Beneficial ownership registers — filing and discrepancies

Beneficial ownership registers create two entirely separate obligations, and most firms only notice one of them. The first is a filing duty: you declare your own beneficial owners as a legal entity. The second is a discrepancy-reporting duty that applies to you as an obliged entity, in respect of your customers’ register entries. They have different owners, triggers and systems, and the second is the one that gets missed. This guide sets out the AMLR rule that will govern discrepancy reports from July 2027, the national rules that apply until then, how each register differs, and three worked cases.

1. Two duties, easily confused

Filing your own beneficial owners happens a handful of times in a company’s life. Reporting discrepancies can arise on any corporate onboarding or periodic review, which makes it a process to design, with a clock, a decision record and an owner.

2. The AMLR rule: Article 24, step by step

Article 24 of Regulation (EU) 2024/1624 governs discrepancy reports once the Regulation applies on 10 July 2027 (Article 90). Until then, each Member State’s transposition of the Fourth AML Directive’s discrepancy duty applies, and those national rules differ in deadline and recipient (section 3). A firm designing its process now should build to the AMLR version and add the national variants on top.

What must be reported. Discrepancies between the central register and the information the obliged entity collects itself when identifying and verifying beneficial owners, under Article 20(1)(b) and Article 22(7).

When. Without undue delay and in any case within 14 calendar days of detection.

With what. The information obtained that indicates the discrepancy, whom the entity considers the beneficial owners to be, and where applicable the nominee shareholders and nominee directors, and why. It is a reasoned report, not a flag.

The derogation. Article 24(2) lets the entity ask the customer for more information instead of reporting where the discrepancy is either (a) limited to typographical errors, different transliterations or minor inaccuracies that do not affect the identification of the beneficial owners or their position, or (b) the result of outdated data, where the beneficial owners are known to the entity from another reliable source and there are no grounds to suspect an intention to conceal.

The follow-through most runbooks miss. If the entity concludes the register is wrong, it must invite the customer to file the correct information with the register, again without undue delay and within 14 calendar days. If the customer does not do so within that deadline, Article 24(3) requires the entity to report the discrepancy itself, on the full terms of paragraph 1. The derogation also does not apply in higher-risk cases subject to the enhanced due diligence measures of Section 4 of Chapter III.

3. The registers themselves, and their discrepancy rules today

Each Member State operates its own register, with its own filing mechanics and access regime:

• Spain: the central beneficial-owner register created by Royal Decree 609/2023, which also determines who may query it.
• Germany: the Transparenzregister, with its own filing deadlines by legal form and its own discrepancy duty on obliged entities.
• Netherlands: the UBO-register at the KVK, with graded access levels UBOB1 to UBOB3 and the article 10c Wwft terugmeldplicht in force since 1 October 2024.
• France: the registre des bénéficiaires effectifs, held in the Registre national des entreprises at the INPI, where consultation now requires an access decision under article L. 561-46-2 CMF.
• Italy: the registro dei titolari effettivi, suspended since May 2024, validated by the Court of Justice on 21 May 2026, and given an entirely new access regime by D.Lgs. 122/2026 that is not yet switched on.
• Luxembourg: the Registre des bénéficiaires effectifs, rebuilt by the loi du 23 janvier 2025, with an escalating administrative ladder that ends in striking-off and a legitimate-interest route decided on the opinion of an advisory commission.
• Belgium: the UBO register at FPS Finance, the only one in this list that requires an annual confirmation even where nothing has changed, and the only one that backs every entry with a supporting document under Article 3 §1 16° of the Royal Decree of 30 July 2018.
• Ireland: the Register of Beneficial Ownership, with no annual return, a five-month filing runway under Regulation 20(2) of S.I. 110/2019, a fourteen-day follow-up obligation, and a Tier Two access tier that designated persons apply for and pay per report.

The discrepancy rules that apply before July 2027 differ in basis, recipient and clock:

The divergence that matters operationally is access, not filing. Filing mechanics converge on the same shape: declare on incorporation, update on change, and face penalties for silence. Access has split. France has moved to a permission model: an assessed legitimate interest, an access certificate valid for three years, and a twelve-working-day response time where silence counts as refusal. The Netherlands has a tiered model, where the same register returns different fields depending on the requester’s authorisation level, with financial undertakings under the Wft at UBOB2 and the FIU at UBOB3. Italy’s new access regime follows the French template, because both transpose the same AMLD6 articles, but the Italian register is suspended, so the regime exists on paper only. Luxembourg keeps a permission model and adds an advisory-commission gate for legitimate-interest requests. A single “pull the UBO extract” step in a pan-European runbook cannot describe all four.

