Liechtenstein’s Beneficial Owner Register Leak: What It Means for Foundations and Trusts

What happened to Liechtenstein’s beneficial ownership register

Liechtenstein’s register of beneficial owners, the VwbP, is kept at the Office of Justice and lists the people who ultimately stand behind companies, foundations and trusts. During the night of 29 to 30 July 2026, unknown attackers gained unlawful access to it and copied data relating to around 31,000 legal entities, the Government of Liechtenstein says (opens in a new tab). Initial forensic findings pointed to a targeted attack on that register, with no attack found on other systems.

The government took the register offline and notified the data protection authority of a personal data breach within the 72-hour deadline; the public prosecutor asked the court to open preliminary inquiries. On 2 October it announced (opens in a new tab) a limited reopening from 5 October 2026, with access only after users identify themselves in person; a comparison with backups had shown the data was not modified.

Rafael Cintron, who founded Wealthy Expat, draws one lesson in the video: if a country with Liechtenstein’s reputation for privacy can be breached, no single country should hold all of your wealth and all of your information.

What the register held, and what it did not

The register implements the European anti-money laundering directives, under which a beneficial owner is always a natural person: whoever ultimately owns or controls an entity, directly or indirectly. For a trust that means the settlor, the trustees, any protector, the beneficiaries and anyone else with ultimate control; for a foundation, the people in equivalent positions. A Liechtenstein foundation (opens in a new tab) is itself a legal person that holds the assets its founder dedicates to a purpose and to beneficiaries. Extra layers of companies do not take its owners off the register.

The government’s FAQ lists the data copied:

• For each legal entity: its name.
• For each beneficial owner: their role or roles, surname, first name, date of birth, nationality or nationalities, and country of residence.

Bank client secrecy and account, asset, transaction and advisory information are not affected, the government says, and no home address is among the fields it lists. Entities already deleted are among the 31,000, so a structure you have wound up may be included. No number of affected individuals has been given.

Why one country should not hold your whole life

A name, a date of birth and a country of residence are not a bank statement. Linked to a Liechtenstein structure, though, they could make a fraudulent call or email, apparently from your trustee, your bank or an authority, look credible. The exposure grows with concentration: when one country holds your residence, banking, structures and documents, one breach there reaches all of it.

Rafael’s answer in the video is diversification: residence and banking in more than one country and, where it fits, a further citizenship through a citizenship by investment program; Vanuatu, Turkey and São Tomé and Príncipe are among those he names. Diversification spreads where your life is held. It does not reduce what you report under the common reporting standard or anywhere else, and each country adds its own registers and checks.

Lawful privacy for a foundation or trust

Privacy and secrecy are different things. Registering the people behind a foundation or trust is a legal duty. Under Liechtenstein’s register law (opens in a new tab), authorities such as the financial intelligence unit and the tax administration can consult the register, and banks and other obliged entities can obtain entries for their due diligence. It is not public: anyone else must apply to the Office of Justice and credibly show that the data are needed to fight money laundering, its predicate offences or terrorist financing. Leaving a beneficial owner off it, or telling a bank less than the truth, is not privacy: it is the conduct these rules exist to stop.

The law also treats this data as sensitive. In November 2022 the Court of Justice of the European Union ruled invalid (opens in a new tab) the EU rule that information on the beneficial owners of companies and other legal entities must be accessible in all cases to any member of the general public, citing a serious interference with private life and data protection. Liechtenstein shows the other side of the risk: data kept for authorities and obliged entities can still be stolen.

In practice, answer every know-your-customer question fully and truthfully; as Rafael says in the video, if a form asks for all your citizenships, declare them all. You choose which institutions you work with, not whether to pass their legal checks. Beyond that, share less: ask what a provider needs and why, and in the EU and EEA use Article 15 of the GDPR to ask a company whether it holds your personal data and for a copy.

If you have a Liechtenstein foundation or trust

• Ask your trustee or foundation council whether your entity is among the 31,000, including any structure already wound up; the Office of Justice answers questions at vwbpfragen@llv.li.
• Treat any unexpected call, email or letter that uses your name, date of birth or structure with care, and confirm it through a contact you already hold before you act or pay.
• Keep your register entry accurate and current, as the law requires.
• Ask your adviser whether to apply for a restriction. If the entity proves that disclosure would expose a beneficial owner to a disproportionate risk, such as fraud, kidnapping, extortion or violence, or that the owner is a minor, the Office of Justice can limit what other obliged entities and third parties are shown: for five years, renewable, or for a minor until adulthood. Authorities and banks still see the entry.
• Review with your adviser what each bank, trustee and platform holds about you, and what it still needs.

Our guide to asset protection strategies sets out the wider, lawful picture. This article is general information, not tax or legal advice: take advice in each country involved. If another country of residence or citizenship belongs in your plan, our strategy assessment sets out the routes that fit.