Amendments to the RCBE regime

Decree-Law 115/2025 of October 27 (“Decree-Law 115/2025”) amends the legal regime governing the Central Register of Ultimate Beneficial Owners (“RCBE”), initially approved by Law 89/2017 of August 21. It transposes into Portuguese law the requirement for “demonstrating a legitimate interest” for any individuals or organizations seeking to access information about beneficial owners.

This amendment aligns with changes to Articles 30 and 31 of Directive (EU) 2015/849, as established by Article 74 of Directive (EU) 2024/1640 of the European Parliament and of the Council of May 31, 2024, on the mechanisms to be put in place by Member States for the prevention of the use of the financial system for the purposes of money laundering or terrorist financing. It also follows the judgment of the Court of Justice of the European Union in Joined Cases C-37/20 and C-601/20, WM and Sovim SA v. Luxembourg Business Registers. This judgment annulled the amendment introduced by Directive (EU) 2018/843 to Article 30.5 of Directive (EU) 2015/849, which had required Member States to ensure that information on the beneficial owners of companies and other legal entities incorporated within their territory was accessible in all cases to any member of the general public.

New access regime: Demonstrating legitimate interest

The revised article 19.1 of the RCBE legal regime now reflects the guideline adopted in Directive (EU) 2024/1640, stipulating that information “is made available on a website to anyone who demonstrates a legitimate interest in accessing it. In other words, only individuals or organizations with legitimate interests may access information about the beneficial owners of legal entities and collective interest centers without legal personality. All access to information about beneficial owners is recorded and retained for audit purposes for a five-year period, including details of the legitimate interest invoked.

The amendment seeks to ensure a just balance between the protection of beneficial owners’ fundamental rights—specifically the right to privacy and personal data protection—and the protection of the European Union’s (“EU”) financial system against money laundering and terrorism financing. Also, it promotes the value of transparency in legal transactions, which is facilitated by enabling those who intend to do business with legal entities or collective interest centers without legal personality within the EU to know the beneficial owners.

Exclusion of undivided inheritances from the RCBE’s scope

Decree-Law 115/2025 now excludes undivided inheritances from the obligation to register the beneficial owner. Previously, it only excluded pending inheritances (heranças jacentes). In fact, one of the key requirements for registering with the RCBE is the voluntary nature of the entity’s constitution. Even though an inheritance may remain undivided by the heirs’ will, they are not the ones who bring about its formation. As there is no legal obligation to proceed with the partition (of the inheritance), it should be outside the scope of the registration obligation.

Following the same principle of delimiting and minimizing scope, and regarding the data collected in the declaration, article 9.1.c) of the RCBE regime no longer limits identification to the “the declarant” (based on the previous wording). Instead, it now includes “the legal representative of a beneficial owner who is a minor or an adult under supported decision-making” (maior acompanhado), clarifying who can be identified for the purpose of accountability for the declaratory act, without equating the legal representative with the effective beneficial owner.

National Data Protection Committee opinion on the amendments

Before this amendment was put into effect, the Secretary of State for the Presidency of the Council of Ministers submitted a request to the Portuguese Data Protection Authority (“CNPD”) regarding the draft decree-law amending the RCBE to transpose Article 74 of Directive (EU) 2024/1640. Following this request, the CNPD issued Opinion 2025/57 on September 30, 2025, stating that this amendment establishes “an equivalence for this purpose between the declarant and the legal representative of a beneficial owner who is a minor or an adult under accompanied support, aiming to comply with the principle of data minimization. In other words, it is a practical equivalence strictly for the purposes of identifying and attributing the act of declaration.

The rationale is to anchor data processing in compliance with a legal obligation (Article 6.1.c) of the General Data Protection Regulation (“GDPR”)), implementing the principle of data minimization (Article 5.1.c) of the GDPR) and data protection by design and by default (Article 25 of the GDPR), with the corresponding fulfillment of transparency obligations (Articles 13 and 14 of the GDPR) and storage limitation (Article 5.1.e) of the GDPR).

Accordingly, the collection of data on the representative must be limited to what is strictly necessary to (a) prove the legitimacy of the representation; (b) ensure means of contact; and (c) enable accountability for the declaration, without equating the representative to the effective beneficial owner or broadening data categories.

As regards the plan for accessing RCBE information, the CNPD welcomes the replacement of public access with the “legitimate interest” requirement and the provision for recording access logs for five years (including the legitimate interest invoked) as proportionate accountability and auditing measures.

It also recalls the statutory reserve (reserva de lei) applicable to data processing and the need for prior control by the CNPD regarding the ordinance that will define the access methods and users’ identification data, concerning which the CNPD “reserves its opinion for a later time.” Lastly, it concludes that the proposal does not “raise new issues from the perspective of the right to personal data protection.”

Date of entry into force of the amendments to the RCBE regime

Although the decree-law makes no provision regarding the date of entry into force, under the applicable supplementary regime, where no specific date is set, the decree-law enters into force on the fifth day following its publication (i.e., November 1).