Pursuant to the adoption of comprehensive revisions to the U.S. anti-money laundering statutes as part of the Defense Appropriations Act of 2021 (the “Defense Act”)1, on September 30, 2022, the Financial Crimes Enforcement Network (“FinCEN”) issued final regulations to implement revised “beneficial ownership information” (“BOI”) disclosure rules for legal entities (the “Final Rule”)2. Specifically, the Final Rule implements Section 6403 of the Corporate Transparency Act (the “CTA”)3, which requires reporting companies, including corporations, limited liability companies and similar entities, to submit to FinCEN specified information identifying their beneficial owners—that is, the natural persons who own and control them—as well as information about the persons—termed “company applicants” and discussed in greater detail below—who form or register those corporate entities.

The Final Rule is a major departure from the current scheme of FinCEN’s regulations regarding the identification of the beneficial ownership of legal entities, which requires banks, other lenders and certain other financial intermediaries (defined as “financial institutions”) to obtain a limited amount of BOI information prior to engaging in a financing transaction or opening an account relationship with a covered legal entity.4 While these obligations will remain in place for the immediate future, the CTA creates the “Beneficial Ownership Secure System” (the “BOSS”), a new federal BOI data base. That data base will contain confidential information provided directly from reporting companies to FinCEN, including updates, and will make that information available to certain government agencies, as well as financial institutions that are currently subject to obtaining BOI pursuant to FinCEN’s CDD Rule.5

Importantly, the scope of reportable BOI has been substantially expanded, and by January 1, 2025, will require literally millions of existing smaller-sized legal entities to initially register directly with FinCEN—as well as each time a new reporting company is either formed or registered.6 Further, a reporting company will be required to amend its filing with FinCEN whenever the reporting company determines that the BOI data previously reported to FinCEN is no longer accurate.

The Final Rule is the first of three proposed regulations that FinCEN will issue to implement the CTA’s legal entity reporting requirements, and addresses: (a) the legal entities that must file with FinCEN; (b) when filing must occur; and (c) the information that must be provided in the filing.7

This Alert summarizes each of these components of the Final Rule, as well as provides observations regarding the impact the Final Rule may have on the U.S. anti-money laundering (“AML”) compliance process.

For ease of discussion, the summary will be divided as follows:

  • Coverage under the Final Rule;
  • Timing requirements for filing initial reports and amended reports;
  • Required information to be filed about a reporting company and its BOI;
  • Special disclosure requirements regarding “company applicants”; and
  • Comments and observations.
Reporting Requirements for Covered Legal Entities'

The Final Rule establishes two categories of reporting companies that must file reports with FinCEN—“Domestic Reporting Companies” and “Foreign Reporting Companies.” However, in addition to imposing the obligation on reporting companies to file and amend required reports, the Final Rule also identifies several critical persons and entities that are substantially impacted by the requirements of the Final Rule, and whose individual identification data must be included in a filing by a reporting company: beneficial owners and company applicants.

Each is discussed separately below.

Domestic Reporting Companies and Foreign Reporting Companies

Subject to exemptions, discussed below, a Domestic Reporting Company is any entity that is created under state or federal law by the filing of a document with a Secretary of State’s office, or a comparable office operated by an Indian Tribe.8

A Foreign Reporting Company is any entity formed under the law of a foreign (i.e., non-U.S.) jurisdiction that is required to be registered to do business with a Secretary of State’s office, or a comparable office operated by an Indian Tribe.9

As defined by the Final Rule, the range of a legal entity that is a covered reporting company is extremely broad, and includes corporations, limited liability companies, statutory trusts and other similar legal entities created by the filing or registration of a document with a Secretary of State’s office (or similar office), including a comparable office operated by an Indian Tribe. However, because the intent of the CTA is to capture BOI for legal entities whose ownership and management is not otherwise available, the following 23 exemptions10 are available for those legal entities whose ownership information is either already publicly available or readily obtainable:

