previous legal situation under AMLD and "WiEReG"

Under Art 30(5)(c) AMLD4, Member States had to ensure that beneficial ownership information was accessible to all persons and entities that could demonstrate a "legitimate interest". AMLD5 extended the access to beneficial ownership information to "all members of the public." A legitimate interest no longer had to be shown under this provision. By providing public and transparent access to beneficial ownership information, the EU legislators intended to contribute to a more effective prevention of money laundering and terrorist financing in the financial sector.

In Austria, the aforementioned provision was implemented in Section 10 WiEReG. Accordingly, "anyone" may request an extract from the register without having to demonstrate a legitimate interest. Section 10a WiEReG provides for certain restrictions at the request of the beneficial owner. For this purpose, however, the beneficial owner must prove that, taking into account all circumstances of the individual case, the inspection is opposed by overriding interests of the beneficial owner that are worthy of protection.

ECJ ruling: Partial invalidity of the GWRL

In its judgment of November 22, 2022, the ECJ ruled in joined cases C-37/20 and C-601/20 that the extensive access to the register for all members of the public introduced by the 5th GWRL is invalid. The background was two lawsuits filed by beneficial owners against the Luxembourg registry authority. In these lawsuits, the beneficial owners requested a restriction of access to the register data under Luxembourg national law. Due to concerns raised about the compatibility with fundamental rights, the Luxembourg District Court referred the question of the validity of the opening of the transparency register to the ECJ for a preliminary ruling.

The ECJ pronounced that the extensive public access to information on beneficial owners constitutes a serious interference with the fundamental rights enshrined in Article 7 (respect for private and family life) and Article 8 (protection of personal data) of the Charter. The ECJ essentially reasoned as follows:

The interference with the aforementioned fundamental rights is not limited to what is absolutely necessary and is not proportionate to the objective pursued of combating money laundering and terrorist financing.

The extended right of inspection created by the 5th AML Directive is not outweighed by advantages in combating money laundering and terrorist financing when compared to the less intrusive regulation under the 4th AML Directive.

The optional measures to provide for restrictions through national law (such as online registration prior to inspection of the UBO register or limiting public access in exceptional cases) are not sufficient to adequately limit the risk of abuse.

The argument put forward by the Commission that the criterion of a "legitimate interest" (as still provided for in the 4th ARC) is difficult to define was not seen by the ECJ as a reason to justify unrestricted public access.

Outlook on the impact of the decision

The national registry authorities reacted promptly to the ECJ decision. For example, Austria stopped general public access to the register on beneficial owners already one day after publication. Luxembourg and the Netherlands even blocked all access to the register on beneficial owners. The German registry authority issued a press release confirming that no more general public requests will be approved. Conversely, register extracts can still be obtained, provided the requests are based on legitimate interests. It is expected that similar measures will follow in other EU member states.

Furthermore, the ruling is also expected to result in changes to the draft of the current EU AML package, which is to replace the ARC in the future. The drafts currently provide for a public access to the registers comparable to the 5th AML Directive, whereby no legitimate interest has to be demonstrated.

Finally, we would like to point out that legal entities still have access to the Austrian register. Obligated parties can access it via the company service portal and the mandatory notification of beneficial owners also remains in place.

Second decision: On the scope of (enhanced) due diligence obligations.

In Case C-562/20 of November 17, 2022, the ECJ addressed different questions of interpretation regarding (enhanced) due diligence obligations under the AML Directive. The case was prompted by a money laundering audit at a tax consulting and auditing company based in Latvia. According to the Latvian AML Law, this company is obliged to comply with due diligence requirements regarding the prevention of money laundering and terrorist financing. In the course of the audit, the supervisory authority found that the company had failed to adequately comply with its due diligence obligations with respect to two clients and imposed a fine. The Latvian company filed an action for annulment of the penalty, which was the basis for the present reference for a preliminary ruling. The ECJ then addressed four fundamental questions about the scope of (enhanced) due diligence obligations.

The ECJ made the following key statements in its judgment:

• First, the ECJ stated that Article 18 (1) and (3) of the 4th ARC (application of enhanced due diligence based on risk analysis) do not require an obliged entity to automatically classify a customer in the high risk category and apply enhanced due diligence solely because the customer is an NGO, one of the customer's employees is a national of a third country with a high risk of corruption (Russia), or one of the customer's business partners is affiliated with such a third country. Rather, since the AML Directive only provides for minimum harmonization, Member States may specify in national law such circumstances as factors indicating a potentially higher risk of money laundering or terrorist financing. Obligated persons must then take these factors into account in their risk assessment with respect to their customers. However, the factors must be compatible with Union law, in particular with the principles of proportionality and non-discrimination.
• The next point concerns the interpretation of Art 13 (1) lit c and d of the 4th GWRL. This refers to the assessment and collection of information on the purpose and nature of the business relationship, including continuous monitoring of the transactions carried out and their documentation. The supervisory authority found that a client of the obligated party had conducted financial transactions with a company majority-owned by a Russian company. The obligor stated that it had verified its client's transaction and the underlying contracts by inspecting them at the client's premises. However, this was too little for the supervisory authority, which considered that the obligated party should have submitted a contract to plausibilize the transaction. The ECJ rejected this view and stated that the ARC does not require obliged entities to obtain from the customer a copy of the contract concluded between the latter and a third party. It is sufficient if the obliged party can provide other appropriate documentation demonstrating that it has analyzed the transaction executed between the customer and the third party and the business relationship, and has taken due account of the identified risks when applying due diligence. Accordingly, the ECJ considered the submission of the report documenting the inspection of the contract as adequate.
• These statements are very exciting and practically relevant for the Austrian market. In our opinion, they clearly indicate that the ECJ does not require a KYCC ("Know Your Customer's Customer") check even for risky transactions, as the FMA seems to have in mind according to its current due diligence circular. The ECJ does not require that information or documentation be obtained on the client's material business partners and other relevant parties to the client's contract. Similarly, it does not require an audit of the funds used with the customer's client. Rather, the ECJ requires a transaction review for particularly high-risk transactions that customers engage in with their counterparties. These include complex and unusually large transactions or those that have no obvious economic or legitimate purpose. In our opinion, the KYCC requirements postulated by the FMA recently cannot be derived from the ECJ ruling, but point in the opposite direction.
• Furthermore, the ECJ stated that obliged entities may have to apply enhanced due diligence requirements to existing clients on the basis of an up-to-date risk assessment if this appears appropriate. This is particularly the case if the customer's circumstances change. Enhanced due diligence must then be applied regardless of whether or not the deadline set in national law for conducting a new risk assessment has expired. Obligated parties must therefore take ongoing measures to ensure that they are aware of any change in customer risk. Adequate monitoring must therefore be able to detect any risk deviations even outside of the touring update intervals.

Finally, with regard to the publication of sanctions (so-called "naming and shaming"), the ECJ has pronounced that national authorities must ensure that the published information is consistent with the information contained in the decision. Consequently, information that is not consistent with the information contained in the decision is excluded from publication.

How can we help you?

We will monitor upcoming developments as a result of the ECJ rulings and inform you about them on our website. With our extensive expertise in the prevention of money laundering and terrorist financing, we can provide you with competent support on all legal issues in this topic area. We look forward to receiving your inquiry.