The Anti-Money Laundering Act of 18 September 2017 (the “AML Act”) set up a central register at the Treasury Administration(the “UBO Register[1]”) to which all Belgian companies (and certain other legal entities) have to provide information on their Ultimate Beneficial Owner (“UBO”). A royal decree laying down the terms of access, contents, and timing of the register was published on 14 August (the “Royal Decree”).
The register is operational as of today. The required information must be provided by 31 March 2019.
This newsletter discusses the implications for companies.
Why the need for a UBO Register?
AML legislation traditionally requires organizations like financial and credit institutions (“Obliged Entities”) to investigate and verify the identity of their clients, including their UBOs.
For sake of greater transparency and to facilitate this obligation, the Fourth Anti-Money Laundering Directive 2015/849 requires all Member States to set up a central register in which accurate and up-to-date information regarding the UBOs can be consulted.
Who qualifies as a UBO?
The AML Act defines a UBO as any natural person(s) who ultimately own or control the legal entity.
This is the natural person(s) who:
- ultimately own or control a legal entity through direct or indirect ownership of a sufficient percentage of the shares or voting rights or ownership interest in that entity, including through bearer shareholdings. Any ownership of more than 25% of the shares or voting rights will be regarded as an indication of a sufficient percentage.
- exercise control over the legal entity through other means.
If it is still not possible to identify the aforesaid UBOs after having exhausted all means, the natural person(s) who are senior managing officials at the company (directors, managers or officers) qualify as the company’s UBOs.
Which entities have to provide information to the UBO Register?
The obligation to provide information to the register will apply to all companies established in Belgium, foundations, (international) non-profit associations, trusts, and fiduciaries (and similar types of structured arrangements).
Obliged Entities do not have to verify the UBOs of listed companies, but any company established in Belgium, be they listed or not, will still have to provide the required information to the UBO Register.
Although the term “companies” is not defined in the AML Act itself, it logically refers to all companies that are incorporated in accordance with the Belgian Companies Code, including limited companies (e.g.: NV/SA, BVBA/SPRL), partnerships, cooperative entities (e.g.: CVBA/SCRL).
What information will have to be provided to the UBO Register?
The following information will have to be provided to the Register:
- the identity of the UBO (name, surname, birth date, nationality, country of residence, residential address, national (social security) register number);
- since when did he or she begin to qualify as a UBO;
- whether he or she owns the company (directly or indirectly) or controls it (directly or indirectly) through other means;
- if the UBO controls the company indirectly, the number of intermediaries, their incorporation date, legal form, registered office, company no.,
- the extent of his or her ownership or control:
- if he or she owns or controls the company directly: the percentage of shares or voting rights held in the company;
- if he or she owns or controls the company indirectly: the weighted percentage of the shares or voting rights held in the company.
How will the information be collected and processed by the register?
Directors of a company will have to provide the UBO information to the UBO Register electronically within one month from when the data became known or are modified. Such information must also be updated once a year.
The information provided to the Register will be retained for ten years after the company loses its legal personality or after it permanently ceases its business activities. Additional specifics will be laid down by the Minister.
Who will have access to the register?
Pursuant to the Royal Decree, the following parties have access to the UBO Register:
- competent authorities (including the Ministry of Finance, National Bank of Belgium, FSMA);
- financial and credit institutions (and other Obliged Entities) in the framework of their AML obligations;
- any Belgian citizen.
However, Belgian citizens will have access to only a more limited set of information (no access will be granted to the full date of birth, first name, national (social security) register number and residential address of the UBO).
For clarity’s sake, this right of access of citizens only extends to the UBO information regarding companies. If a citizen wants to access UBO information regarding non-profit associations, foundations, trusts or similar structures, he or she will have to demonstrate that he or she has a legitimate interest relating to the prevention of money-laundering and funding of terrorism.
What are the terms of access?
Any Obliged Entity or Belgian citizen who wants to access the UBO Register must pay a fee, but this sum still needs to be determined by the Minister.
Furthermore, the information in the UBO Register may not be used, processed, or distributed for purposes that are contrary to the objectives of the AML Act or the Royal Decree implementing it.
A UBO can also request the Treasury Administration to deny access to all of part of his/her information, to persons or organizations other than the competent authorities or Obliged Entities.
The Ministry will grant this request if the applicant can demonstrate that access to this information would expose him or her to a disproportionate risk of fraud, kidnapping, blackmail, extortion, harassment, violence, or intimidation.
Which data protection obligations must be observed?
Most of the above-listed information that will have to be provided to the UBO Register qualifies as personal data under the applicable data protection legislation. Consequently, companies must comply with several data protection principles under these laws.
Firstly, companies have to inform their UBOs, who are considered data subjects under data protection legislation, about:
- the obligation of the company to communicate the aforementioned information to the UBO Register;
- the fact that the data at stake are registered and stored in the UBO Register;
- the name and the address of the department in charge of managing the UBO Register at the Treasury Administration;
- the possibility for competent authorities, financial and credit institutions (and other Obliged Entities) and, to a certain extent, any Belgian citizen, to access the UBO Register and the information it contains;
- the right of the UBO to be informed of the data that are registered under his/her name in the UBO Register and to rectify and/or delete incorrect data (such right being exercised by the UBO towards the company while the company in its turn has the obligation to subsequently request the UBO Register’s manager to rectify/delete the incorrect data);
- the fact that the data at stake are stored and will be retained for ten years after the company loses its legal personality or permanently ceases its business activities.
In parallel, the Treasury Administration will inform the UBOs about their registration in the UBO Register and provide them with the data registered under his or her names.
Secondly, the UBOs concerned may consult the data recorded in the UBO Register by sending a request to the Treasury Administration and request, free of charge, the rectification or deletion of any inaccurate data registered in his or her name. Companies will then be responsible for rectifying or deleting such data and for notifying the Register about any such changes without delay.
In addition, the use of any personal data by companies will be strictly limited to what is needed for them to comply with their obligations to identify their UBOs.
Whereas the AML Act refers to the application of the General Data Protection Regulation 2016/679 (“GDPR”) and the Belgian Privacy Act of 1992, the Royal Decree refers to the latter only.
What are the sanctions for non-compliance?
First, if a company fails to timely comply with its UBO identification obligations, its directors can not only be held liable by the company but also be punished by fines ranging from minimum EUR 50 to maximum EUR 5,000 under the Companies Code.
Second, the AML Act allows the Minister of Finance to impose an administrative fine, ranging between EUR 250 and EUR 50,000, for failure to comply with the UBO identification obligations.
Lastly, any violation of the GDPR can lead to significant fines being imposed, the amount of which can be up to 4% of the total worldwide annual turnover of the company concerned.
When is the deadline for providing the UBO information to the UBO Register?
The Royal Decree will enter into force on 31 October 2018.
The Minister has postponed the first deadline for providing the UBO information to the UBO Register. The old deadline was 31 November 2018, the new deadline is 31 March 2019.
Footnotes:
[1] The UBO Register can be accessed via the MyMinfin application.
