Every sovereignty questionnaire asks who owns the supplier. Europe closed the register that answered it.
The Court of Justice struck down public access to beneficial ownership data in November 2022, on privacy grounds, and it was right to. The consequence is that the question now gets answered by the only party with no interest in answering it.

Item 14 on the questionnaire has two boxes. Is the supplier ultimately owned or controlled by an entity established outside the Union. Yes. No.
The supplier ticks no and attaches a register extract. The extract is genuine, current and issued by a public authority in a member state. It gives a company name, a legal form, a registered office, a registration number and the people entitled to sign. In most member states it does not give a shareholder, because the register was never built to hold one. It was built so a counterparty could establish who has authority to bind the company, which is a different problem, and one that was solved a long time ago.
So the extract is not evidence for the answer it has been attached to. It is evidence for a neighbouring answer, and it has been filed under item 14 by someone who was not trying to mislead anybody and had nothing better to send.
The court closed the one register that answered it
On 22 November 2022 the Court of Justice held invalid the provision of the anti-money-laundering directive that required member states to make beneficial ownership information available to any member of the general public. The reasoning is short and difficult to argue with. Publishing who owns what, to everybody, without conditions, is a serious interference with Articles 7 and 8 of the Charter, and the legislature had not shown it was strictly necessary.The judgment is correct. It is also the reason your supplier diligence got harder. Both of those are true and neither is a complaint.
The registers did not close. The unconditional door closed. Obliged entities doing anti-money-laundering checks kept their access, competent authorities kept theirs, and access for persons able to show a legitimate interest was left standing. What went was the route a procurement officer could use without explaining herself to anyone. Several member states then switched their portals off entirely rather than build a gate, which in my view was over-compliance, and which lasted.
The 2024 anti-money-laundering package puts the legitimate-interest route back on a Union footing and names the categories the legislature had in mind: press, civil society, academia. Whether a public buyer performing supplier diligence on a cloud framework has a legitimate interest in the beneficial ownership of a bidder is a question I have not seen answered anywhere I would be willing to cite. It is not obviously yes. The interest is real, and the list was drafted with somebody else in front of them.
The register can name a person who owns nothing
A beneficial owner is the natural person who ultimately owns or controls the company, and the directive's worked indication of that is a shareholding above a quarter. Where no such person can be identified after all possible means have been exhausted, the senior managing official may be recorded instead.
The fallback exists for defensible reasons — widely held companies, layered trusts, a genuine dead end — and it is reached considerably more often than the drafting suggests. The effect on your file is specific. A beneficial ownership entry can be a perfectly accurate record of a person who holds no shares in anything. The register is not misleading you. It answered the question it was asked, which was who should we write down.
The door that stayed open is the accounts
Nobody closed the accounts, and accounting consolidation follows control rather than nationality.
A subsidiary is consolidated into the accounts of the undertaking that controls it, and the test is a control test: a majority of the voting rights, the power to appoint or remove a majority of the board, dominant influence exercised by contract or under the articles. Article 22 of the Accounting Directive is where that test lives. Two consequences follow, and the second one is the useful one.
Control can be bought without shares, and company law has known it for longer than the cloud has existed.
First, a subsidiary's own filed notes must name the parent that draws up the consolidated accounts and say where those accounts may be obtained. That is a filing obligation, it is public, and it does not require you to have a legitimate interest in anything. Each set of accounts hands you the next name. The chain stops where the accounts stop being filed in the Union, and where it stops is itself an answer.
Second, dominant influence exercised by contract is in that test because the drafters already understood that control does not have to be bought with equity.
What a joint venture moves, and what it leaves where it was
A sovereign joint venture is a real thing and it moves real objects. The contracting entity, the share register, the employment contracts, the people who hold the keys. What it does not usually move is the technology licence, the support escalation path, and the undertaking to keep the platform at the same version as the platform it is a copy of. Ordinary commercial arrangements, all of them, none of them a feature, and every one of them the sort of thing the phrase dominant influence exercised by contract was written to catch.
