Over the past week, our horizon scanning system flagged a material regulatory shift in Portugal that will impact how lending institutions carry out beneficial ownership verification.

Portugal has amended the rules for who can access its central register of company owners - known as the Registo Central do Beneficiário Efetivo (RCBE). This register lists the beneficial owners behind trusts and entities and is a key tool used by banks, law firms, and regulators.

Until now, anyone could look up this ownership information online through the RCBE. But under Decreto-Lei n.º 115/2025, public checks are withdrawn and only companies who can prove a “legitimate interest” will be allowed to access the data. This follows the Court of Justice of the European Union’s 2022 rulings that found unlimited public access to beneficial ownership registers disproportionate on privacy grounds.

This alters a core dependency in AML due diligence, requiring compliance teams to update their workflows.

Regulatory and operational implications:

1. Access to ownership data will change: Firms can no longer rely on the RCBE as their main source of beneficial ownership information during customer due diligence (CDD). Access will be restricted, so institutions must plan for restrictions or delays.
2. Procedural changes will be required: When requesting information from the RCBE, firms will now have to justify why access is needed and keep records explaining the purpose and proportionality of each request. Onboarding and review processes should be updated to include these steps.
3. KYC/AML policy updates required: Customer acceptance policies, KYC standards, and AML frameworks should be revised to reflect the new access rules. Firms will need to set out how they will verify ownership using alternative evidence if RCBE data cannot be obtained.
4. Regulators will expect adaptation: Supervisors won’t accept the loss of RCBE access as a reason to stop ownership checks. Firms will be expected to show how they continue verifying ultimate beneficial owners (UBOs) under the new restrictions, using other reliable sources where necessary.

At Zango, we categorised this update as high impact due to its effect on verification integrity, SLA risk in onboarding, and dependency risk within AML frameworks. This reform is part of a broader European pivot from open to controlled and traceable access to ownership data.

Regulatory change does not always add rules. Sometimes, it removes assumptions. This is one of those cases.