Register access has therefore become an estate to maintain, with credentials, expiry dates and per-market entitlement levels. It needs the same ownership as any other credential estate, and the same renewal diary.

4. Building the discrepancy process

The clock runs from detection, so the design burden is on knowing when detection occurred. Five things make it work:

• Timestamp the comparison, not the onboarding. Detection is when the register was checked against the file, which may be at onboarding, at periodic review, or when an extract is refreshed. All three paths must write the same field.
• Route the derogation decision. Deciding not to report under the typographical or outdated-data limbs is a decision with conditions. Made silently by an analyst closing an alert, it leaves no record that the conditions were tested.
• Block the derogation for EDD customers. If the customer’s risk rating triggers enhanced due diligence, the case management tool should not offer the derogation option at all.
• Put a 14-day expiry on the customer invitation. An unanswered invitation turns into a report under Article 24(3). The request needs an expiry date and an automatic escalation, not just a send date.
• Keep a per-market routing table. Recipient, channel and credential for each register, including the Dutch terugmelding authorisation and the French access certificate, with renewal dates.

5. The design point underneath all of it

Facts: A firm populates beneficial ownership at onboarding directly from the national register extract, on the view that the register is authoritative.

What that produces: A file that can never generate a discrepancy report, because there is nothing independent to compare. The firm has also not performed the identification the AMLR requires. Article 22 obliges the entity to identify and verify beneficial owners, and Article 24 obliges it to state whom it considers them to be.

What the practitioner does: Treats the register as a verification input rather than a source. The identification is performed on the customer’s own documentation, such as the ownership chain, shareholder agreements and control arrangements, and the register extract is compared against it. That comparison is the discrepancy control, and it costs almost nothing once the identification is being done properly.

6. Worked example: an outdated shareholding

Facts: A payment institution onboards a German GmbH. The Transparenzregister shows two beneficial owners at 50% each. The notarised share-transfer deed supplied by the customer shows that one of them sold her stake to the other three months ago. The firm has no suspicion of concealment.

What the rule says: Under the AMLR, this is outdated data where the beneficial owner is known from another reliable source, so Article 24(2)(b) allows a request to the customer instead of a report. Because the register is wrong, the firm must invite the customer to correct it within 14 days. Before July 2027, the German § 23a GwG regime applies and must be checked for its own conditions.

What the practitioner does: The analyst records the detection date, the deed as the reliable source, and the derogation decision with its reasons. The system sends the customer an invitation with a 14-day expiry and checks the register again on day 15.

Outcome: If the entry is corrected, the case closes with the evidence on file. If not, the firm files a report stating that it considers the remaining shareholder the sole beneficial owner, and why.

7. Worked example: a high-risk customer with a nominee

Facts: A Dutch BV applies for a business account. The UBO-register names one director as beneficial owner. A trust deed obtained in due diligence shows he holds the shares as nominee for a person resident in a high-risk third country. The customer is rated high risk and placed under enhanced due diligence.

What the rule says: The derogation does not apply to higher-risk cases under Section 4. The firm reports within 14 days of detection, naming whom it considers the beneficial owner and identifying the nominee.

What the practitioner does: The analyst files the terugmelding through the KVK portal using the firm’s authorised account, attaching the trust deed extract and the reasoning. Separately, the MLRO assesses whether the concealment raises a suspicion that requires a report to the FIU.

Outcome: Two separate outputs from one finding: a register report within the deadline, and a documented suspicion assessment.

FAQ

What to do, today

• Onboarding owner: add a single “register compared” timestamp written by onboarding, periodic review and extract refresh.
• Financial crime: add the derogation decision, the EDD block and the 14-day invitation expiry to the case workflow.
• Compliance: build the per-market routing table and diary the renewal of each register credential.

Related: The discrepancy duty in detail · Registre des bénéficiaires effectifs — France · UBO-register — Netherlands · What is a beneficial owner · Account registers compared · Kontenabrufverfahren — the § 24c KWG account file · CRBOT — Ireland’s trust beneficial ownership register · Handelsregister (KVK) — the Dutch company register · Handelsregister — the German company register · Registro Mercantil — the Spanish company register · CRO — the Irish company register · RCS — the Luxembourg company register · Company registers compared across the EU · RFT — Luxembourg’s register of fiducies and trusts · Ley de Integridad Pública: FTF access and the Libro de Socios