Switzerland's Transparency Register is scheduled to go live on October 1, 2026, cataloging the beneficial owners behind roughly 600,000 legal entities. But a cyberattack on neighboring Liechtenstein's nearly identical system has prompted Swiss wealth managers to question whether the launch should be delayed.

Hackers breached Liechtenstein's Register of Beneficial Owners, known as the VwbP, during the night of July 29-30, extracting personal data tied to approximately 31,000 legal entities. The compromised information included names, birth dates, nationalities, and countries of residence of the people behind companies, foundations, and trusts. No financial data was accessed.

What happened in Liechtenstein

Liechtenstein launched its VwbP in 2021 to comply with EU anti-money laundering directives. Authorities detected irregularities in the register on July 30, ending its period of secure operation. The Liechtenstein government responded quickly, taking the database offline and establishing a crisis unit led by Prime Minister Brigitte Haas and Justice Minister Emanuel Schädler. Officials were formally notified by July 31 or August 1. Public statements confirming the scope of the breach followed between August 2 and 4.

Why Swiss wealth managers are nervous

Switzerland and Liechtenstein are deeply intertwined when it comes to wealth management. Many Swiss clients use Liechtenstein-domiciled entities, particularly foundations and trusts, as part of their wealth structuring. The breach therefore does not only affect people in Vaduz; it also affects clients across the border in Zurich, Geneva, and other private banking centers.

Switzerland's own Transparency Register would function along similar lines to Liechtenstein's VwbP, collecting beneficial ownership data on the country's legal entities. The scale, however, is significantly larger, covering an estimated 600,000 entities compared to Liechtenstein's 31,000 — roughly 20 times the attack surface, a point that Swiss financial intermediaries are now emphasizing with urgency.

The wealth managers' argument is not that transparency is bad. Rather, they contend that launching a massive centralized database of sensitive personal information without ironclad cybersecurity is reckless. In their view, the Liechtenstein breach serves as a proof of concept for exactly the kind of attack that could target Switzerland's register on a far greater scale.

The debate plays into a broader European reckoning over who should be able to see beneficial ownership data at all. In November 2022, the Court of Justice of the European Union ruled that blanket public access to such registers violated privacy rights, restricting access to persons with a legitimate interest. That ruling reshaped how EU member states — and EEA countries like Liechtenstein — operate their registers, and it frames the current discussion in Switzerland over how strictly access to the Transparency Register should be limited once it launches.

The transparency vs. security tension

Beneficial ownership registers exist for a straightforward policy goal: making it harder to launder money by forcing disclosure of who actually controls corporate entities. Liechtenstein, while not an EU member, adopted the framework through its European Economic Area membership. The registries are part of a wider international push by bodies such as the Financial Action Task Force and the G20 to lift the anonymity that shell companies can provide.

The stolen Liechtenstein data, while not containing account balances or transaction histories, is far from harmless. Names and birth dates of beneficial owners, combined with their nationalities and residence countries, provide enough information for sophisticated social engineering attacks, identity theft, or even physical security threats against wealthy individuals.

How Swiss authorities respond to the wealth managers' concerns in the run-up to the October 2026 launch — whether with adjusted access rules, hardened security requirements, or a postponement — will signal how the country intends to balance its anti-money laundering commitments with the data protection expectations of its private banking sector.