  • SEC reporting issuers;
  • Governmental authorities;
  • Banks;
  • Credit unions;
  • Depository institution holding companies;
  • Money services businesses (i.e., money transmitters);
  • Securities exchanges or clearing agencies;
  • Other Exchange Act registered entities;
  • Investment companies or investment advisers;
  • Venture capital fund advisers;
  • State-licensed insurance producers;
  • Commodity Exchange Act registered entities;
  • Accounting firms;11
  • Public utilities;
  • Designated financial market utilities;
  • Pooled investment vehicles;
  • Tax-exempt entities;
  • Certain entities that provide services to tax-exempt organizations;
  • Large operating companies;12
  • Subsidiaries of certain exempted entities;13 and
  • Inactive entities.14

As noted in the Final Rule, FinCEN estimates that approximately 5 million covered legal entities are created each year that would qualify as a reporting company (i.e., not exempted). Further, all existing legal entities not otherwise exempted as of the effective date of the Final Rule—which is January 1, 2024—will likewise be required to register with FinCEN and provide BOI within 1 year of the effective date (i.e., by January 1, 2025). (FinCEN estimates that the number of covered reporting companies in this category exceeds 30 million entities.)15

Beneficial Owners

As compared to the CDD Rule regarding the collection of BOI, the definition of the term “beneficial owner” under the Final Rule is the most significant change—and perhaps presents the greatest compliance challenge for reporting companies. This is because the requirement by a reporting company to identify a beneficial owner will now include not only all individuals who own or control 25% of more of a reporting company, but also all individuals who hold the authority to cause the adoption of major corporate and operational decisions at a reporting company. This is due to the revised definition of a beneficial owner, which states:

Beneficial owner. For purposes of this section, the term ‘‘beneficial owner,’’ with respect to a reporting company, means any individual who, directly or indirectly, either exercises substantial control over such reporting company or owns or controls at least 25 percent of the ownership interests of such reporting company.16

The import of this definition is that, unlike the current CDD Rule, the Final Rule will require that a reporting company identify not only all individuals who own or control 25% of the “ownership interests” in a reporting company, but all individuals who exercise substantial control over a reporting company. Further, unlike the CDD Rule which requires a disclosure to a financial institution, potential liability will be increased because a reporting company will be required to provide BOI directly to the federal government (i.e., to FinCEN).

In regard to an individual owning a 25% ownership interest in a reporting company, the Final Rule creates layers of analytic complexity in regard to determining what constitutes a direct or indirect ownership interest—which is measured beyond a mere computation of equity ownership in a reporting company, and includes:

  • Any equity, stock, or similar instrument (without regard to whether the instrument is transferable, is classified as stock or anything similar, or confers voting power or voting rights);
  • Any capital or profit interest in a reporting company;
  • Any instrument convertible, with or without consideration, into any share or instrument in the two categories above (and regardless of whether the instrument ischaracterized as debt);
  • Any put, call, straddle, or other option or privilege of buying or selling any of the foregoing; or
  • Any other instrument, contract, arrangement, understanding, relationship, or mechanism used to establish ownership.

To emphasize the expansive nature of an ownership interest that is intended, the Final Rule indicates that direct or indirect ownership may include: (a) joint ownership of an undivided interest; (b) ownership through another individual acting as an nominee or similar intermediary; (c) ownership through a trust (including a trustee or a settlor or beneficiary of a trust if that individual holds the authority to direct certain activities of the trust); and (d) ownership through one or more intermediary entities.17

Unlike the current CDD Rule, the Final Rule will require that a reporting company identify every individual who exercises “substantial control” over a reporting company, which includes an individual who:

  • Serves as a “senior officer” of the reporting company;
  • Has authority over the appointment or removal of any senior officer or a majority of the board of directors (or similar body); or
  • Directs, determines, or has substantial influence over “important decisions” made by the reporting company.18

As a clear indication that the substantial control factor is not limited to individuals holding a formal position at a reporting company, the term “important decisions” includes an individual that directs, determines, or has substantial influence over important decisions made by the reporting company, including decisions affecting:

  • Major aspects of the business, including the sale, lease, mortgage, or other transfer of principal assets of the reporting company;
  • The reorganization, dissolution, or merger of the reporting company;
  • Expenditures or investments, including the issuance of any equity or debt, or approval of the operating budget of the reporting company;
  • The selection or termination of business lines or ventures, or geographic focus, of the reporting company;
  • Compensation schemes and incentive programs for senior officers;
  • Significant contracting activities of the reporting company;
  • Amendments of any significant governance documents of the reporting company; or
  • Any other form of substantial control over the reporting company.19

Company Applicants

The Final Rule defines a “company applicant” as “an individual that either directs or controls the creation or registration of a reporting company.”20 This would include, for example, an attorney at a law firm that orders the incorporation or formation of a new corporation, limited partnership, statutory trust or limited liability company through a subordinate employee.

