Directive 2024/1640 and the Challenge of Legitimate Interest

Executive Summary

The European Union has completed its most ambitious reform to the prevention of money laundering with the approval of a new legislative package, the centrepiece of which is the Sixth Anti-Money Laundering Directive (AMLD6) and Directive (EU) 2024/1640.

This regulation redefines who can access confidential company information and centralises financial supervision throughout Europe. The structural change comes about with the launch of the Anti-Money Laundering Authority (AMLA). This agency, which has been operational in Frankfurt since July 2025, now exercises direct supervisory powers over high-risk entities, removing the complete autonomy of national regulators to ensure a seamless single market.

Regulatory context

Directive 2024/1640 is not an isolated measure, but replaces the 2015 directive and is integrated into a single European regulation designed to unify compliance rules across the 27 Member States. The aim is to close regulatory loopholes and ensure that money laundering is treated as a serious crime throughout the European Union, with harmonised definitions and effective sanctions, while also strengthening coordination between Member States to prevent any part of the common market from becoming a refuge for financial crime.

The situation in Spain: the RCTIR

In this regard, Spain has a more developed regulatory framework than some other Member States, although this does not mean that the system is fully operational. In response to the opacity detected by the European Commission in various national registers, the Spanish legal system has permitted the creation of the Central Register of Beneficial Ownership (RCTIR), regulated by Royal Decree 609/2023, which is intended to centralise information on the beneficial owners of all Spanish legal entities, as well as foreign entities operating in or from Spain. However, the RCTIR is not yet fully operational, although Obligated Parties may currently register and request access.

Legal criterion: The challenge of legitimate interest

The mission to harmonise rules and centralise information on beneficial ownership, as intended with the RCTIR and its European counterparts, came up against a fundamental legal challenge: data protection and privacy.

To understand the legal significance of this Directive, we must refer to the ruling of the Court of Justice of the European Union (CJEU) of November 2022 in the joined cases WM and Sovim SA (C-37/20 and C-601/20).

Until 2022, European legislation allowed access to the register of beneficial owners to be public for ‘anyone’. The CJEU invalidated this provision, ruling that indiscriminate public access disproportionately violated the fundamental rights to privacy and data protection (GDPR) of entrepreneurs.

To comply with the ruling without sacrificing transparency, the new Directive introduces the unified concept of Legitimate Interest. There is no longer universal access, but rather legitimate interest will be determined on a case-by-case basis, except in the following cases where it will be presumed:

Journalists and media acting for the purposes of preventing money laundering and terrorist financing;

Civil society organisations (NGOs and academics) dedicated to the fight against financial crime;

Those seeking to conduct commercial transactions while avoiding links to ML / TF; and

PBCFT service providers that supply information to obliged entities or competent authorities.

Key Milestones and roadmap for adaptation in Spain

The compliance roadmap is rolled out on the following key dates, when Spain must adapt its access regulations (RETIR) to facilitate consultation by new legitimate actors:

July 2024 (Entry into force): The regulations are now official and companies must review the accuracy of their beneficial ownership data, anticipating greater scrutiny.

July 2025 (AMLA Operational): The European agency in Frankfurt began operations. If your company operates in the financial sector or has a high cross-border risk profile, supervision could shift from Madrid (SEPBLAC) to Frankfurt.

July 2026 – 2027 (Full Transposition): Deadline for Spain to fully integrate the rules on access for legitimate interest. Although our register already exists, it will have to streamline procedures so that journalists and NGOs can consult data without bureaucratic obstacles, increasing the public exposure of corporate structures.

July 2029 (Real Estate Transparency): Deadline for centralised access to the beneficial ownership of real estate. Opaque asset structures that own real estate assets will definitively lose their anonymity vis-à-vis the European authorities.