On September 30, 2022, the US Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) published a final rule to implement the beneficial ownership information (BOI) reporting provisions of the Corporate Transparency Act (CTA), which was enacted as part of the Anti-Money Laundering Act of 2020 within the National Defense Authorization Act for Fiscal Year 2021.  The final rule responds to comments on the proposed rule published by FinCEN in December 2021, which was the subject of a prior blog post.

The final rule is intended to protect US national security and the US financial system by preventing and combatting fraud, corruption, money laundering, and terrorist financing, among other illicit activities, by parties seeking to hide money and other assets in the United States via shell companies and other opaque legal structures. The rule aims to provide essential information to national security, intelligence, and law enforcement agencies by requiring certain business organizations and entities to report information to FinCEN about the beneficial owners and controllers of such organizations and the individuals who have filed an application with specified government authorities to form the entity or register it to do business. The rule describes who must file a beneficial ownership information report, what information must be reported, and when a report is due.

The final rule has widespread application, and it is expected that an estimated 33 million entities will be subject to the new BOI disclosure rule when it becomes effective on January 1, 2024.

The final rule is largely in line with the proposed rule, but incorporates modifications that respond to comments FinCEN received and that are intended to minimize unnecessary burdens on reporting companies.  Before summarizing the new rule in detail below, here are a few key takeaways:

• Though not necessarily a direct impetus for the passage of the CTA or the BOI reporting provisions, Treasury opportunistically made the linkage between the final rule and recent increased efforts to target Russian elites that have benefitted from a perceived lack of transparency in using US corporate structures to evade sanctions, launder money, and engage in other illicit activities. It is safe to assume that DOJ, Treasury, the interagency Task Force KleptoCapture, and other enforcement agencies will use the new BOI reporting tool to aggressively pursue such actors in the future.
• The new rule is being positioned as a strong sign of US support for a growing international consensus, especially among US allies, for increased transparency regarding beneficial ownership information. It remains an open question just how much BOI information, and with whom, the US will be willing or authorized to share.
• To that point, FinCEN will engage in a separate rulemaking to establish rules for who may access BOI, for what purposes, and what safeguards will be required to ensure the information is secured and protected. Privacy and cybersecurity advocates, as well as reporting companies themselves, will have strong incentives to shape that rulemaking through the formal notice and comment process.
• Given the nature of the BOI reporting that will be required, it seems possible if not likely that the Committee on Foreign Investment in the United States (CFIUS) may use the new BOI reporting to analyze and identify scores of foreign ownership arrangements that were previously unknown and, if national security concerns are implicated, use its authorities to review and investigate such non-notified transactions.
• The new rule seeks to strike a balance among multiple statutory mandates under the CTA. These include ensuring that the information collected will be highly useful for national security, intelligence, law enforcement, and other lawful purposes (for example by establishing relatively short timelines for the required BOI reports), and minimizing burdens on reporting companies, including small businesses (for example by requiring somewhat less information about entities that were created before the rule’s effective date).
• Despite the fact that Treasury touts the modest cost of preparing and submitting an initial BOI report, it seems certain that the cost of compliance will increase substantially for many companies required to file BOI reports due to the parameters of the rule’s enforcement mechanisms, which target individuals with potential civil and criminal penalties for willful failures to report. This includes “senior officers”, a very broadly defined category of company officers not limited by official title, even if such persons lack any specific knowledge of the reporting failure.

“Reporting Companies”

With respect to US-organized entities, “reporting company” is defined to mean a corporation, limited liability company (LLC), or any other entity created by filing a document with the secretary of state of any state or a similar office of a state or tribal authority. Subject to the applicability of specific exemptions, reporting companies include limited liability partnerships, limited liability limited partnerships, business trusts, and most limited partnerships, in addition to corporations and LLCs.  The preamble states that general partnerships, sole proprietorships, and certain types of trusts which are not created through the filing of a document with a secretary of state would not be reporting companies.

Foreign reporting companies include corporations, LLCs, and other entities formed under the laws of a foreign country that are registered to do business in any US state or tribal jurisdiction by filing a document with the secretary of state of any state or a similar office.

In line with the exemptions prescribed in the CTA, twenty-three types of entities are exempt from the reporting rules, including publicly traded companies; larger private companies meeting certain requirements with respect to number of employees, revenue, and physical presence in the United States; and tax-exempt entities.  Many types of financial institutions already subject to FinCEN regulation are also exempt from the requirements.

“Beneficial Owners”

Reporting companies must report “beneficial owners,” which includes any individual who directly or indirectly either (1) exercises substantial control over a reporting company, or (2) owns or controls at least 25 percent of the ownership interests of a reporting company.

A reporting company may be structured such that multiple individuals exercise essentially equal authority over the entity’s decisions. Exercising substantial control or owning ownership interests through intermediate entities, conferring special rights in connection with a financial arrangement, issuing puts, call, straddles, or other options, and other circumstances may result in a multitude of individuals who may need to be reported as beneficial owners.

Individuals with “substantial control” are defined broadly to include: (1) senior officers of the reporting company (which includes the president, CFO, general counsel, CEO, COO and any other officer who performs similar functions regardless of title); (2) individuals with authority over the appointment or removal of any senior officer or a majority of the board of directors (or similar body); (3) individuals able to direct, determine, or have substantial influence over important decisions made by the reporting company; and (4) individuals with any other form of substantial control over the reporting company.  In a notable difference from FinCEN’s 2016 rule governing customer due diligence by US financial institutions (2016 CDD Rule), the BOI reporting rule is not limited to information on one individual with substantial control; the new rule requires the reporting of information on each individual who directly or indirectly exercises substantial control over the reporting company.

