Pursuant to the adoption of comprehensive revisions to the U.S. anti-money laundering statutes as part of the Defense Appropriations Act of 2021 (the “Defense Act”)[1], on September 30, 2022, the Financial Crimes Enforcement Network (“FinCEN”) issued final regulations to implement revised “beneficial ownership information” (“BOI”) disclosure rules for legal entities (the “BOI Regulations”)[2]. Specifically, the BOI Regulations implement Section 6403 of the Corporate Transparency Act (the “CTA”)[3], which requires reporting companies, including corporations, limited liability companies and similar entities, to submit to FinCEN specified information identifying their beneficial owners—that is, the natural persons who own and control them—as well as information about the persons—termed “company applicants” and discussed in greater detail below—who form or register those corporate entities.

Subsequent to the issuance of the BOI Regulations, FinCEN issued related supplemental regulations clarifying how reported BOI will be shared with other governmental agencies such as law enforcement agencies as well as financial institutions.[4] In addition—and not a day too late—on January 1, 2024, FinCEN announced that its electronic reporting portal, termed the “BOSS,” discussed below, was now available for use by reporting companies.[5]

The BOI Regulations are a major departure from the current scheme of FinCEN’s regulations regarding the identification of the beneficial ownership of legal entities, which requires banks, other lenders and certain other financial intermediaries (defined as “financial institutions”) to obtain a limited amount of BOI prior to engaging in a financing transaction or opening an account relationship with a covered legal entity.[6] While these obligations will remain in place for the immediate future, the CTA creates the “Beneficial Ownership Secure System” (“BOSS”), a new federal BOI database. BOSS will contain confidential information provided directly from reporting companies to FinCEN, including updates, and will make that information available to certain federal, state, local and foreign government and law enforcement agencies and regulators, as well as to financial institutions that are currently subject to obtaining BOI pursuant to FinCEN’s CDD Rule.[7]

Importantly, the scope of reportable BOI has been substantially expanded, and by January 1, 2025, will require literally millions of existing smaller-sized legal entities to initially register directly with FinCEN—as well as each time a new reporting company is either formed or registered.[8] Further, a reporting company will be required to amend its filing with FinCEN whenever the reporting company determines that the BOI previously reported to FinCEN is no longer accurate.

This eUpdate summarizes the primary components of the BOI Regulations, including: (a) the legal entities that must file with FinCEN; (b) when filing must occur; and (c) the information that must be provided in the filing. In addition, this eUpdate provides observations regarding the impact the BOI Regulations may have on the U.S. anti-money laundering (“AML”) compliance process.

For ease of discussion, the summary will be divided as follows:

• Coverage under the BOI Regulations;
• Timing requirements for filing initial reports and amended reports;
• Required information to be filed about a reporting company and its BOI;
• Special disclosure requirements regarding “company applicants”; and
• Comments and observations regarding compliance.

Reporting Requirements for Covered Legal Entities

The BOI Regulations establish two categories of reporting companies that must file reports with FinCEN—“Domestic Reporting Companies” and “Foreign Reporting Companies.” However, in addition to imposing the obligation on reporting companies to file and amend required reports, the BOI Regulations also identify several critical persons and entities that are substantially impacted by the requirements of the BOI Regulations, and whose individual identification data must be included in a filing by a reporting company: beneficial owners and company applicants.

Each is discussed separately below.

Domestic Reporting Companies and Foreign Reporting Companies

Subject to exemptions, discussed below, a Domestic Reporting Company is any entity that is created under state or federal law by the filing of a document with a Secretary of State’s office (or similar office), including a comparable office operated by an Indian Tribe (a “Secretary of State”).[9]

A Foreign Reporting Company is any entity formed under the law of a foreign (i.e., non-U.S.) jurisdiction that is required to be registered to do business with a Secretary of State.[10]

As defined by the BOI Regulations, the range of legal entities that are covered by the CTA is extremely broad, and includes corporations, limited liability companies, statutory trusts and other similar legal entities created by the filing or registration of a document with a Secretary of State. However, because the intent of the CTA is to capture BOI for legal entities whose ownership and management is not otherwise available, the following 23 exemptions[11] are available for those legal entities whose ownership information is either already publicly available or readily obtainable:

