Our Financial Services & Products Group outlines the nuances of the first of what will be three rules under the Corporate Transparency Act to create a fundamental shift in the focus of U.S. beneficial ownership information collection.

• “Reporting companies” will have primary responsibility for the first time
• But the term “reporting company” itself is subject to 23 separate exemptions
• Relief for banks from the burdens of the Customer Due Diligence Rule will not be coming for some time

On September 29, 2022, the Financial Crimes Enforcement Network (FinCEN) issued its long-awaited final rule for beneficial ownership information reporting, effective January 1, 2024. The rule is the first in a series of three to be issued pursuant to the Corporate Transparency Act (CTA), enacted as part of the National Defense Authorization Act for Fiscal Year 2021. The implementation of all three rules will create a fundamental shift in the focus of U.S. beneficial ownership information collection, placing primary responsibility on covered “reporting companies” for the first time, and close a long-standing gap in the U.S. anti-money laundering (AML) framework. However, as FinCEN makes clear in the preamble to the rule, the ultimate impact on financial institutions subject to the 2016 Customer Due Diligence (CDD) Rule—that have been laboring to collect beneficial ownership information since it became effective in 2018—is still unknown.

The key takeaways from the final rule are relatively straightforward, and as FinCEN notes, the rule was adopted largely as proposed. Reporting companies that existed before January 1, 2024 will have one year—until January 1, 2025—to file reports with FinCEN. Reporting companies created after January 2024 will have 30 days to file an initial report. The rule also implements 30-day deadlines for updates or corrections to information previously filed with the agency.

For this rule in particular, the devil is in the details. The rule’s core defined terms—“beneficial owner,” “ownership interest,” and “substantial control,” among others—are full of nuance. The term “reporting company” itself is subject to 23 separate exemptions. Rather than spell out each detail, we highlight a number of our key takeaways from the final rule.

