Registre des bénéficiaires effectifs — France’s UBO register
France’s beneficial ownership register stopped being a lookup and became a permission. The registre des bénéficiaires effectifs (RBE) is no longer something you consult; it is something you are granted access to, for a fixed term, after an assessment of your legitimate interest. Décret n° 2026-310 du 24 avril 2026 put the machinery around that assessment in place, and its timing provisions bite on 10 November 2026. If your onboarding process still assumes a French UBO extract can be pulled on demand, it is describing a register that closed in July 2024.
1. Two duties, and only one of them is yours as a filer
A payment or e-money firm meets the RBE in three different capacities, and confusing them is the most common source of process failure:
| Capacity | What you owe | Legal basis |
|---|---|---|
| As a French-registered entity | Declare your own beneficial owners, and update within 30 days of any change | Articles L. 561-46 and R. 561-55 CMF |
| As an obliged entity performing due diligence | Consult the register — which now requires an access decision | Articles L. 561-46, L. 561-46-2 CMF |
| As an obliged entity that finds a mismatch | Report the discrepancy to the greffier du tribunal de commerce | Article L. 561-47-1 CMF |
Only the first is a filing duty in the ordinary sense. The second is an access-management problem that sits with whoever owns your vendor and credential estate. The third is an operational control that has to fire during customer due diligence, not during a periodic clean-up — and it is the one that most often has no owner at all.
2. Filing your own beneficial owners
Since 1 January 2023 the RBE is a component of the Registre national des entreprises (RNE), maintained and published by the INPI. Declarations no longer go to the commercial court registry directly; they are filed through the guichet unique, the single business-formalities portal, which routes them to the competent bodies and into the RNE.
The threshold is the familiar one: a beneficial owner is a natural person who directly or indirectly holds more than 25% of the capital or of the voting rights, or who exercises control by other means. Where no such person can be identified, the legal representative is declared instead — the same fallback that every EU register applies, and the same one that produces registers full of directors rather than owners.
Two timing rules matter. The declaration accompanies the registration application, and any fact or act requiring the declared information to be corrected or completed must be declared within 30 days. That second clock is the one firms miss: it runs from the corporate event, not from the moment the company secretarial team notices the corporate event.
3. The access regime, and why it changed
Until 31 July 2024 the RBE was substantially public. Following the Court of Justice’s ruling on public access to beneficial ownership registers, France replaced open consultation with a filtered model: access on request, granted to those who can demonstrate a legitimate interest, and unrestricted access for a defined list of competent authorities.
The statutory hook is article L. 561-46-2 CMF, inserted by article 4 of loi n° 2025-391 du 30 avril 2025 (the 2025 DDADUE law). It restricts consultation to persons demonstrating a legitimate interest, and it creates a presumption: persons with a link, even an indirect one, to the prevention of or fight against money laundering, its predicate offences or terrorist financing are presumed to have that interest. Obliged entities under article L. 561-2 CMF continue to have access in the framework of their due diligence measures.
Décret n° 2026-310 du 24 avril 2026 then supplied the procedure, and it is worth reading as a workflow rather than as law:
- Article R. 561-57 sets out the authorities with unrestricted access — law enforcement and the financial intelligence unit, courts and anti-corruption bodies, EU institutions including OLAF, Europol, Eurojust and the new anti-money-laundering authority, professional supervisory bodies, and European counterpart authorities.
- Article R. 561-58-1 defines how legitimate interest is assessed: by reference to the applicant’s function and, save for certain officials, to their connection with the entity concerned. Recognition already granted by another member state removes the need to re-examine the functional criterion — a point of real practical value for a group operating several EU entities.
- Article R. 561-58-2 sets the response times. A request goes to the register keeper or the commercial court registry, which answers within twelve working days, reduced to seven for holders of an access certificate. Silence is an implicit rejection, which means an unanswered request is not a pending request.
- Article R. 561-58-3 provides for an access certificate valid for three years once legitimate interest is established.
The decree applied from 25 April 2026, except the provisions on the assessment time limits, which apply from 10 November 2026.
4. Three situations, and what the practitioner actually does
Scenario 1 — the passporting EMI that has never applied for access.
Facts: an e-money institution passported into France onboards French corporate customers from its head office. Its onboarding runbook says “obtain an RBE extract”. No one has held an access certificate since the register closed.
What the rule says: access is now a decision under L. 561-46-2 and R. 561-58-2, not a self-service lookup, and the answer can take twelve working days — with silence counting as refusal.
