Under the US Corporate Transparency Act (CTA), which became effective January 1, 2024, most domestic companies and some foreign companies doing business in the United States will be required to disclose personal identifiable information (e.g., a passport) regarding the beneficial owners and individuals who file corporate paperwork on the company’s behalf. The information must be disclosed to the US Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN). These Beneficial Owner Information (BOI) reports will not be public and will only be available to law enforcement, state, and local government agencies with a court order, as well as federal financial regulators and financial institutions with consent of the reporting company.
Simply put, the CTA will now require for the first time that most private US companies and some foreign companies disclose to the federal government personal identifiable information regarding who owns and/or controls the entity.
The obligation to report BOI began on January 1, 2024. Entities created prior to January 1, 2024, have until January 1, 2025, to file a BOI report. Entities created on or after January 1, 2024, have 90 days to file a BOI report. BOI reports are filed electronically through FinCEN’s website.
BACKGROUND
The Bank Secrecy Act of 1970 has long required financial institutions to identify and verify the beneficial owners of legal entity customers as part of its anti-money laundering (AML) and customer due diligence (CDD) compliance programs. (Other existing federal AML disclosure rules requiring beneficial owner information disclosure include Geographic Targeting Orders, the Enablers Act, the Anti-Money Laundering Act of 2020, and the Illicit Cash Act.) In January 2021, Congress enacted the CTA, which is additional federal legislation for collection of BOI for legal entities formed or registered under US state corporate laws.
The stated purpose of the CTA is to stop criminals from concealing their ownership in legal entities used to conduct illicit activity, including money laundering, terrorist financing, tax evasion, and other criminal activity. Congress recognizes that BOI is sensitive and will not make this information publicly available. The BOI information will be directly available only to authorized government authorities and financial institutions for customer due diligence purposes.
The law is extremely broad and far reaching, subjecting nearly all private companies to this federal disclosure requirement. That said, this same BOI has been required to be collected by banks and financial institutions as part of their CDD and AML compliance programs for decades and should not be viewed as a major new government invasion of privacy. The CTA does impose burdensome recordkeeping, filing, and compliance requirements.
The CTA imposes costly civil and criminal penalties for non-compliance. Accordingly, reporting companies should work with their professional advisors to comply with the CTA as soon as reasonably possible in 2024.
DISCUSSION
The CTA, codified as 31 U.S.C. § 533, sets out the statutory scheme for establishing the BOI disclosure requirements. Additionally, FinCEN issued detailed regulations and regulatory analysis on September 30, 2022 (see 31 CFR part 1010) and information on their website (see www.fincen.gov/boi).
The CTA requires legal entities including corporations, limited liability companies, limited partnerships, and other similar organizations to report identifying information about the individuals who directly or indirectly own or control the company. In addition, the CTA requires filing information about the entity and the company applicants who filed corporate documents to form or register a company with a secretary of state (including foreign companies). There are certain entities that are exempt from the BOI reporting including publicly traded companies, nonprofits, and certain large operating companies.
Who is Required to Report?
The CTA defines a reporting company as a corporation, limited liability company, statutory trust, or similar legal entity created or registered to do business by filing an application with the secretary of state under the law of a US state or Indian tribe. An example of a state agency is the Delaware Division of Corporations. Reporting companies can include both domestic and foreign entities if they are registered to do business in a US state.
Certain entities are “out of scope” of the CTA; these include sole proprietorships, general partnerships, unincorporated associations, certain trusts, and a foreign entity not registered to do business in a state or Indian tribe. In addition, there are 23 statutory exemptions including large operating companies, banks, financial services firms, securities companies, insurance companies, tax-exempt entities, and accounting firms registered under Sarbanes Oxley.
What Does “Beneficial Owner” Mean?
The CTA defines a beneficial owner as an individual that exercises “substantial control” over the entity or owns or controls not less than 25% of the ownership interests of the entity. The definition carves out minors, nominees, employees, inheritors, and creditors. Reporting by estates, trusts, trustees, grantors, settlors, and beneficiaries can create particular challenges.