• SEC reporting issuers;
• Governmental authorities;
• Banks;
• Credit unions;
• Depository institution holding companies;
• Money services businesses (i.e., money transmitters);
• Securities exchanges or clearing agencies;
• Other Exchange Act registered entities;
• Investment companies or investment advisers;
• Venture capital fund advisers;
• State-licensed insurance producers;
• Commodity Exchange Act registered entities;
• Accounting firms;[12]
• Public utilities;
• Designated financial market utilities;
• Pooled investment vehicles;
• Tax-exempt entities;
• Certain entities that provide services to tax-exempt organizations;
• Large operating companies^;[13]
• Subsidiaries of certain exempted entities;[14] and
• Inactive entities.[15]

As noted in the BOI Regulations, FinCEN estimates that approximately 5 million covered legal entities are created each year that would qualify as a reporting company (i.e., not exempted). Further, all existing legal entities not otherwise exempted as of the effective date of the BOI Regulations (i.e., January 1, 2024) will likewise be required to register with FinCEN and provide BOI within 1 year of the effective date (i.e., by January 1, 2025). FinCEN estimates that the number of covered reporting companies in this category exceeds 30 million entities.[16]

Beneficial Owners

As compared to the CDD Rule regarding the collection of BOI, the definition of the term “beneficial owner” under the BOI Regulations is the most significant change—and perhaps presents the greatest compliance challenge for reporting companies. This is because the requirement by a reporting company to identify a beneficial owner will now include not only all individuals who own or control 25% of more of the ownership interests in a reporting company, but also all individuals who hold the authority to cause the adoption of major corporate and operational decisions at a reporting company. This is due to the revised definition of a beneficial owner, which states:

Beneficial owner. For purposes of this section, the term ‘‘beneficial owner,’’ with respect to a reporting company, means any individual who, directly or indirectly, either exercises substantial control over such reporting company or owns or controls at least 25 percent of the ownership interests of such reporting company.[17]

The import of this definition is that, unlike the current CDD Rule, the BOI Regulations now require that a reporting company identify not only all individuals who own or control 25% of the “ownership interests” in a reporting company, but all individuals who exercise substantial control over a reporting company. Further, unlike the CDD Rule which requires a disclosure to a financial institution, potential liability will be increased because a reporting company will be required to provide BOI directly to the federal government (i.e., to FinCEN).

In regard to an individual owning a 25% or greater ownership interest in a reporting company, the BOI Regulations create layers of analytic complexity in regard to determining what constitutes a direct or indirect ownership interest—which is measured beyond a mere computation of equity ownership in a reporting company, and includes:

• Any equity, stock, or similar instrument (without regard to whether the instrument is transferable, is classified as stock or anything similar, or confers voting power or voting rights);
• Any capital or profit interest in a reporting company;
• Any instrument convertible, with or without consideration, into any share or instrument in the two categories above (and regardless of whether the instrument is characterized as debt);
• Any put, call, straddle, or other option or privilege of buying or selling any of the foregoing; or
• Any other instrument, contract, arrangement, understanding, relationship, or mechanism used to establish ownership.

To emphasize the expansive nature of an ownership interest that is intended, the BOI Regulations indicate that direct or indirect ownership may include: (a) joint ownership of an undivided interest; (b) ownership through another individual acting as an nominee or similar intermediary; (c) ownership through a trust (including a trustee or a settlor or beneficiary of a trust if that individual holds the authority to direct certain activities of the trust); and (d) ownership through one or more intermediary entities.[18]

Unlike the current CDD Rule, the BOI Regulations require that a reporting company identify every individual who exercises “substantial control” over a reporting company, which includes an individual who:

• Serves as a “senior officer” of the reporting company (and FinCEN has indicated that “senior officer” includes the president, chief financial officer, general counsel, chief executive officer, chief operating officer, and each other officer performing a similar function);
• Has authority over the appointment or removal of any senior officer or a majority of the board of directors (or similar body); or
• Directs, determines, or has substantial influence over “important decisions” made by the reporting company.[19]

As a clear indication that the substantial control factor is not limited to individuals holding a formal position at a reporting company, the term “important decisions” includes an individual that directs, determines, or has substantial influence over important decisions made by the reporting company, including decisions affecting:

• Major aspects of the business, including the sale, lease, mortgage, or other transfer of principal assets of the reporting company;
• The reorganization, dissolution, or merger of the reporting company;
• Expenditures or investments, including the issuance of any equity or debt, or approval of the operating budget of the reporting company;
• The selection or termination of business lines or ventures, or geographic focus, of the reporting company;
• Compensation schemes and incentive programs for senior officers;
• Significant contracting activities of the reporting company;
• Amendments of any significant governance documents of the reporting company; or
• Any other form of substantial control over the reporting company.[20]

Company Applicants

The BOI Regulations define a “company applicant” as “an individual that either directs or controls the creation or registration of a reporting company.”[21] This would include, for example, an attorney at a law firm that directs and supervises the incorporation or formation of a new corporation, limited partnership, statutory trust or limited liability company through a subordinate employee. Companies or legal entities cannot be company applicants.

As originally proposed in the rulemaking process, the BOI disclosure scheme would have required that a reporting company identify its “company applicant” and provide information regarding that individual or entity. In the public comments to the proposed BOI regulations, strong concerns were raised by law firms and other potential covered parties regarding this requirement. In a compromise responding to these concerns, the BOI Regulations limit the identification of company applicants to reporting companies formed or registered on and after January 1, 2024—meaning that the estimated 30 million reporting companies already in existence as of January 1, 2024 are relieved from this reporting requirement when filing their initial reports.[22]

The term “company applicant” refers to the individual or individuals that are responsible for forming or registering a reporting company, and states:

• For a Domestic Reporting Company, the individual who directly files the document that creates the Domestic Reporting Company;
• For a Foreign Reporting Company, the individual who directly files the document that first registers the Foreign Reporting Company; and
• Whether for a Domestic or a Foreign Reporting Company, the individual who is primarily responsible for directing or controlling the filing if more than one individual participates in the filing of the document.[23]

The import of the third formulation above is that frequently there will be two individuals who will fall into the definition of a company applicant: (a) a senior official or agent directing the incorporation or registration project; and (b) the individual actually making the filing. For example, this means that, in the case of law firms or in-house law departments, a supervising lawyer and a junior lawyer, paralegal or other ministerial employee will need to be identified as company applicants for reporting companies formed or registered on and after January 1, 2024. FinCEN has confirmed that a maximum of two company applicants may be identified for each reporting company.

Timing Requirements for Filing Initial and Amended Reports

Under the BOI Regulations, the time at which a required report is due by a reporting company is based upon: (a) the date the reporting company was created or registered; and (b) whether the report is an initial report, an updated report providing new information or a report correcting erroneous information in a previous report.

Domestic Reporting Companies and Foreign Reporting Companies created or registered to do business in the U.S. prior to January 1, 2024, will have until January 1, 2025, to file their initial reports with FinCEN.[24]

Domestic Reporting Companies and Foreign Reporting Companies created or registered to do business in the U.S. in the calendar year 2024 will be required to file their initial report with FinCEN within 90 calendar days of the date on which they are created or registered, respectively (and from January 1, 2025 onwards, this deadline is shortened to 30 days).[25]

Finally, in regard to all reporting companies, the BOI Regulations impose subsequent filing requirements. First, when there is a change in the information previously reported to FinCEN, a reporting company would have 30 calendar days to file an updated report. For example, this filing obligation would arise if the ownership or management prongs of the beneficial ownership tests changes.

Second, if a reporting company determines that it filed information that was inaccurate at the time of the filing, the reporting company would have to file a corrected report within 30 calendar days of the date it knew, or should have known, that the information was inaccurate.[26]

Information Required to be Provided or Amended

A reporting company must file two general categories of information: (a) detailed information regarding the reporting company and its company applicant; and (b) BOI identifying individuals owning or controlling a 25% or more ownership interest, and management individuals holding the authority to direct the operations of the reporting company.