What the practitioner does: applies for the access certificate as an infrastructure task with a three-year renewal date on it, and in the meantime instructs onboarding to obtain the extract from the customer. Two changes follow in the file: a diarised certificate expiry, and a runbook that distinguishes “extract obtained from the register” from “extract supplied by the customer”, because only the first can support a discrepancy report without further work.
Scenario 2 — a genuine mismatch found at onboarding.
Facts: a French SAS declares a single beneficial owner at 60%. The customer’s own shareholders’ agreement, obtained during due diligence, shows a second individual holding 30% through an intermediate holding company.
What the rule says: article L. 561-47-1 CMF requires obliged entities to report to the greffier du tribunal de commerce discrepancies between register information and information held from other sources. Under article 24 of Regulation (EU) 2024/1624 the report is due without undue delay and in any event within 14 calendar days of detection, must state whom the entity considers the beneficial owners to be, and must say why.
What the practitioner does: timestamps the comparison — not the onboarding — as the detection event, files a reasoned report rather than a flag, and records the ownership chain that produced the conclusion. The recipient then has a defined window to respond before the registry’s own enforcement powers engage; that is the registry’s clock, not yours, and it does not extend your 14 days.
Scenario 3 — a group entity restructures and nobody tells company secretarial.
Facts: a French subsidiary of an EU group is reorganised in a way that moves a holding from 24% to 27%. The share transfer completes on the 3rd; the group’s legal team learns of it on the 40th day.
What the rule says: the modification declaration is due within 30 days of the act requiring the declared information to be corrected or completed. The clock ran from the transfer.
What the practitioner does: files immediately and does not wait for the next corporate housekeeping cycle, then fixes the cause — the RBE update has to be a downstream consequence of the share register changing, triggered by the same event that triggers the share register entry. Any design that depends on someone remembering will fail again, and the failure carries a criminal penalty attached to inaccurate or incomplete information, not only to silence.
5. The training obligation buried in the same decree
Décret n° 2026-310 is not only about register access. It also inserts article D. 561-38-1-1 CMF, requiring entities subject to anti-money-laundering obligations to train staff on hiring and regularly thereafter on the applicable rules, the sanctions that attach to breaching them, and money-laundering and terrorist-financing typologies. Training records must be kept for five years after the end of employment.
That retention period is the operational point. Five years past termination is longer than most human-resources systems retain training data by default, and the record has to survive the leaver process, not sit inside it. Firms that run training through a learning platform tied to active accounts will find the evidence deleted precisely when a supervisor asks for it.
FAQ
Can we still look up a French company’s beneficial owners online?
Not freely. Since 31 July 2024 the register is consulted on request. Competent authorities listed in article R. 561-57 CMF have unrestricted access; everyone else must demonstrate a legitimate interest under article L. 561-46-2 CMF, and obliged entities have access in the framework of their due diligence.
How long does an access request take?
Twelve working days, reduced to seven for holders of an access certificate, under article R. 561-58-2 CMF. Silence at the end of the period counts as a rejection. Those timing provisions apply from 10 November 2026.
How long does access last once granted?
An access certificate issued on proof of legitimate interest is valid for three years under article R. 561-58-3 CMF, so it needs a diarised renewal like any other credential.
Where is the declaration filed now?
Through the guichet unique, the single business-formalities portal, into the Registre national des entreprises maintained by the INPI. Declarations are no longer made to the commercial court registry directly.
What is the deadline for updating a declaration?
Thirty days from the fact or act requiring the declared information to be corrected or completed. The clock runs from the corporate event itself.
What happens if we do not declare?
Article L. 574-5 CMF provides six months’ imprisonment and a €7,500 fine, with additional penalties including a management ban, and the same penalty applies to inaccurate or incomplete declarations. The registry may also strike the entity three months after a formal notice.
6. What to do, today
- Find out whether you have access at all. Ask who holds the RBE access certificate and when it expires. If nobody can answer, your French onboarding is running on customer-supplied extracts whether or not the runbook says so.
- Diarise 10 November 2026 and the three-year certificate expiry. Both are dates that arrive without a notification.
- Give the discrepancy report an owner and a timestamp field. Detection is when the register was compared against the file; if no system writes that moment, the 14-day clock cannot be evidenced.
- Make the RBE update a consequence of the share register, not a task. The 30-day clock runs from the corporate event.
- Check that training records survive leavers by five years. Article D. 561-38-1-1 CMF is new, and the retention rule is the part that breaks existing systems.
Related: Beneficial ownership registers — filing and discrepancies · FICOBA — France’s account register · TRACFIN and suspicious activity reporting · What is a beneficial owner