What Does “Company Applicant” Mean?
Company applicants are the professionals or employees who filed the corporate documents to form or register a company with a secretary of state (including foreign companies). Only a domestic company created on or after January 1, 2024, or a foreign company that first registered to do business in the United States on or after January 1, 2024, is required to report its company applicants.
What Information Gets Reported and When?
The following information will be reported to FinCEN on a BOI report:
- Reporting Company – Name, DBA name, address, jurisdiction, and tax identification number.
- Beneficial Owner – Name, date of birth, residential address, and an unexpired photo ID or passport.
- Company Applicants – Name, date of birth, business or residential address, and an unexpired photo ID or passport.
For companies in existence or registered prior to January 1, 2024, the initial BOI report must be made by January 1, 2025. For companies formed or registered on January 1, 2024, or later, the initial BOI report is due within 90 days of formation or registration. After January 1, 2025, new companies will have to file an initial report within 30 days of formation.
BOI reports are filed through an online portal maintained by FinCEN. Updated reports are required only when there are changes to the previously submitted reporting company information or the individual’s personal identifying information. The reporting company must file an updated BOI report no later than 30 days after the date on which the change occurred.
Who Can Access this Information?
Access to the FinCEN database is limited to federal agencies engaged in law enforcement, national security, or intelligence activity, US Treasury tax investigations, state, local and tribal criminal or civil investigations, and financial institutions in connection with CDD or AML solely with the consent of the reporting company.
Are There Penalties for Non-Compliance?
The CTA provides for civil and criminal penalties for failure to (1) file a BOI report, (2) update a BOI report, and (3) correct inaccurate BOI reports. 31 U.S.C. § 5336(h) provides in relevant part:
It shall be unlawful for any person to willfully provide, or attempt to provide, false or fraudulent beneficial ownership information, including a false or fraudulent identifying photograph or document, to FinCEN, in accordance with this section, or to willfully fail to report complete or updated beneficial ownership information to FinCEN in accordance with this section.
There is a civil penalty of $500 per day and criminal penalties of up to a $10,000 fine and/or imprisonment for up to two years. Note that no penalties will be imposed for filing an inaccurate report corrected within 90 calendar days of when it was filed. FinCEN has stated that, as a general matter, an inadvertent mistake by a reporting company acting in good faith after diligent inquiry would not constitute a willfully false or fraudulent violation.
What Steps Should Be Taken to Establish a CTA Compliance Plan?
Every new or existing company established or registered in the United States, in conjunction and coordination with owners, company management, accounting firms, legal counsel, trust companies, and other stakeholders, should establish a CTA compliance plan. We recommend taking the following steps:
- Determine whether an entity is a reporting company (e.g., is it out of scope or exempt from CTA).
- Identify beneficial owners based on 25% ownership or substantial control tests. Is there an exclusion?
- Identity company applicants.
- Address any privacy issues or concerns that the stakeholders have.
- Gather BOI, prepare BOI report, and electronically file BOI report with FinCEN.
- Adopt processes and procedures to ensure that changes to BOI are timely and correctly identified and that an updated BOI report is filed with FinCEN.
In addition to these basic CTA compliance steps, companies and their service providers and advisors should consider possible revisions to governing documents (such as operating agreements for limited liability companies and bylaws for corporations) to require applicable beneficial owners to disclose the required reporting information to the company, including any future changes to such information. In addition, companies should consider how the enactment of the CTA might impact transaction documents and contract provisions regarding representations, warranties, covenants, and indemnification.
For more information about the CTA, here are some additional resources:
- General Information – https://www.fincen.gov/boi
- FAQs – https://www.fincen.gov/boi-faqs#B_1
- Small Business Resources – https://www.fincen.gov/boi/small-business-resources
- File a BOI Report – https://boiefiling.fincen.gov/
This Global Matters post was adapted from an original alert developed and distributed by Ally Law member firm Kalbian Hagerty LLP.