Reporting Company Information

In regard to general information to be filed by a reporting company concerning its own corporate existence and operations, information that must be provided in an initial report includes:

• The full name of the reporting company;
• Any trade name or ‘‘DBA” name of the reporting company;
• The business address of the reporting company;
• The State or Tribal jurisdiction of formation of the reporting company (or for a Foreign Reporting Company, the State or Tribal jurisdiction where the Foreign Reporting Company first registers); and
• A unique identifier associated with the reporting company, such as an IRS TIN or EIN.[27]

Beneficial Owner Information

In regard to a beneficial owner, the following information must be provided:

• The full legal name of the beneficial owner;
• The date of birth of the beneficial owner;
• The complete current address of the beneficial owner; and
• A unique identifying number of the beneficial owner, such as a passport, governmental ID or driver’s license (including a photo of the individual).[28]

Company Applicant Information 

In the case of a reporting company formed or registered on and after January 1, 2024, the following information must be filed by a reporting company for a company applicant:

• The full legal name of the company applicant;
• The date of birth of the company applicant;
• The complete current address of the company applicant; and
• A unique identifying number of the company applicant issued by an approved source, such as a passport, governmental ID or driver’s license (including a photo of the individual).[29]

Penalties for Non-Compliance

The CTA makes it a federal crime to file false reports regarding a reporting company. Paraphrasing the language in the CTA, it states:

• It shall be unlawful for any person to willfully provide, or attempt to provide, false or fraudulent beneficial ownership information, including a false or fraudulent identifying photograph or document, to FinCEN or willfully fail to report complete or updated beneficial ownership information to FinCEN; and
• Any person that commits a violation: (i) shall be liable to the United States for a civil penalty of not more than $500 for each day that the violation continues or has not been remedied; and (ii) may be fined not more than $10,000, imprisoned for not more than 2 years, or both.

The BOI Regulations state that “each person filing such report or application shall certify that the report or application is true, correct, and complete.” Further, the BOI Regulations clarifies that liability may apply to a person who provides required information through another person—which impliedly includes BOI and related data required to be assembled and filed by a reporting company.[30]

Compliance Comments and Observations

We offer the following comments and observations.

First, from the viewpoint of existing reporting companies (i.e., companies formed or registered prior to January 1, 2024), there will likely be an informational gap that will prove challenging. Many smaller companies and entities rely on third parties to perform organizational tasks such as the filing of charter documents, and frequently technical compliance is more aspirational in nature than the reality of technical corporate compliance. For example, this may mean that the relationship between this category of a reporting company and its company applicant may by necessity have to be expanded (or revisited) to include ensuring that the company applicant provides (or assists) the reporting company in the filing of an initial report and any subsequent reports to FinCEN.[31]

Second, particularly for reporting companies such as companies that are formed or registered on and after January 1, 2024, several consecutive amended reports may be required following the filing of an initial report. This is because, for reporting entities employed for many typical commercial purposes, the organization of a legal entity such as a corporation proceeds in several steps, including: (a) initial formation; (b) board of director and similar organizational actions; (c) structuring of management; and (d) one or several rounds of capital raising. If one or several of these and related stages of a reporting company fall outside of the initial 90-day period or subsequent 30-day reporting periods, amended reports will be required.

Third, the BOI Regulations create a complicated (and potentially burdensome) analytical scheme for calculating the aggregate ownership interests of a reporting company and for each possible beneficial owner. Besides computational rules that do not necessarily comply with accounting related to corporate ownership, a reporting company may be subject to engaging in legal and contractual reviews of investor entitlements that may be beyond the capability of the management of a small corporate entity.[32] Further, as the capitalization and operations of a reporting company expands, obtaining and evaluating ownership interests may prove increasingly problematical.[33]    

Finally, despite repeated requests for clarification of identified ambiguities in the BOI Regulations, as well as acceptable analytical approaches to BOI computations, FinCEN has been unwilling to issue any substantive (i.e., useful) interpretative guidance except to parrot the language of the BOI Regulations. For example, clarity will be required from FinCEN regarding the degree of due diligence that will be required to identify data to be reported, as well as the degree of reliance that a third party (e.g., a law firm or accounting firm) may rely upon when analyzing the BOI and assisting in the preparation of an initial report and amended reports.

This reluctance on the part of FinCEN in the minimum will require reporting companies for the next several years to closely monitor interpretative announcements by FinCEN and consider whether amending previously filed reports will be necessary.

*       *       *

This eUpdate is an updated version of a previous summary of the BOI Regulations. Future eUpdates will address developments in the implementation of the BOI Regulations.