CTA Compliance Obligations for CTA Participants: Reporting Companies, Beneficial Owners, and Third-Party Preparers

In an evolving (and somewhat disjointed) process, FinCEN has been providing guidance to persons and entities that are responsible for filing required beneficial ownership information (“BOI”) reports to FinCEN, as well as to “beneficial owners” when providing BOI to a reporting company to enable the reporting company to file a BOI report (a “BOI Report”) with FinCEN. This guidance has primarily been promulgated though FinCEN’s Small Business Compliance Guide[1] and its Beneficial Ownership Information—Frequently Asked Questions (the “FAQs”).[2]

Although the Corporate Transparency Act (the “CTA”)[3] and FinCEN’s implementing regulations (the “BOI Regulations”)[4] address the obligations of a reporting company to file initial reports and updated reports as necessary (to reflect changes or errors in previously filed reports), a fulsome discussion of the technical duty of participants when complying with the CTA reporting process (as interpreted by FinCEN) is less clear under the BOI Regulations.[5] For example:

• What degree of due diligence by a reporting company is necessary to determine whether the BOI it receives is complete and accurate?
• Does a beneficial owner or company applicant have an affirmative obligation to provide complete and accurate BOI when requested by a reporting company?
• To what degree may a third party rely upon BOI provided by a reporting company for purposes of assisting in the preparation and filing of BOI Reports?

This lack of clarity regarding the compliance obligations of CTA participants (e.g., to provide accurate information and to verify the same) creates heightened risk for CTA participants because FinCEN has emphasized that non-compliance creates both civil and criminal liability.[6]

FinCEN has primarily utilized the FAQs to provide CTA participants with its views on compliance with the various duties and obligations of CTA participants.

In this eUpdate we discuss: (a) FinCEN’s views of the duties and obligations of CTA participants; and (b) risk management alternatives to be considered by CTA participants to mitigate possible liability. In that regard, below we identify pertinent FinCEN guidance in the FAQs regarding CTA compliance obligations, and apply that guidance to the following CTA participants:

• Reporting companies;[7]
• Beneficial owners;[8]
• Third parties filing a BOI Report for a reporting company; and
• Company applicants.[9]

FinCEN FAQs Regarding Compliance Obligation

The FAQs establish a baseline of responsibility for a reporting company to file timely and accurate reports, and state:

FAQ No. K. 4—Is a reporting company responsible for ensuring the accuracy of the information that it reports to FinCEN, even if the reporting company obtains that information from another party?

Yes. It is the responsibility of the reporting company to identify its beneficial owners and company applicants, and to report those individuals to FinCEN. At the time the filing is made, each reporting company is required to certify that its report or application is true, correct, and complete. Accordingly, FinCEN expects that reporting companies will take care to verify the information they receive from their beneficial owners and company applicants before reporting it to FinCEN. (Emphasis added.)

Importantly, FAQ No. K. 4 states that a reporting company is required to certify that its BOI Report “is true, correct, and complete.” Stated another way, the certification that a report is true, correct, and complete imposes on a reporting person some degree of inquiry (i.e., due diligence) that information in a filed BOI Report has been verified in some reasonable manner.

This compliance duty is expanded in FAQ No. K. 3, which expands on the obligation of CTA participants to provide complete and accurate information:

FAQ No. K. 3—Who can be held liable for violating BOI reporting requirements?

Both individuals and corporate entities can be held liable for willful violations. This can include not only an individual who actually files (or attempts to file) false information with FinCEN, but also anyone who willfully provides the filer with false information to report. Both individuals and corporate entities may also be liable for willfully failing to report complete or updated beneficial ownership information; in such circumstances, individuals can be held liable if they either cause the failure or are a senior officer at the company at the time of the failure.

i. Can an individual who files a report on behalf of a reporting company be held liable?

Yes. An individual who willfully files a false or fraudulent beneficial ownership information report on a company’s behalf may be subject to the same civil and criminal penalties as the reporting company and its senior officers.

ii. Can a beneficial owner or company applicant be held liable for refusing to provide required information to a reporting company? 

Yes. As described above, an enforcement action can be brought against an individual who willfully causes a reporting company’s failure to submit complete or updated beneficial ownership information to FinCEN. This would include a beneficial owner or company applicant who willfully fails to provide required information to a reporting company. (Emphasis added.)

