FinCEN Beneficial Ownership Rule: US Compliance Requirements

The Corporate Transparency Act (CTA), enacted as part of the National Defense Authorization Act for Fiscal Year 2021, represents the most significant reform of US anti-money laundering law in a generation. Its core purpose is to close the longstanding gap in US beneficial ownership transparency — a gap that for decades allowed anonymous shell companies formed in states like Delaware, Wyoming, and Nevada to hold assets, open bank accounts, and conduct transactions without any public record of their ultimate human owners. FinCEN's Beneficial Ownership Information (BOI) reporting rule, effective from 1 January 2024, implements the CTA's reporting requirements. For businesses with US connections, compliance is not optional — and the implementation history has been turbulent.

What the CTA Requires

The CTA requires "reporting companies" to submit beneficial ownership information to FinCEN. A reporting company is any corporation, LLC, or similar entity created by filing documents with a US Secretary of State or equivalent, or any foreign company registered to do business in the US. The rule captures an estimated 30+ million existing US entities, plus hundreds of thousands of new entities formed each year.

For each reporting company, the BOI report must include: the legal name and any trade names, the current US address, the jurisdiction of formation or registration, and the taxpayer identification number. For each beneficial owner and company applicant, the report must include: name, date of birth, residential address, and the identifying number and issuing jurisdiction from a government-issued identification document, along with an image of that document.

A "beneficial owner" is defined as any individual who, directly or indirectly: (1) exercises substantial control over the reporting company; or (2) owns or controls at least 25% of the ownership interests of the reporting company. The definition of "substantial control" is broad — it includes senior officers (CEO, CFO, COO, general counsel, and senior officer equivalents), board members with authority to appoint or remove any senior officer, and any individual with authority over important decisions about the company's business, finances, or structure.

Company Applicants

In addition to beneficial owners, reporting companies formed after 1 January 2024 must also report "company applicants" — the individuals who directly filed the document that created the company, and the individuals who directed or controlled the filing. For companies formed before that date, company applicant reporting is not required. This transitional distinction matters: existing companies only need to report beneficial owners, while new companies have a broader initial reporting obligation.

Exemptions: Who Is Not Required to Report

The CTA includes 23 categories of exempt entities. The most commercially significant exemptions are:

• Large operating companies: Entities that employ more than 20 full-time employees in the US, have an operating presence in the US, and reported more than $5 million in gross receipts or sales on the prior year's US federal tax return. This exemption is designed to exclude established businesses that are already subject to significant regulatory disclosure requirements.
• SEC reporting companies: Companies registered with the SEC under sections 12 or 15(d) of the Securities Exchange Act of 1934.
• Regulated financial services: Banks, credit unions, registered broker-dealers, investment companies registered under the Investment Company Act, investment advisers registered with the SEC, insurance companies, and state-licensed insurance producers.
• Inactive entities: Companies that have been in existence for more than one year, have not conducted active business, have no foreign ownership, have no assets, have not sent or received funds exceeding $1,000, and have not undergone change of ownership in the preceding 12-month period.
• Subsidiaries of exempt entities: Entities whose ownership interests are controlled or wholly owned by an exempt entity (with certain exceptions).

Importantly, the exemptions are not self-executing: a company that believes it qualifies for an exemption should document its basis for that belief, as FinCEN can request justification. The "large operating company" exemption in particular requires ongoing attention — a company that drops below the 20-employee threshold must file a BOI report within 30 days of the change.

Reporting Deadlines

The CTA's implementation has been marked by multiple deadline changes resulting from court challenges. The key timelines as they stand in early 2026:

• Reporting companies created or registered before 1 January 2024 had an initial deadline (as extended by litigation-driven FinCEN guidance) of 1 January 2025 for their initial BOI report, with further extensions granted for some categories.
• Reporting companies created or registered on or after 1 January 2024 and before 1 January 2025 had 90 calendar days from creation/registration to file an initial BOI report.
• Reporting companies created or registered on or after 1 January 2025 have 30 calendar days from creation/registration to file.
• Changes to beneficial ownership information must be reported within 30 days of the change.

The litigation trajectory — including the Texas Top Cop Shop case, the Alabama District Court challenge, and subsequent appeals — created significant uncertainty about enforcement during 2024–2025. As of early 2026, the BOI reporting obligation is substantively in effect for domestic reporting companies, though legal challenges continue in some courts and practitioners should monitor FinCEN guidance for further updates.

Access to BOI Data

A critical distinction between the US framework and the UK/EU registers is that US BOI data is not publicly accessible. FinCEN's BOI database is a law enforcement tool. Access is limited to: federal agencies for national security, intelligence, and law enforcement purposes; state, local, and tribal law enforcement agencies with court authorisation; foreign government agencies (through formal channels); financial institutions with customer consent (for CDD purposes); and Treasury staff for tax administration. This restricted access architecture reflects the privacy concerns raised by the business community during the CTA's development, but it limits the utility of the register as a transparency tool compared to public registers.

Penalties for Non-Compliance

Willful failure to report, willful provision of false information, and willful failure to update information all carry civil penalties of up to $591 per day (adjusted for inflation) and criminal penalties of up to $10,000 and two years' imprisonment. The "willful" standard requires knowing and intentional violation — it is not met by mere negligence. However, the intentional provision of false information to FinCEN is a clear criminal act, and the penalties are severe enough to make compliance a genuine business priority.

FinCEN has indicated that it will focus early enforcement efforts on wilful non-compliance and fraud rather than technical violations by entities making good-faith efforts to comply. Businesses that are uncertain about their reporting obligations should seek legal advice and document that they did so — demonstrating good faith will be relevant if a reporting question later arises.