As originally proposed in the rulemaking process, the BOI disclosure scheme would have required that a reporting company identify its “company applicant” and provide information regarding that individual or entity. In the public comments to the proposed BOI regulations, strong concerns were raised by law firms and other potential covered parties regarding this requirement. In a compromise responding to these concerns, the Final Rule limits the identification of company applicants to reporting companies formed or registered on and after January 1, 2024—meaning that the estimated 30 million reporting companies already in existence as of the effective date of the Final Rule are relieved from this reporting requirement when filing their initial reports.21

The term “company applicant” refers to the individual or individuals that are responsible for forming or registering a reporting company, and states:

  • For a Domestic Reporting Company, the individual who directly files the document that creates the Domestic Reporting Company;
  • For a Foreign Reporting Company, the individual who directly files the document that first registers the Foreign Reporting Company; and
  • Whether for a Domestic or a Foreign Reporting Company, the individual who is primarily responsible for directing or controlling the filing if more than one individual is involved in the filing of the document.22

The import of the third formulation above is that frequently there will be two individuals who will fall into the definition of a company applicant: (a) a senior official directing the incorporation or registration project; and (b) the individual actually making the filing. For example, this means that, in the case of law firms or in-house law departments, a supervising lawyer and a junior lawyer, paralegal or other ministerial employee will need to be identified as company applicants for reporting companies formed or registered on and after January 1, 2024.

Timing Requirements for Filing Initial and Amended Reports

Under the Final Rule, the time at which a required report is due by a reporting company is based upon: (a) the date the reporting company was created or registered; and (b) whether the report is an initial report, an updated report providing new information or a report correcting erroneous information in a previous report.

Domestic Reporting Companies and Foreign Reporting Companies created or registered to do business in the U.S. prior to January 1, 2024, will have until January 1, 2025, to file their initial reports with FinCEN.23

Domestic Reporting Companies and Foreign Reporting Companies created or registered to do business in the U.S. on and after January 1, 2024, will be required to file their initial report with FinCEN within 30 calendar days of the date on which they are created or registered, respectively.24

Finally, in regard to all reporting companies, the Final Rule would impose subsequent filing requirements. First, when there is a change in the information previously reported to FinCEN, a reporting company would have 30 calendar days to file an updated report. For example, this filing obligation would arise if the ownership or management prongs of the beneficial ownership tests changes. Second, if a reporting company determines that it filed information that was inaccurate at the time of the filing, the reporting company would have to file a corrected report within 30 calendar days of the date it knew, or should have known, that the information was inaccurate.25

Information Required to be Provided or Amended

A reporting company must file two general categories of information: (a) detailed information regarding the reporting company and its company applicant; and (b) BOI identifying individuals owning or controlling a 25% or more ownership interest, and management individuals holding the authority to direct the operations of the reporting company.

Reporting Company Information

In regard to general information to be filed by a reporting company concerning its own corporate existence and operations, information that must be provided in an initial report includes:

  • The full name of the reporting company;
  • Any trade name or ‘‘DBA” name of the reporting company;
  • The business address of the reporting company;
  • The State or Tribal jurisdiction of formation of the reporting company (or for a Foreign Reporting Company, the State or Tribal jurisdiction where the Foreign Reporting Company first registers); and
  • A unique identifier associated with the reporting company, such as an IRS TIN or EIN.26

Company Applicant Information 

In the case of a reporting company formed or registered on and after January 1, 2024, the following information must be filed by a reporting company for a company applicant:

  • The full legal name of the company applicant;
  • The date of birth of the company applicant;
  • The complete current address of the company applicant; and
  • A unique identifying number of the company applicant issued by an approved source, such as a passport, governmental ID or driver’s license (including a photo of the individual).27

Beneficial Owner Information

In regard to a beneficial owner, the following information must be provided:

  • The full legal name of the beneficial owner;
  • The date of birth of the beneficial owner;
  • The complete current address of the beneficial owner; and
  • A unique identifying number of the beneficial owner, such as a passport, governmental ID or driver’s license (including a photo of the individual).28

Penalties for Non-Compliance

The CTA makes it a federal crime to file false reports regarding a reporting company. Paraphrasing the language in the CTA, it states:

  • It shall be unlawful for any person to willfully provide, or attempt to provide, false or fraudulent beneficial ownership information, including a false or fraudulent identifying photograph or document, to FinCEN or willfully fail to report complete or updated beneficial ownership information to FinCEN; and
  • Any person that commits a violation: (i) shall be liable to the United States for a civil penalty of not more than $500 for each day that the violation continues or has not been remedied; and (ii) may be fined not more than $10,000, imprisoned for not more than 2 years, or both.

The Final Rule states that “each person filing such report or application shall certify that the report or application is true, correct, and complete.” Further, the Final Rule clarifies that liability may apply to a person who provides required information through another person—which impliedly includes BOI and related data required to be assembled and filed by a reporting company.29

Comments and Observations

We offer the following comments and observations.

First, as noted above, the Final Rule is the first of three regulations that FinCEN will issue to implement the CTA’s legal entity reporting requirements. As stated in the Final Rule, the two additional regulations that will be issued by FinCEN will address: (a) the protocols for accessing the BOI database by permitted users; and (b) revisions to the current CDD Rule.

If the BOSS ultimately relieves financial institutions from the current burdens of complying with the CDD Rule, the BOSS may provide a welcome relaxation regarding AML compliance for financial institutions. If, however, covered financial institutions will be required to separately report legal entity information they receive under the CDD Rule—and compare that data with the data filed by a reporting company and held in the BOSS—compliance will become potentially more complicated.

Second, the Final Rule creates a complicated (and potentially burdensome) analytical scheme for calculating the aggregate ownership interests of a reporting company and for each possible beneficial owner. Besides computational rules that do not necessarily comply with accounting related to corporate ownership, a reporting company may be subject to engaging in legal and contractual reviews of investor entitlements that may be beyond the capability of the management of a small corporate entity.30 Further, as the capitalization and operations of a reporting company expands, obtaining and evaluating ownership interests may prove increasingly problematical.31

Third, from the viewpoint of existing reporting companies (i.e., companies chartered or registered prior to January 1, 2024), there will likely be an informational gap that will prove challenging. Many smaller companies and entities rely on third parties to perform organizational tasks such as the filing of charter documents, and frequently technical compliance is more aspirational in nature than the reality. For example, this may mean that the relationship between this category of a reporting company and its company applicant may by necessity have to be expanded (or revisited) to include ensuring that the company applicant provides (or assists) the reporting company in the filing of an initial report and any subsequent reports to FinCEN.

Fourth, particularly for reporting companies such as companies that are formed or registered on and after January 1, 2024, several consecutive amended reports may be required following the filing of an initial report. This is because, for reporting entities employed for many typical commercial purposes, the organization of a legal entity such as a corporation proceeds in several steps, including: (a) initial formation; (b) board of director and similar organizational actions; (c) structuring of management; and (d) one or several rounds of capital raising. If one or several of these and related stages of a reporting company fall outside of a single 30-day period and the BOI has changed, amended reports will be required.
 
Finally, in light of the probability that reporting companies may elect to employ legal counsel and other third parties to analyze BOI reporting requirements and file reports, clarity will be required from FinCEN regarding the degree of due diligence that will be required to identify data to be reported, as well as the degree of reliance that a third party (e.g., a law firm or accounting firm) may rely upon when analyzing the BOI and assisting in the preparation of an initial report and amended reports.

*       *       *

As noted in this Alert, the Final Rule is only the first in a series of three regulatory rules that will restructure the U.S. AML compliance scheme for BOI. In addition, other provisions of the CTA have not yet been proposed by FinCEN, but are likely to also radically modify current AML compliance obligations by banks and other financial institutions.

Future Alerts will address these and related regulatory initiatives that should be expected in 2023 and 2024. Among other things, we are aware that FinCEN has indicated that it is considering issuing interpretative guidance regarding compliance with the Final Rule that already have been raised. 