As stated in FAQ No. K. 3, FinCEN views every CTA participant’s duty (including senior officers of a reporting company) as not merely passive in nature, but as requiring an affirmative duty to respond with accurate and complete information when requested.

Of the greatest liability concern to a reporting company is the possible reluctance of a beneficial owner to cooperate by supplying accurate and complete BOI—either to a reporting company or to a third party that is assisting in the preparation and filing of a BOI Report. While liability is created for a beneficial owner to cooperate with a reporting company, FAQ No. K. 5 places an affirmative compliance duty on a reporting company (as well as third parties assisting in the preparation and filing of a BOI Report) to require that BOI be provided. As stated in FAQ No. K. 5:

FAQ No. K. 5. What should a reporting company do if a beneficial owner or company applicant withholds information?

While FinCEN recognizes that much of the information required to be reported about beneficial owners and company applicants will be provided to reporting companies by those individuals, reporting companies are responsible for ensuring that they submit complete and accurate beneficial ownership information to FinCEN….

Existing reporting companies should engage with their beneficial owners to advise them of this requirement, obtain required information, and revise or consider putting in place mechanisms to ensure that beneficial owners will keep reporting companies apprised of changes in reported information, if necessary. Beneficial owners and company applicants should also be aware that they may face penalties if they willfully cause a reporting company to fail to report complete or updated beneficial ownership information.

Persons considering creating or registering legal entities that will be reporting companies should take steps to ensure that they have access to the beneficial ownership information required to be reported to FinCEN, and that they have mechanisms in place to ensure that the reporting company is kept apprised of changes in that information. (Emphasis added.)

In FAQ No. K. 2, FinCEN emphasizes both the civil and criminal exposure for violations:

FAQ No. K. 2. What penalties do individuals face for violating BOI reporting requirements?

As specified in the [CTA], a person who willfully violates the BOI reporting requirements may be subject to civil penalties of up to $500 for each day that the violation continues.…[10] A person who willfully violates the BOI reporting requirements may also be subject to criminal penalties of up to two years imprisonment and a fine of up to $10,000. Potential violations include willfully failing to file a beneficial ownership information report, willfully filing false beneficial ownership information, or willfully failing to correct or update previously reported beneficial ownership information.

Risk Management Considerations and Approaches

Compliance failures in FinCEN’s new BOI disclosure scheme could be extraordinarily damaging not only to reporting companies and other corporate CTA participants, but also to individuals because violations of the BOI Regulations and the guidance contained in the FAQs potentially bring with it civil and criminal liability for CTA participants that are individuals. Among other things, the disruptive nature of an alleged violation in the area of anti-money laundering compliance is so severe that contesting alleged violations may not be practical—both because of the monetary cost to defend against alleged violations, as well as the potential loss of reputation to a targeted person or entity.[11]

It is suggested that CTA participants consider adopting policies and procedures that are directed to both internal and external CTA compliance. While it appears that FinCEN will continue to clarify what constitutes a reasonable compliance scheme, the following approaches might be considered:

The Reporting Company—A reporting company should consider both educating its beneficial owners of their respective duties to timely supply accurate and complete BOI, as well as assigning responsibility internally to assemble and file accurate BOI Reports to FinCEN.

In regard to beneficial owners, communications to a beneficial owner might include mandatory instructions to an investor in order for the reporting company to demonstrate that its interaction with a beneficial owner was reasonable when obtaining BOI. In addition, a reporting company should consider obtaining a certification from a beneficial owner that: (a) all BOI provided is complete and accurate; (b) the reporting company can rely upon all BOI received from the beneficial owner; and (c) the beneficial owner acknowledges its obligation to notify the reporting company of all BOI changes that require the filing of an amended BOI Report.

In the case of many investments, securities offering and/or governance documents generally contain representations and warranties made by an investor, including compliance with AML laws and regulations. Although this approach may be appropriate as a starting point for a BOI compliance program, in specific circumstances separate disclosures regarding the duties of a beneficial owner may be required.