• Relief for banks from the burdens of the CDD Rule will not be coming for some time. The CDD Rule must be revised within one year after the effective date of this final rule, meaning those changes may be delayed until late 2024, given FinCEN’s current staffing and budgetary limitations.
• Revisions to the CDD Rule may, in some ways, expand banks’ burdens. FinCEN has noted flaws in the existing CDD Rule. As one example, FinCEN labeled the CDD Rule’s requirement to collect information on only a single control person—rather than an unlimited number of persons exercising substantial control—as a shortcoming. FinCEN notes that it is specifically looking to “align” the CDD Rule with the rule in its future rulemaking. How potentially expanded information collection requirements will square with the CTA’s goal to reduce unnecessary or duplicative burdens on financial institutions is unclear.
• FinCEN is going to be busy before the January 2024 effective date. In a number of pertinent areas of the final rule, the agency indicated it would supplement remaining gray areas with additional guidance or FAQs. Given that the rule applies to many businesses outside the financial sector, there is a good chance that the agency will be inundated with questions, requests for clarification, and interpretations to specific factual scenarios. The extent that FinCEN addresses those questions, given its other priority work, is an open question.
• FinCEN notes that it intends its beneficial ownership database, BOSS, to be ready to receive reports and provide access “[a]ssuming adequate funding.” If FinCEN does not receive increased funding, it may be difficult for the agency to stand up the system by or on the effective date, which would, predictably, create issues for entities prepared to file on that date.
• The final rule made a few notable changes around the edges of the proposed rule:
  • Various filing deadlines set out in the rule have been harmonized to set 30-day standards across the board, extending some deadlines that had been set at only 14 days. This should reduce confusion and, importantly for covered reporting companies, missed deadlines.
  • FinCEN removed the proposed rule’s requirement that entities created before January 2024 report information on their “company applicant,” i.e., the person(s) who file or direct the filing of the documents that create or register the reporting company. This will reduce the burden on existing companies tracking down potentially old information.
  • The final rule specifies that the trigger for the reporting period for an initial report of a reporting company created after January 2024 is the earlier of the date (1) the company receives actual notice that its creation or registration has become effective; or (2) the secretary of state or similar office first provides public notice that the company has been created or registered. This change sets a clearer marker for the filing deadline.
  • FinCEN will require reporting companies to report all trade and d/b/a names, regardless of whether they are filed or registered with a relevant government authority. It is unclear how FinCEN will track whether these reports are comprehensive, since some of the names are not registered, but this should at a minimum increase the amount of information stored on each company.
  • In assessing the 20-employee element of the “large operating company” exemption to the “reporting company” definition, FinCEN shot down a request by commenters to consolidate employees across affiliated entities.
• FinCEN’s treatment of submitted comments also provides some insight into how the agency will oversee compliance with the regulation. These positions are likely to be carried over by other federal regulators overseeing AML compliance. As one example, FinCEN noted that it opted not to adopt a good-faith or other standard for the requirements to update or correct reports: the obligation on reporting companies is to “report accurately.” Similarly, FinCEN noted that it is inherent in the responsibility of identifying and reporting beneficial owners and company applicants that reporting companies do so “truthfully and accurately.” Thus, FinCEN reinforced that it is the reporting company, not the individuals, that has the ultimate burden to ensure the reports are correct and complete. FinCEN relayed its expectation that reporting companies will verify the information they receive from their beneficial owners and applicants before they report it.
• FinCEN rejected the notion that the exemptions to the term “reporting company” should be broad, noting that such a read could lead to loopholes used to evade the reporting requirements. The final rule cites CTA author Senator Sherrod Brown’s statement that the exemptions are intended to be “narrowly interpreted.” FinCEN notes that there is a “high bar” for additional exemptions, meaning the likelihood of the list expanding is slim, although the agency expressed an openness to hearing suggestions for additional exemptions.
• FinCEN notes in the preamble that control “exercised in novel and less conventional ways” can still be “substantial.” FinCEN specifically references this interpretation in discussing decentralized autonomous organizations. How these organizations comply with the rule—and how FinCEN monitors for compliance—remains to be seen, but it is likely that enforcing the rule on such entities will be challenging.
• FinCEN has, by its own admission, largely assumed that companies that do not fit the “large operating company” exemption (which requires at least 20 full-time employees) will have less complex ownership structures and, therefore, will have an easier time complying with the rule. Whether this assumption holds up in practice remains to be seen—various entity types are formed for specific corporate purposes, may be subject to complex ownership structures, and yet employ a workforce of less than 20.
• The significance of the impact of the rule in the context of the ever-increasing sanctions program against Russia and its oligarchs will be an important area to watch. FinCEN’s press release and the preamble to the final rule made no bones about singling out Russian oligarchs as a primary target for the disclosure obligations imposed by the rule. The ownership identification provisions around trusts in particular differ from the CDD Rule and will likely provide more insight into a common vehicle employed by Russian oligarchs that own property or other assets in the United States.
• As FinCEN notes in the preamble, the regulations permit individuals to be accountable for reporting violations. It is reasonable to assume that FinCEN or other federal agencies may lean on this authority, given the current focus on individual responsibility in the corporate world. While the regulation imposes a “willful” standard that eliminates negligence as a basis of liability, individuals owning, controlling, or acting on behalf of reporting companies will need to be cognizant of the rule’s requirements and ensure controls are in place to submit accurate and complete reports.

Although the January 2024 effective date may seem far away, entities should now begin thinking through whether they will be required to file a report or whether they will be subject to an exemption. If they are required to file a report, companies may have to do some digging to pull together all the information required to be filed. Any organizations looking to actively create new affiliates or vehicles after the effective date as part of their business operations should begin preparing to establish those new entities in compliance with the rule.

Banks and other financial institutions subject to the CDD Rule have longer to go before they will find out how much their compliance obligations in this area will change. However, given all the activity by their company customers that may be triggered in the lead-up to the rule’s effective date, they should be prepared for an influx of new due diligence information on their customers and, potentially, receipt of information that could change their risk assessment for some of them. Our team of attorneys has helped both bank and nonbank clients understand the scope of FinCEN’s rules; please reach out to any of the authors with any questions about compliance with the rule.

Download PDF of Advisory

[View source.]