The rule provides standards and mechanisms for determining whether an individual owns or controls 25% of the ownership interests of a reporting company, including rules for aggregating all of an individual’s different types of ownership interests. The rule captures equity in the reporting company as well as other types of interests, such as capital or profits interests and convertible interests, warrants, rights, or other options or privileges to acquire equity, capital, or other interests.  Direct and indirect interests include joint ownership interests, interests held through another individual acting as nominee, custodian or agent, and interests held through ownership or control of intermediary entities.

With respect to trusts, reportable ownership interests include those of a trustee or any other individual with authority to control or dispose of trust assets; a beneficiary who is the sole permissible recipient of the trust’s income and principal or has a right to withdraw substantially all of the assets from the trust; and a grantor or settlor who has the right to revoke the trust or otherwise withdraw the assets of the trust.

The rule exempts certain individuals, including minor children (provided the information of the child’s parent or guardian is reported) until they reach the age of majority; individuals whose only interest is through a right of future inheritance; a creditor of the reporting company (unless perhaps if the rights of the creditor amount to an equity interest); an individual acting as nominee, intermediary, custodian, or agent on behalf of another individual (such as a tax lawyer doing work for a reporting company, including when such work is conducted under the authority of a power of attorney); and employees (other than senior officers) who exercise substantial control solely due to their employment status.

“Company Applicants”

Reporting companies created or registered on or after January 1, 2024 must also report “company applicants,” which is defined to include (1) the individual who files the document that forms the entity (or in the case of a foreign reporting company, the individual who files the document that first registers the entity to do business in the United States) and (2) the individual who is primarily responsible for directing or controlling the filing of the formation/registration document by another individual.

Reporting companies existing or registered prior to January 1, 2024 are not required to identify and report company applicants, but must still identify and report beneficial owners.

Information to Be Reported 

In addition to identifying information of the reporting company itself, the reporting company must provide, for each beneficial owner and company applicant required to be identified and reported, the (1) name, (2) birthdate, (3) address (in most cases, a residential street address), (4) a unique identifying number and issuing jurisdiction from an acceptable identification document (such as a non-expired passport or a US driver’s license or other state issued identification card), and (5) an image of such identification document.

Reporting companies and individuals may obtain “FinCEN identifiers” by submitting an application to FinCEN containing the information that a company would otherwise be required to provide. Individuals and entities with FinCEN identifiers may use that number for future FinCEN BOI reports, rather than providing the full suite of required information in each report.

When Must Reports be Filed?

A reporting company created or registered before January 1, 2024, will have one year from such date to file its initial report, while a reporting company created or registered on or after January 1, 2024 must submit its initial report no later than 30 days after the date it receives actual notice that its creation or registration has become effective (or, if earlier, the date on which a secretary of state or similar office first provides public notice of the reporting company’s formation or registration), a welcome change from the 14 day deadline originally proposed for newly created entities. Once the initial report has been filed, both existing and new reporting companies will have to submit updates within 30 days of a change in the required information previously submitted to FinCEN concerning the reporting company or its beneficial owners.  (Changes to previously reported information concerning a company applicant do not trigger the obligation to file an updated report.)  Errors in reports filed must be remedied by filing a corrected report within 30 days of becoming aware or having reason to know of inaccuracies in earlier reports.

Penalties for Reporting Violations

Per the framework set out by the CTA, willful reporting violations – namely, providing false or fraudulent BOI to FinCEN or failing to report complete or updated BOI to FinCEN as required under the rule – carry potential civil penalties of up to $500 per day that the violation continues or has not been remedied and criminal penalties of up to a $10,000 fine and up to 2 years in prison.

The final rule clarifies that penalties for reporting violations fall principally on individuals, directly and indirectly, not the reporting companies. Notably, in the case of failures to report complete or updated BOI on a reporting entity, this covers “senior officers” of the entity – a very broadly defined category of company officers, which includes the president, CFO, general counsel, CEO, COO, and any other officer who performs similar functions regardless of title – even if such persons lack any specific knowledge of the reporting failure. Such a penalty regime, coupled with the certifications on the reports and the continuing obligation to update the reporting promptly upon any change of relevant facts (such as a change in ownership or change in officer/board make-up or a reorganization of the company) constitutes a substantial new regulatory enforcement risk, which will likely increase associated compliance costs.

Individuals who provide false or fraudulent information to FinCEN indirectly, such as by providing such information to a reporting company for inclusion in a BOI report to FinCEN, can also be held liable for reporting violations.

The manner in which FinCEN and DOJ elect to pursue reporting violations, and the ultimate penalties assessed, will warrant careful monitoring. The preamble to the new rule states that the assessment of potential violations will depend on all the facts and circumstances, but “as a general matter, FinCEN does not expect that an inadvertent mistake by a reporting company acting in good faith after diligent inquiry would constitute a willfully false or fraudulent violation.”

What is Still to Come

FinCEN expects the vast majority of filings to be done electronically but must still publish the reporting forms that will be used to comply with the reporting obligations under the rule.

The timing of FinCEN’s expected rulemaking aimed at safeguarding the BOI being collected remains unclear.  The CTA also requires FinCEN to revise the 2016 CDD Rule within one year after the effective date of the BOI reporting rule (that is, by January 1, 2025), to align the 2016 CDD Rule with the new reporting and access framework for BOI, and to reduce any unnecessary or duplicative burdens on financial institutions and their legal entity customers.

FinCEN plans to develop infrastructure to administer the requirements of the rules in accordance with the security and confidentiality requirements of the CTA.

FinCEN’s ability to implement the new rule successfully, and complete all necessary steps by the effective date of January 1, 2024, will be dependent on adequate funding and additional appropriations, among other factors.