Which gives you a check that costs an afternoon. If the venture is genuinely outside the foreign parent's control, that parent's own consolidated accounts will not consolidate it; it will sit there as an associate or an equity-method investment, or it will not appear at all. If it is consolidated, the parent's auditors have already formed a view on who controls it and published it. That view binds no court and says nothing about jurisdiction. It is one professional opinion on the ownership question, formed under a different set of rules, by people with no commercial reason to flatter the product.
There is also an instrument that compels a bidder to disclose its foreign financial links directly, in the tender, on pain of the bid being unusable. The foreign subsidies regulation sets its notification threshold by contract value, and the value is high. I have not checked the figure this month and am not going to print one, but it is not a threshold an ordinary cloud framework goes anywhere near, and it was not written with you in mind.
The extract has a date on it. The accounts have an older one. A change of control is filed after it happens, in every member state, and the months in between are where the interesting weeks live. The register records the last thing somebody filed. That is all it has ever claimed to do, and item 14 is asking it for considerably more.
Written from
Primary The document itself. Claims in this piece rest only on these.
- Joined Cases C-37/20 and C-601/20, WM and Sovim SA v Luxembourg Business RegistersThe judgment the second section rests on. Not opened for this draft. I am confident of the date, of the ground — Articles 7 and 8 of the Charter, and a failure to show strict necessity — and of the effect, which is that the provision requiring beneficial ownership data to be available to any member of the general public is invalid. Read the operative part before this runs, and check in particular that the piece has not overstated what survived: obliged-entity access, competent-authority access and legitimate-interest access were not before the Court in the same way.
- Directive (EU) 2015/849 as amended by Directive (EU) 2018/843, Article 3(6)(a)Source for the 25 per cent shareholding indication and for the senior managing official fallback, which is the load-bearing point of the third section. Not opened for this draft. The wording I have paraphrased as 'after having exhausted all possible means' should be checked and quoted exactly if it is quoted at all, because the whole paragraph turns on how demanding that phrase is.
- Directive 2013/34/EU, the Accounting Directive: the consolidation control test and the disclosures required in the notesThis is the mechanism the field guide depends on and it is the citation I am least sure of. I have given Article 22 as the location of the control test from memory and have not opened the consolidated text. The claim that a subsidiary's own filed notes must name the parent preparing consolidated accounts, and say where those accounts may be obtained, is stated in the body as a filing obligation; I have not verified which article imposes it, nor which size categories are exempted, and the exemptions matter. An editor should replace both article references with checked ones or cut the numbers and keep the mechanism.
- Regulation (EU) 2024/1624 and Directive (EU) 2024/1640, the anti-money-laundering packageCited for the restoration of a legitimate-interest route to beneficial ownership registers and for the categories the legislature named. No application date and no transposition deadline is printed here, because I have not read either instrument this month. Do not let anyone add one. The sentence saying nobody has established whether a public buyer's supplier diligence is a legitimate interest is deliberate and should survive editing.
- Directive (EU) 2017/1132, the system of interconnection of business registersBehind the description of what a cross-border register search returns. Not opened. No article number appears in the body for this reason. The claim that the returned data set does not include shareholders is from use of the e-Justice search rather than from the text, and should be characterised as such if it is tightened.
- Regulation (EU) 2022/2560 on foreign subsidies distorting the internal market, procurement chapterThe instrument that does compel disclosure of foreign financial contributions in a tender. The piece states that its threshold is set by contract value and declines to print the figure, which I have not checked. That omission is the honest version and it should stay an omission rather than becoming an approximation.
Reporting Attributed, not relied on. Where the reporting is the fact, it says so.
- Placeholder: coverage of member states suspending public register access after the November 2022 judgmentWould be attributed. Nothing in this piece rests on it. The characterisation of some closures as over-compliance is my own and is marked as an opinion in the text; if it is edited into a reported fact, it needs an outlet and a country attached to it.
Lead Pointed us at the story. Nothing here is cited as authority.
- Placeholder: launch material for sovereign cloud joint venturesWhere the story came from. Not cited, not relied on, and no company, country or venture is named anywhere in this piece. The consolidation observation in the fifth section is a method, not a finding about anybody. Nothing here should be edited into a statement that a named venture is or is not consolidated by a named parent without the accounts on the desk.