CJEU Shareholder Data Ruling (C-798/24): What It Means for KYB and UBO Verification

On 3 September 2026, the Court of Justice of the European Union ruled that Latvian law breached the GDPR by giving anyone access to the identities of shareholders in public limited liability companies. Seventeen minority shareholders brought the case, C-798/24, known as Jautiva. The Court held that unrestricted public access to their identities was a disproportionate interference with the rights to privacy and data protection under Articles 7 and 8 of the Charter of Fundamental Rights. 

Many firms use shareholder data to identify and corroborate UBOs, and that data may now be restricted. 

Key takeaways 

• The ruling covers shareholder identity in public limited liability companies (SA, AG, AS). It does not directly mention private limited companies.

• It extends the reasoning of the 2022 Sovim judgment, which struck down the public access provision to UBO registers.

• It binds a registry only where that registry publishes equivalent data, and it takes effect through national implementation.

• UBO access under 6AMLD and the AMLR is unchanged.

• The UK is not bound, but legal pressure on the Companies House model has begun.

What did the CJEU decide in C-798/24? 

Latvian law required public limited liability companies to disclose their shareholders to the commercial register, which published shareholder names without restriction. The Court found that open publication intruded too far into the private lives of the people named and was not compliant with the GDPR. 

The result surprised few. The Advocate General's opinion in December 2025 pointed the same way, as Kyckr reported at the time. 

However, the judgment does not alter any register's data. It simply obliges Latvia, and any Member State with a comparable regime, to bring its rules into line.

How does Jautiva compare with Sovim? 

In WM and Sovim SA v Luxembourg Business Registers (Joined Cases C-37/20 and C-601/20, 22 November 2022), the Court struck down the 5AMLD provision that gave the public access to beneficial ownership registers. Jautiva applies the same logic to a different dataset: the shareholder declarations of public limited liability companies.

What followed Sovim is a rough guide to what may follow now. Several registries went further than the judgment required, and some withdrew entire datasets. Public access to UBO registers across the EU has been fragmented ever since. In several Member States, it remains effectively suspended while national legitimate-interest regimes are built.

Which companies and countries are affected?

The ruling concerns public limited liability companies: the SA, AG and AS forms. It does not directly mention private limited companies (Ltd, SIA, GmbH, SARL, B.V. and equivalents). But the ruling may reach further, for two reasons. 

1. “Public limited” doesn’t mean it's listed.

A "public limited company" is a legal form, not evidence of whether the entity’s shares trade on a stock exchange. Many unlisted holding companies in continental Europe use it. As such, the ruling could affect companies in the middle of a cross-border ownership chain, as opposed to just listed ones.

2. Member states will decide how to interpret it

What the Court decided and what countries do about it are two different things. Each country's lawmakers, registries and data protection authorities will choose how strictly to apply Jautiva. After Sovim, several went further than the Court required. Some will probably do the same this time.

But the ruling has one important limit: The GDPR protects natural persons – not companies. In other words, if the shareholder is a company, the entry is not personal data, and the Court's reasoning should not reach it. Most intermediate holders in cross-border chains are legal persons, so on the face of the judgment the layers that matter most for tracing control stand untouched.

Registries don’t always separate natural and legal persons when they restrict access; after Sovim, several pulled whole datasets. And a natural person can hold shares at any level of a chain, not only at the top. Some structures are built that way on purpose. 

The jurisdictions to watch are EU registries that publish shareholder identity for public limited liability companies without an access condition. Kyckr is mapping them now.

Does the ruling change access to UBO registers?

No. 6AMLD (Directive (EU) 2024/1640) and the AML Regulation (Regulation (EU) 2024/1624), both adopted in 2024 in direct response to Sovim, set the framework. Under it:

• Competent authorities and obliged entities keep access to beneficial ownership registers for customer due diligence.

• Journalists, civil society and third-country obliged entities gain access through a legitimate-interest route, harmonised across Member States for the first time.

Member States must transpose by 10 July 2027, the date the AMLR starts to apply.

Jautiva leaves these provisions intact. If anything, it could push Member States to extend the legitimate-interest model to shareholder data.

Why does shareholder data matter for AML?

Obliged entities use shareholder data to identify UBOs and map financial crime risk along an ownership chain. Reliable public UBO data is scarce, and many firms' own risk policies require them to corroborate UBO declarations anyway. With UBO access fragmented, shareholder data has become more important.

Take one person holding three stakes, each below 25%, through three different vehicles. Together they may amount to effective control. The pattern shows only if all three holdings are visible. Withdraw shareholder data for one class of intermediate company, and that part of the picture could go dark.

What happens next?

National legislators, registries and data protection authorities will give Jautiva effect, and their decisions will differ. Watch for three things:

• Registries restricting or withdrawing shareholder fields

• Authorities reading the judgment beyond public limited liability companies

• Attempts to bring shareholder data under a legitimate-interest regime like the one 6AMLD sets for UBO registers.

What Kyckr is doing

Kyckr retrieves data from official company registers at the point of request. That data feeds our Enhanced Profiles and Ownership Discovery, which traces ownership structures and calculates UBOs. Nothing changes until registries change what they publish or how they grant access.

We are now mapping exposure – identifying every registry in our EU coverage that publishes shareholder identity for public limited liability companies without an access condition, and the fields a restriction would remove. We’re also tracking implementation and will publish updates as Member States respond.

As an AML/CFT provider, Kyckr now has access to the UBO registers of the seven Member States that we believe are fully compliant with the AMLD6 and are working closely with other Member State registrars to increase that number. In accordance with national and EU legislation, we are rolling out legitimate interest access to our customers.

Frequently asked questions

Does C-798/24 apply to private limited companies?

Not directly. The ruling concerns public limited liability companies. National authorities may still read it more widely, as some did after Sovim.

Is Latvia the only country affected?

Latvia must change its rules. Any Member State with a comparable regime faces the same obligation.

Does the ruling cover corporate shareholders? 

The GDPR protects natural persons, so entries naming a company should fall outside it. Registries may still restrict whole datasets.

Can obliged entities still access UBO registers?

Yes. 6AMLD and the AMLR preserve access for obliged entities performing customer due diligence.

Is the UK bound by the ruling?

Not directly. UK courts may have regard to it, and a public campaign against the public PSC and ROE registers has begun, though it hasn’t brought legal action.