1 Public Law 116-283 (January 1, 2021).

3 Division F of the Defense Act is the Anti-Money Laundering Act of 2020, which includes the CTA.

4 The current customer due diligence requirements applicable to certain defined “financial institutions” will be modified in a rule-making to be issued by FinCEN and will remain in effect until modified. 31 C.F.R § 1010.230 (the “CDD Rule”).

5 87 Fed. Reg. 59498, 59508 (September 30, 2022).

6 This Alert addresses definitional terms included in the Final Rule, several of which in other regulatory contexts have different meanings (e.g., a “reporting company” under the Final Rule is markedly different in meaning from that term employed in federal securities laws and regulations).

7 The two additional proposed regulations to be issued by FinCEN will address: (i) the protocols for accessing the BOI database by permitted users; and (ii) revisions to existing CDD obligations by defined “financial institutions” pursuant to the CDD Rule.

8 31 C.F.R. § 1010.380(c)(1).

9 Id.

10 31 C.F.R. § 1010.380(c)(2).

11 A noteworthy omission from the list of exempted entities are law firms, whose members will frequently constitute “company applicants,” discussed below.

12 A large operating company is any entity that: (a) employs more than 20 full time employees in the United States; (b) has an operating presence at a physical office within the United States; and (c) has more than $5 million in reportable sales or operating revenue. (For a company that is part of an affiliated group of companies, the consolidated sales or revenues of the affiliated group may be used for this calculation.)

13 31 C.F.R. § 1010.380(c)(2)(xxii). (This exemption is not available for money services businesses and certain pooled investment vehicles.)

14 The CTA and the Final Rule include the authority for the Secretary of the Treasury (in consultation with other federal agencies) to exclude by regulation additional types of entities. (FinCEN has already indicated that it does not intend to consider additional exemptions at this time and has implied that granting new exemptions in the future is unlikely.)

15 31 C.F.R. § 1010.380(a)(1); 87 Fed. Reg. 59498, 59581(September 30, 2022).

16 31 C.F.R. § 1010.380(d).

17 31 C.F.R. § 1010.380(d)(2). The Final Rule exempts from the definition of beneficial owner: (a) a minor child (provided that the parent or guardian is identified); (b) a nominee or intermediary; (c) an employee (provided that the employee is not a senior officer of the reporting company); (d) an individual holding a future interest through inheritance; and (e) most creditors holding an interest to secure debt.

18 31 C.F.R. § 1010.380(d)(1).

19 Id. In an approach similar to the complexity associated with determining whether an individual holds an ownership interest, an individual may hold substantial control directly or indirectly through: (a) board representation; (b) ownership or control of a majority of the voting power or voting rights of the reporting company; (c) control exercised through an intermediary entity; (d) arrangements with individuals acting as nominees; (e) voting power or voting rights of the reporting company; and (f) any other contract, arrangement, understanding, relationship, or otherwise. 31 C.F.R. § 1010.380(d)(3).

20 31 C.F.R. § 1010.380(e).

21 31 C.F.R. § 1010.380(b)(2)(iv).

22 31 C.F.R. § 1010.380(e).

23 31 C.F.R. § 1010.380(a)(1)(iii).

24 31 C.F.R. § 1010.380(a)(1)(i), (ii).

25 31 C.F.R. § 1010.380(a)(2), (3).

26 31 C.F.R. § 1010.380(b)(2). (When a Foreign Reporting Company has not yet been issued a TIN, a tax identification number issued by a foreign jurisdiction and the name of the foreign jurisdiction may be used.)

27 31 C.F.R. § 1010.380((b)(1)(ii).

28 Id. Both a reporting company and an individual may elect to obtain a “FinCEN identifier,” which may be used in lieu of the information required to be submitted to FinCEN. 31 C.F.R. § 1010.380(b)(4). (It is unclear at this time whether the use of this alternative will be useful except for persons and entities that anticipate making frequent filings with FinCEN.)

29 31 C.F.R. § 1010.380(b); 31 C.F.R. § 1010.380(g).

30 Clarification of many nuanced corporate rights that might constitute substantial control may ultimately have to be addressed in clarifications to be issued by FinCEN (e.g., the holding of a contractual veto power over specified and limited significant corporate transactions). 

31 31 C.F.R. § 1010.380(d)(2)(iii).