In regard to internally organizing an effective BOI compliance program, a reporting company may want to designate either an individual employee or officer to be responsible for BOI compliance within the corporate group. For example, for those reporting companies that are subject to AML compliance, responsibility for BOI compliance might be assigned to the designated AML officer.[12] Alternatively, operating divisions of a reporting company might be trained to include as a regular component of corporate organization and reporting BOI compliance and outreach to its beneficial owners.

Third Parties Assisting in the Drafting and Filing of BOI Reports—In the case of third parties assisting in the drafting of a BOI Report (e.g., a lawyer, law firm or accountant) the major compliance challenge is to adequately document that the third-party preparer is reasonably relying upon the BOI provided by the reporting company and its beneficial owners.

The applicable FinCEN verification language when filing an initial or subsequent report arguably contains language that allows a third party to rely upon BOI provided by a reporting company:

I certify that I am authorized to file this [BOI Report] on behalf of the reporting company. I further certify, on behalf of the reporting company, that the information contained in this [BOI Report] is true, correct, and complete.[13]

The language that indicates that a third-party preparer is certifying “on behalf of a reporting company” the accuracy of a filed BOI Report might possibly be viewed as inadequate in the absence of a documented communication (e.g., email or contract) between the third party and the reporting company. Specifically, any such communication or contract should specify: (a) the role of the third party; (b) the obligation of the reporting company to obtain accurate and complete BOI to be included in a BOI Report; (c) the agreement of the reporting company to defend and indemnify the third party for inaccurate or false data; and (d) role of the third party to assist or to file additional BOI Reports in the future.[14]

Beneficial Owners—Although sophisticated investors are now familiar with the intrusive nature of a financial institution’s know your customer or “KYC” obligations,[15] there is likely a large segment of individuals who may qualify as beneficial owners that may balk at any requirement to reasonably cooperate with a reporting company in regard to disclosing their respective BOI.

Reasonable cooperation is complex due to the BOI Regulations that define “beneficial ownership” under the CTA’s two-pronged approach: (a) equity ownership of 25% or more of a reporting company;[16] and (b) the exercise of “substantial control” of the reporting company.[17] In other words, even individuals with no actual ownership interest in a reporting company may nonetheless be deemed “beneficial owners” due to their ability to substantially control the reporting company.

Reporting changes in equity ownership can require the filing of several amended BOI Reports in a short period of time because equity ownership can vary significantly if several rounds of capital raises occur, as well as tracing equity ownership through several layers of corporate ownership. Similarly, the extremely broad range of what constitutes “substantial control” may easily result in the lack of understanding of contractual and other rights that result in an individual being deemed a beneficial owner through an individual’s ability to determine “important decisions” of a reporting company.[18]

While ultimately the assembly of BOI may be systematized through detailed policies and procedures shared among CTA participants, for the remainder of 2024 it is more probable that the onus for ensuring the receipt of accurate and correct BOI from beneficial owners will be on the reporting company.

Observations and Recommendations

Anecdotal evidence regarding compliance with the BOI Regulations indicates that many existing reporting companies organized or registered prior to January 1, 2024 are taking a prudent, “wait and see” approach to allow FinCEN to elaborate on the standard it will employ to determine whether BOI compliance is reasonable. For example, the FAQs employ the concept of “willfulness” when describing an actionable violation—does this mean intentionally reporting inaccurate or false BOI, or is it a lesser standard that includes merely failing to develop reasonable policies and procedures for compliance?

While FinCEN indicates in the BOI Regulations and accompanying materials that “willfulness is a legal concept that is well established in existing case law,” that legal position is an exaggeration of the clarity of the concept of willfulness. Though beyond the scope of this eUpdate, the standard of willfulness as determined by case law ranges from merely making an unknowing statement (e.g., a form of negligence) to recklessness or conduct that approaches an intent to knowingly violate the law.

While the applicable standard for willful conduct will ultimately have to be resolved by judicial interpretation, at minimum, having policies and procedures in place to file accurate and complete BOI Reports arguably insulates reporting companies and other CTA participants from liability by demonstrating reasonable conduct.

As noted in this eUpdate, while the range of complexity to comply with FinCEN’s views of the compliance obligations of CTA participants will vary significantly, it is strongly recommended that reporting companies consider some or all of the strategies discussed herein to position themselves as attempting to reasonably comply with current FinCEN guidance.