Beneficial owners: who can see your data, and how to apply for exclusion
7 min read
If you are the beneficial owner of an Italian company, or have just signed the filing that names one, you have already taken a decision whose price you may not know. Since 23 July your name, your month and year of birth, country of residence and citizenship are no longer reserved to the authorities: accredited obliged entities read them, and so does anyone showing a legitimate interest — including anyone documenting with your company an actual commercial or financial negotiation under way, including at the talks stage. All of it with no prior notice to the data subject. A procedure to stop them exists: it is filed with the communication to the Register, not afterwards. And the technical format for lodging it, approved on 23 September, is not yet in force.
Who sees, and what they see
Legislative decree 122 of 10 June 2026 (published on 8 July, in force since 23 July 2026) transposes articles 11, 12, 13 and 15 of directive (EU) 2024/1640 and inserts articles 21-bis to 21-sexies into legislative decree 231/2007. For the authorities (art. 21-bis) — the finance ministry, the financial intelligence unit, the Guardia di Finanza, AMLA, the EPPO, OLAF, Europol — access is immediate, unfiltered, direct and free.
Obliged entities (art. 21-ter) need an accreditation from the competent chamber of commerce, valid two years, and must report any discrepancy between the Register and their own customer due diligence.
Legitimate interest (art. 21-quater) is the new door. The law presumes it for journalists on the professional roll, third-sector bodies and NGOs, professors and researchers, anyone in commercial or financial negotiations with you, obliged entities and authorities of third countries, administrations running the national recovery plan, contracting authorities and the anti-corruption authority; paragraph 4 leaves it open to anyone else demonstrating it case by case. Under paragraph 3 the first three groups and foreign authorities also obtain the five-year history, dissolved entities included, and the ownership structure. The procedure (art. 21-quinquies) closes within twelve working days; the access certificate is valid three years.
The shield, and its silence
Article 21-sexies is headed «Casi di esclusione dell’accesso», cases of exclusion from access. The chamber of commerce may exclude access, wholly or partly, in the presence of «circostanze eccezionali», exceptional circumstances: those exposing the beneficial owner to a disproportionate risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation, plus cases of legal incapacity or minority.
Here is the part that decides. The declaration accompanies the filing to the Register and gives a certified email address of the beneficial owner (paragraph 2): not a remedy to trigger when somebody knocks, but a document to lodge beforehand. It must set out a precise indication of the exceptional circumstances, explain how access would aggravate the risk, and come with the evidence and any supporting documentation (paragraph 3). The assessment is case by case, taking account in any event of the principle of proportionality between the alleged risk and the interest in access (paragraph 4).
Then paragraph 5, worth reading twice. The reasoned decision is served by certified email within twelve working days of the access request, and if no communication reaches the applicant in time «l’accesso si intende respinto» — access is deemed refused. Silence protects the beneficial owner, not the applicant: the opposite of what the habit of tacit consent suggests. Where access is granted instead, the Register opens no earlier than thirty days from receipt of the communication by the opposing party (paragraphs 5 and 6): the window to react, with the remedies of article 25 of law 241/1990 recalled by paragraph 7.
Three things to know. Exclusion does not operate against notaries, lawyers and other independent legal professionals — article 3, point 3, letter b, of regulation (EU) 2024/1624 — «quando operano come pubblici ufficiali», when they act as public officials (paragraph 8). Every 31 January the chambers of commerce report refusal statistics to the two ministries, and on to the European Commission: a recurring deadline. And paragraph 10 requires those records to be held separately, with measures ensuring «accessi selettivi», selective access, and making the data unintelligible to anyone not authorised to access them, through cryptographic techniques. Who really reads the data is not written in the impact assessment: it is written in the permissions.
The missing piece
Article 2 of decree 122/2026 sets three obligations, all within sixty days of entry into force: 21 September 2026. A Ministry of Enterprise decree updating the technical specifications for filing. The update of the technical rules under finance ministry decree 55 of 11 March 2022, subject to the data protection authority’s opinion. And, in any case subsequently to those two, a measure declaring the system of access to beneficial ownership data operational.
The first exists: the directorial decree of 23 September 2026, Business Register. Update of the decree of 18 October 2013 (Fedra 7.20), in Official Gazette no. 228 of 1 October 2026, page 33 — signed two days after the deadline. But its article 1, paragraph 2, provides that the specifications take effect from the date identified by the measure of the Ministry of Enterprise and Made in Italy under article 2, paragraph 4, of legislative decree 122 of 10 June 2026.
That measure, as at 3 October, does not appear to have been adopted. The scope of our check is a limit, not a proof: the general series of the Official Gazette from no. 221 of 23 September to no. 229 of 2 October, and the list of directorial decrees on mimit.gov.it, where the latest act is still that of 23 September itself. On the technical rules of paragraph 3 we assert nothing: we did not find them, and no source rules out their adoption.
What changes in the filing format
Annex A to that decree — published in the Gazette with a broken font character map, illegible on screen — introduces a new xsd format for the declaration of a beneficial owner opposing access, new automatic checks on the xml format, and new document-type codes for the declaration and for its supporting evidence. From the date it takes effect, filings prepared with the previous version remain acceptable for a maximum of sixty calendar days; after that, they are rejected.
In sequence: the procedure has existed in law since 23 July, the form for lodging it was approved on 23 September, and its effectiveness hangs on an act due 21 September that today does not exist. The time limits of article 21-sexies, meanwhile, are written and binding.
What to do now
Anyone with an exposed beneficial owner — by sector, country, litigation or threats — cannot wait for the measure to prepare the file. Establish who, in the group, is a beneficial owner and with which data they are registered. Gather the evidence of the risk, which paragraph 3 wants precise and documented, not merely asserted. Secure the beneficial owner’s certified email address: that is where the decision arrives and from there the time limits run. Map which of your counterparties already fall within article 21-quater, parties in negotiation included. In the industrial security clearance file the list of beneficial owners is already a living document: keeping two versions of it is the fastest way to get both wrong.
How we solve it
An obligation like this does not close with an opinion. It closes with a control that runs over the organisation’s own data: who is the beneficial owner of each entity in the group, what is on the register, when an accreditation expires, which evidence file supports the declaration — with the trail to produce for the chamber of commerce or an inspection. That is the first axis. The second is the one that matters: the same platform holds company extracts, corporate deeds, contracts, certified email, archives and management systems in a single operating model, on which AI agents run the checks and prepare the filings with an operator in command — for large enterprises, defence, public administration and healthcare. Two delivery modes: on-premise, on autonomous machines that need no deep integration into your network, or a dedicated cloud with data centres in Italy in premises we staff ourselves; in both cases with shared management, because nobody needs in-house staff administering AI models. Selective access and data encrypted against anyone unauthorised — what paragraph 10 imposes on the Register — are the same measures we require of a data protection platform.
If there is an exposed beneficial owner in your group, let us talk before the measure comes out.