Overseas entities register: trust data now one request away

Trust privacy behind a UK-property holding vehicle no longer rests on secrecy. It rests on how each person was classified when the entity filed, and on whether the entity's records still match that filing. Since 9 July 2026 a stranger making a single-entity request, for information that does not concern a minor, needs only the entity's name and its Companies House identification number (ID) to ask for the protected trust data. The trust's name stopped being a barrier on that date.

It is easy to read the 2025 regime as opening trust data to legitimate-interest applications only. The instrument does not say that. Regulation 4(1) of the Register of Overseas Entities (Protection and Trusts) (Amendment) Regulations 2025 lets the registrar disclose relevant protected trusts information on application, to any person. A legitimate-interest test applies only in two cases, covered below. Owners who assume otherwise underestimate their exposure.

The rule as made: what changed on 9 July 2026

The Register of Overseas Entities (Protection and Trusts) and Limited Liability Partnerships (Application of Company Law) (Amendment) Regulations 2026, statutory instrument 2026 No. 778, were made on 8 July 2026. Regulation 1(2) says they come into force on the day after the day on which they are made. That gives 9 July 2026.

The Register of Overseas Entities (ROE) was created under the Economic Crime (Transparency and Enforcement) Act 2022. Section 22 of that Act, as substituted by the Economic Crime and Corporate Transparency Act 2023, defines "protected trusts information". The section bars the registrar from making that material available for public inspection. Section 23(3) defines "relevant protected trusts information" as the same material minus the day of the month of an individual's birth and their usual residential address. Section 23(2) lets the Secretary of State make regulations requiring disclosure on application.

The 2025 regulations were made on 24 February 2025. Part 3, containing regulation 4, came into force on 31 August 2025. Regulation 4(3)(d) required each application to include the trust's name alongside the entity's name and ID. Regulation 3 of the 2026 instrument removes sub-paragraph (d). The trust name is not on the public register, so the old requirement worked as a guess-the-name lock. The explanatory memorandum to the draft instrument records, at paragraph 5.12, that Companies House could not release trust information when the name was not supplied. That lock has gone.

Two other changes sit in the same regulation. A replacement regulation 4(2) keeps the legitimate-interest test for requests covering more than one overseas entity, or information about a person under 18. A new regulation 4(2A) says that where only some of the information relates to someone under 18, the test does not block disclosure of the rest. On the wording of the 2025 regulation, before 9 July 2026 one 16-year-old beneficiary could put the whole trust file behind the test. Now only the minor's data is.

Why the legitimate-interest test is less protective than it looks

The test applies to a multi-entity request or a minor. The evidence it demands under regulation 4(3)(f) is proof of an investigation into money laundering, tax evasion, terrorist financing or breaches of sanctions, plus statements of purpose and intended use. A single-entity request meets none of those conditions. One reading is that an applicant who wants data on several entities can sidestep the test by filing separate single-entity applications. We found nothing in the regulations that aggregates related applications. That is a reading of the text, not a statement from Companies House.

The Companies House fees page, last updated on 25 September 2026, lists the application for trust information for a single overseas entity at £55, online only. A worked example shows what that means. Take a family that holds twelve UK properties through twelve overseas entities, each linked to its own trust. An opposing party in a dispute wants the beneficiary details. Before the 2026 amendment they needed the name of each trust, which is not on the public register. Now they need twelve entity names and twelve IDs, which appear on the public register. At £55 each, twelve single-entity applications cost £660 in fees. On the text, regulation 4 requires none of them to show an investigation or any connection to the family, unless a minor's data is involved.

The registrar keeps some discretion. Regulation 4(5) allows refusal where disclosure could prejudice a criminal investigation or harm national security, where required information is missing, or where information must be omitted under regulations made under section 25. Regulation 4(8) allows conditions on use and onward disclosure. Paragraphs (9) and (10) make breach of a condition an offence punishable by a fine on summary conviction. These are real controls on what the recipient does with the data. They are not controls on who gets it.

Classification is now the only lever left

If access is open and cheap, the remaining question is what the register holds about each person and under what label. Three points follow.

First, check which individuals appear as beneficial owners or managing officers and which appear only as trust participants. Sections 22 and 23 of the 2022 Act treat trust-participant detail as protected from public inspection, but disclosable on request. A person recorded as a registrable beneficial owner is recorded in the public part of the register, except for items protected under section 22, such as the date of birth and residential address. A beneficiary the trust deed names but the filing leaves out is a different problem: an omission may be a filing failure, and it is not a privacy strategy.

Second, check whether a protection application exists for anyone at genuine risk. Section 25 of the 2022 Act, as substituted by the Economic Crime and Corporate Transparency Act 2023, lets regulations require the registrar to keep information about individuals off public inspection. Legislation.gov.uk records the substitution as in force from 26 October 2023 for specified purposes. The Companies House fees page lists the application to make information about a relevant individual unavailable for public inspection at £100. We do not set out the grounds here, because they sit in secondary regulations we did not review for this piece. Owners considering an application should read those grounds before filing, not rely on a summary.

Third, note the 2026 changes to protection applications, which moved in parallel. Regulation 2 of the 2026 instrument amends regulation 7 of the Register of Overseas Entities (Delivery, Protection and Trust Services) Regulations 2022. Supporting evidence is now required only for applications on the grounds in regulation 7(3)(a) or (c). An applicant relying on regulation 7(3)(b) must give a service address to replace the usual residential address on the register, unless the entity has left the register or the individual no longer holds the relevant role. We do not set out what each ground covers, so read regulation 7(3) before filing.

The audit to run before someone else requests the file

The sequence matters because a request will not announce itself in advance. Burges Salmon reported the revised draft regulations being brought before Parliament on 1 June 2026, so the direction of travel was public for about five weeks before the instrument was made.

• Pull the public record for each entity and note every named individual and the capacity in which they appear.
• Compare the trust section with the current trust deed, any letters of wishes, and the last update statement. A beneficiary class that has changed since the last filing is a risk in both directions.
• Identify any beneficiary under 18. After 9 July 2026 the rest of the file can be released without a legitimate-interest showing.
• Decide, individual by individual, whether a protection application is justified on the grounds in the regulations, and budget £100 for each (fee as at 25 September 2026).
• Agree who at the trustee or the entity's filing agent monitors the entity's record. Regulation 4 provides for notice to an unsuccessful applicant, and we found no provision requiring notice to the entity or the trustee, so an owner may not learn that a request was made.

The regime still has two honest limits. The data is only as good as the filings, and Companies House can refuse or condition a release. Neither is a privacy plan. The practical conclusion is that trust confidentiality for UK property now depends on what was filed about each person, and how.