In the recent months, the disclosure of the ultimate beneficial owner has been broadly discussed by AML specialists, the business, and the State Agency for National Security of Bulgaria (the latter is the watchdog of money laundering).
The disclosure of the beneficial owner has always been a hot topic ever since the latest amendments in the Bulgarian Measures Against Money Laundering Act (AML Act) which pushed for its announcement. Whichever company fails to declare publicly its beneficial owner in the Commercial register (CR) it can face a financial penalty from approx. 510 euro – 5100 euro. The penalty can be imposed on a continues basis for each month of delay until the beneficial owner is disclosed. The company’s management is also vulnerable for financial sanctions, but to a smaller amount. The purpose of this note, however, is to raise awareness to the privacy concerns regarding the information subject to public announcement for the beneficial owner. The beneficial owner is always a natural person; thus, the transparency goes to her personal data.
The disclosure of the beneficial owner in the CR includes disclosure of full personal data details
The beneficial owner shall reveal full name, date of birth, nationality, country of permanent residence, permanent address details – city, street number, floor, and apartment. All this information is revealed subject to the applicant's consent. If the applicant tries to save some of the additional data (e.g., apartment No.) the online application cannot be completed and signed.
The beneficial owner details will be freely accessible by anyone.
The CR is a publicly available register (here). Most of the information such as main company's details (name, management, capital, address), up-to-date statutes, beneficial owner's data is freely accessible by anyone, with no trace of who makes the check. The viewer of the beneficial owner's data does not need to log in with an electronic signature manifesting his capacity. A similar approach (of easy and open access) has been adopted in Poland, but it is fair to say that there is another different approach – the German one. The German register of beneficial owners "TransperanzRegister" not only requires a deliberate registration to consult the beneficial owner's details but determines the volume of information accessed according to the quality of the applicant – the access is separated based on the capacity of the person who searched for the information (e.g., a public authority; a lawyer who identifying his client for AML purposes, etc..) If it is a regular citizen who wants to examine the beneficial owner's detail, that person must demonstrate a legitimate interest in accordance with Chapter III of the Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing ("the Fourth EU AML Directive").
Was does the Fourth EU AML Directive say?
The Fourth EU AML Directive applies only minimum harmonization of supervisory competences and gives freedom to Member States to shape the transparency' approach. The requirement is to have "relevant, accurate and up-to-date information" for the beneficial owner announced in a public register. However, the latter does not equal provision of unrestricted access to any third parties of full personal details of the beneficial owner. GDPR's compliance must be considered.
Any person who can demonstrate a legal ground or a legitimate interest should have access to information on the nature and scale of the beneficial owner's rights held and their approximate share. And while Fourth EU AML Directive encourages a national law providing a "wider access", access to the permanent address of the beneficial owner and full details thereof can be a disproportionate measure going beyond the public interest.
Individual Member States differ in their approach to disclosing beneficial ownership information. In some countries such as the Czech Republic, Spain, the register is not public, whilst in Austria, Germany, Greece – the person proves a legitimate interest to source beneficial owner's personal data. Further, most European registers do not require the publication of the beneficial owner's "permanent address", disclosing only the place of residence, as the Fourth EU AML Directive provides for, is enough.
Will the full disclosure be changed in Bulgaria?
Bulgarian business continuously grows more and more personal data savvy. Official bodies are still behind though – the massive personal data leak from the NRA servers as of the summer of 2019 shows the lack of fundamental organizational capacity to protect the data and to react to leakages.
The publicity of the CR is of a great value. It reflects the modernization of our company's registration proceedings, makes the access easier, more efficient, and available 24/7. However, the Bulgarian authorities shall consider if the public interest can trump the privacy concerns of the publicized data.
It remains to be seen if the careful collection and publishing of limited types of data, combined with clearly defined exemptions for individuals, strikes the right balance between transparency, accountability, safety, and privacy. If so, will Bulgaria go this way.
