Elliott Phillips and Chris Edwards examine the recent changes to Gibraltar’s Register of Ultimate Beneficial Owners in Financial Regulation International

Gibraltar recently introduced and significantly reversed a new access regime for its Register of Ultimate Beneficial Owners. In a demonstration of legislative agility, Legal Notices 147 (LN 147) and 220 (LN 220) of 2026 restored open access for corporate and legal entities, but carved out express trusts entirely from public inspection. These changes are important for practitioners who advise clients on Gibraltar structures.

Open Register

A brief history helps to understand why they matter.

The Register of Ultimate Beneficial Owners, Nominators and Appointors Regulations 2017 (UBO Regulations) came into operation on 26 June 2017. Sitting under section 184 of the Proceeds of Crime Act 2015, they were expressly enacted for the purpose of transposing, in part, Directive (EU) 2015/849 (the Fourth Money Laundering Directive) and Directive (EU) 2018/843 (the Fifth Money Laundering Directive). This put Gibraltar's regime within the EU’s anti-money laundering transparency agenda.

For Gibraltar, the UBO Regulations established a comprehensive beneficial ownership register with an appointed local Registrar. Under the regime, parallel disclosure obligations were imposed on corporate or legal entities incorporated in Gibraltar (regulation 6 onward) and trustees of express trusts (regulation 9 onward). Both were required to obtain, maintain and update adequate, accurate and current beneficial ownership information, and to submit relevant particulars to the Registrar including the full name, date of birth, and the nature and extent of their beneficial interest.

Notably, regulation 26, concerning access to the register, allowed a wide range of requesters to inspect information: competent authorities, the Gibraltar Financial Intelligence Unit (GFIU), obliged entities and members of the public. This led to the regime being described as an open register, putting Gibraltar among a few jurisdictions that permitted largely unrestricted access to beneficial ownership data. Regulation 26(7) carved out express trusts from inspection. The architecture reinstated by LN 220 therefore echoes a feature of the original legislation.

Under pressure

A landmark 2022 judgment by the Court of Justice of the European Union (CJEU) has put Gibraltar's open register model under increasing pressure. In WM and Sovim, the CJEU held that unrestricted public access to beneficial ownership registers was incompatible with the fundamental rights to privacy and data protection under the EU Charter. This prompted a shift across EU and EU-linked jurisdictions from open registers to access regimes conditioned on a demonstration of legitimate interest.

Legitimate Interest Model

Gibraltar’s response to the post-WM and Sovim consensus is evident in LN 147, which became effective from 15 July 2026, coinciding with the UK-EU Agreement in respect of Gibraltar. It confirms the intent to give effect to changes under the Fourth Money Laundering Directive since the implementation period completion day.

At the heart of LN 147, regulation 26(1)(d) replaced “member of the public” with “natural or legal person that can demonstrate a legitimate interest in accordance with regulation 26ZZA.” Under paragraph (aa), the Commissioner of Income Tax was also inserted as a new category of person entitled to access.

Legitimate interest framework

Regulation 26ZZA established that persons who demonstrate a legitimate interest connected with preventing or combating money laundering, predicate offences, terrorist financing or proliferation financing, could access the beneficial owner’s name, date of birth, country of residence and nationality, and the nature and extent of their beneficial interest.

Categories deemed to hold a legitimate interest include: journalists or media outlets connected with AML/CFT/CPF matters; civil society organisations, NGOs and academic institutions with a similar connection; persons likely to enter into a transaction wanting to avoid links to money laundering; foreign AML/CFT/CPF-obliged entities and competent authorities (subject to proof of need); the Registrar of Companies; the Gibraltar Competition and Markets Authority; public procurement authorities; and certain AML/CFT/CPF product providers. Access could be sought by other applicants on a case-by-case basis.

Verification and safeguards

Under a new regulation 26ZZB the Registrar was required to assess each application by reference to the applicant’s function or occupation (and, for most categories, their connection to the specific entity), to verify their identity, and to respond within 12 working days extendable during periods of high demand in increments of 12 further working days.

After granting access, the Registrar was to issue a certificate valid for three years. Grounds for refusal were limited to the following: failure to provide required information or to demonstrate legitimate interest, reasonable belief that the information would be misused, application of disclosure exemptions, or non-compliance with GDPR Chapter V requirements for non-Gibraltar applicants.

A discretionary exemption under Regulation 26ZZC enables the Registrar to shield personal information from disclosure in exceptional circumstances: where there was a disproportionate risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation, or where the beneficial owner was a minor or lacked legal capacity.

Reversal and Carve-Out

One day before LN 147 was due to commence, LN 220 came into force on 14 July 2026, substituting an entirely new regulation 26 and restoring “a member of the public” as a category of person entitled to request inspection of Register information.

By omitting regulations 26ZZA to 26ZZC, the new regulation 26 removes the legitimate interest test, the verification procedure and the disclosure exemptions. It also amends LN 147, omitting regulations 4(3) and (4) of the Proceeds of Crime (Amendment) Regulations 2026, which would have introduced the legitimate interest wording and inserted regulations 26ZZA–26ZZC.

A new sub-regulation (4) confirms that a member of the public may access the beneficial owner’s name, date of birth, nationality, country of residence, and the nature and extent of their beneficial interest: the data that would have been available under the legitimate interest regime.

Express trust exclusion

The most consequential innovation of LN 220 is regulation 26(7), which expressly disapplies several access provisions where the Register search relates to an express trust.

Specifically, LN 220 contains the following:

• Sub-regulations (1)(c) and (1)(d) - granting access to obliged entities and members of the public - do not apply to searches relating to an express trust.
• Sub-regulation (3), which provides for obliged entities’ customer due diligence access, is similarly disapplied.
• Sub-regulation (4) - the substantive categories of information available to members of the public - does not apply.
• Sub-regulation (5), providing for notification of the beneficial owner upon an access request, is also excluded.

The practical effect is significant: the open register is largely restored to its former breadth for corporate and legal entities incorporated in Gibraltar. However, members of the public and obliged entities are excluded from the inspection right for express trusts. Under new sub-regulations (1A) and (2), only competent authorities, the Commissioner of Income Tax and the GFIU retain direct and immediate access to trust beneficial ownership information.

Other Retained Features

Some of the regime’s longstanding features are preserved by LN 220:

• The GFIU retains direct and immediate access, as do persons to whom the Registrar has delegated functions.
• A ten-year sunset applies to the availability of information from the date the duty to provide it to the Registrar ceases.
• The Registrar also retains discretion to notify a beneficial owner where a member of the public or obliged entity requests information, or is granted access to it.

Unusual Sequencing

The legislative timing is unusual. The legitimate interest regime introduced by LN 147 appears to have been superseded before taking practical effect in relation to regulation 26 amendments. LN 220 also directly amends LN 147 to remove the provisions that would have given effect to that regime.

From a practitioner’s perspective, this sequencing means that the legitimate interest model should be treated as having had no operative period; the transition comes directly from the original open register to the new regime.