Elliott Phillips and Chris Edwards discuss Gibraltar’s new UBO register, in Thomson Reuters Regulatory Intelligence

In a display of legislative dexterity, Gibraltar has simultaneously introduced and substantially reversed a new access regime for its Register of Ultimate Beneficial Owners. Together, Legal Notices 147 (LN 147) and 220 (LN 220) of 2026 have restored open access for corporate and legal entities, while express trusts are carved out entirely from public inspection. For practitioners advising clients with Gibraltar structures, these changes merit attention.

Open Register

To appreciate their significance requires an understanding of the register's origin.

Sitting under section 184 of the Proceeds of Crime Act 2015, the Register of Ultimate Beneficial Owners, Nominators and Appointors Regulations 2017 (UBO Regulations) came into operation on 26 June 2017. They were enacted for the express purpose of transposing, in part, Directive (EU) 2015/849 (the Fourth Money Laundering Directive) and its successor, Directive (EU) 2018/843 (the Fifth Money Laundering Directive). This put Gibraltar's regime squarely within the EU’s anti-money laundering transparency agenda following publication of the Panama Papers.

The UBO Regulations established a comprehensive beneficial ownership register in Gibraltar, with an appointed local Registrar. The regime imposed parallel disclosure obligations on corporate or legal entities incorporated in Gibraltar (regulation 6 onward) and trustees of express trusts (regulation 9 onward). Each was required to obtain, hold and update adequate, accurate and current beneficial ownership information, and to submit prescribed particulars to the Registrar including full name, date of birth, and the nature and extent of the beneficial interest held.

Crucially, regulation 26, which provided access to the register, permitted a broad category of requesters to inspect information: competent authorities, the GFIU, obliged entities and members of the public. This 2017 baseline led to the regime being described as an open register, placing Gibraltar among only a few jurisdictions that permitted largely unrestricted public access to beneficial ownership data.

Regulation 26(7) carved out express trusts from public and obliged entity inspection. The architecture that LN 220 reinstates therefore echoes a feature from the original legislation.

Under pressure

Gibraltar's open register model is under increasing pressure. The Court of Justice of the European Union's landmark 2022 judgment in WM and Sovim held that unrestricted public access to beneficial ownership registers was incompatible with the fundamental rights to privacy and data protection under the EU Charter. Across EU and EU-linked jurisdictions, this prompted a shift from open registers to access regimes conditioned on a demonstration of legitimate interest.

Legitimate Interest Model

Effective from 15 July 2026, LN 147 represents Gibraltar’s response to the post-WM and Sovim consensus. Coinciding with the UK-EU Agreement in respect of Gibraltar, its explanatory memorandum confirms the intent to give effect to changes under the Fourth Money Laundering Directive since the implementation period completion day.

The centrepiece of LN 147, regulation 26(1)(d) replaced “member of the public” with “natural or legal person that can demonstrate a legitimate interest in accordance with regulation 26ZZA.” Under paragraph (aa), it also inserted the Commissioner of Income Tax as a new category of person entitled to access.

Legitimate interest framework

New regulation 26ZZA established that persons demonstrating a legitimate interest connected with the prevention or combating of money laundering, predicate offences, terrorist financing or proliferation financing, could access the beneficial owner’s name, date of birth, country of residence and nationality, and the nature and extent of their beneficial interest.

Certain categories were automatically deemed to hold a legitimate interest, including: journalists or media organisations connected with AML/CFT/CPF matters; civil society organisations, NGOs and academic institutions with a similar connection; persons likely to enter into a transaction wishing to avoid links to money laundering; foreign AML/CFT/CPF-obliged entities and competent authorities (subject to proof of need); the Registrar of Companies; the Gibraltar Competition and Markets Authority; public procurement authorities; and certain AML/CFT/CPF product providers. Other applicants could still seek access on a case-by-case basis.

Verification and safeguards

A new regulation 26ZZB required the Registrar to assess applications by reference to the applicant’s function or occupation (and, for most categories, their connection to the specific entity), to verify their identity, and to respond within 12 working days; extendable in increments of 12 working days during periods of high demand. Upon granting access, the Registrar was to issue a certificate valid for three years. Grounds for refusal were circumscribed: failure to provide required information or to demonstrate legitimate interest, reasonable belief that the information would be misused, application of disclosure exemptions, or non-compliance with GDPR Chapter V requirements for non-Gibraltar applicants.

Regulation 26ZZC complemented this with a discretionary exemption, enabling the Registrar to shield personal information from disclosure in exceptional circumstances: specifically, where there was a disproportionate risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation, or where the beneficial owner was a minor or lacked legal capacity.

Reversal and Carve-Out

On 14 July 2026 - one day before LN 147 was due to commence - LN 220 came into force, substituting an entirely new regulation 26 and restoring “a member of the public” as a category of person entitled to request inspection of Register information.

Completely omitting regulations 26ZZA to 26ZZC, it removes the legitimate interest test, the verification procedure and the disclosure exemptions. It also directly amends LN 147, omitting regulations 4(3) and (4) of the Proceeds of Crime (Amendment) Regulations 2026 (which would have introduced the legitimate interest wording and inserted regulations 26ZZA–26ZZC).

A new sub-regulation (4) confirms that a member of the public may access the beneficial owner’s name, date of birth, nationality, country of residence, and the nature and extent of their beneficial interest: materially the same data points that would have been available under the legitimate interest regime.

Express trust exclusion

LN 220’s most consequential innovation is regulation 26(7), which expressly disapplies several access provisions where the Register search relates to an express trust.

Specifically:

• Sub-regulations (1)(c) and (1)(d) — granting access to obliged entities and members of the public — do not apply to searches relating to an express trust.
• Sub-regulation (3), which provides for obliged entities’ customer due diligence access, is similarly disapplied.
• Sub-regulation (4) — the substantive categories of information available to members of the public — does not apply.
• Sub-regulation (5), providing for notification of the beneficial owner upon an access request, is also excluded.

The practical effect is stark. For corporate and legal entities incorporated in Gibraltar, the open register is largely restored to its former breadth. For express trusts however, members of the public and obliged entities are excluded from the inspection right. Only competent authorities, the Commissioner of Income Tax and the GFIU retain direct and immediate access to trust beneficial ownership information under new sub-regulations (1A) and (2).

Other Retained Features

LN 220 preserves some of the regime’s longstanding features. The GFIU retains direct and immediate access, as do persons to whom the Registrar has delegated functions. A ten-year sunset applies to the availability of information from the date the duty to provide it to the Registrar ceases. The Registrar also retains a discretion to notify a beneficial owner where a member of the public or obliged entity requests information or is granted access to it.

Unusual Sequencing

The legislative timing is noteworthy. The legitimate interest regime introduced by LN 147 appears to have been superseded before it took practical effect in relation to regulation 26 amendments. LN 220 also directly amends LN 147 to remove the very provisions that would have given effect to that regime. From a practitioner’s perspective, this unusual sequencing means that the legitimate interest model should be treated as having had no operative period; the transition comes directly from the original open register to the new regime.