On September 29, 2022, the U.S. Treasury Department’s Financial Crimes Enforcement Network (FinCEN) issued a long-awaited final rule implementing the beneficial ownership information (BOI) reporting requirements of the Corporate Transparency Act (CTA). The final rule adopted much of FinCEN’s December 8, 2021, proposed BOI reporting rule, though FinCEN made several notable amendments in the final rule.¹

Among other things, the final rule:

• adjusts some of the reporting timelines established in the proposed rule;
• does not recognize additional types of entities that are exempt from the CTA’s reporting requirements, but clarifies the application of certain exemptions and that no filing will be required to claim an exemption;
• provides additional detail regarding the definition of “beneficial owner,” but does not cap the number of beneficial owners a reporting company must disclose to FinCEN, so companies must report all persons that hold at least 25% of their “ownership interests” or exercise “substantial control” over the company; and
• simplifies certain aspects of the information that reporting companies must submit to FinCEN.

Given the breadth of the BOI reporting requirements laid out in the CTA, private entities, financial institutions and other stakeholders have been eagerly awaiting the final rule to assess the scope of their future reporting obligations and learn when those will become effective. There has also been significant focus throughout the rulemaking process on the protocols that FinCEN will establish to secure and control access to BOI that has been reported. The final rule provides additional clarity about security for this sensitive information, but it leaves some questions unanswered.

At bottom, the final rule is likely to require a major compliance undertaking for some reporting companies, particularly entities with complex ownership structures that do not qualify for an exemption.

Importantly, the final rule provides a lengthy implementation period, as it does not become effective until January 1, 2024. Reporting companies formed after that date will have 30 days to submit initial BOI reports, and those in existence before the effective date will have until January 1, 2025. This buffer will benefit both reporting companies and the FinCEN itself, given the systems and controls FinCEN will need to implement to receive and securely store BOI. The final rule also signals that future rulemakings will be necessary to harmonize FinCEN’s 2016 customer due diligence rule (the CDD Rule) with the final rule and address information security and access rights.

We expect FinCEN will publish guidance to clarify aspects of the final rule before its effective date.

Requirements of the Final Rule

The final rule features certain notable deviations from the proposed rule’s requirements and definitions that, according to FinCEN, are intended to “minimize unnecessary burdens” and “enhance clarity” for reporting companies. The following sections provide an overview of the key requirements of the final rule and highlight these deviations where relevant.

Who Must Report?

The final rule, like the proposed rule, defines “reporting companies” to include both U.S. domestic companies and foreign companies registered to do business in any U.S. state or tribal jurisdiction. The final rule also leaves unchanged the 23 categories of entities specifically exempted from the CTA’s BOI reporting requirements. These include:

• certain issuers of securities registered with the Securities and Exchange Commission;
• certain financial institutions, including domestic banks, bank holding companies, federal or state credit unions, and FinCEN-registered money services businesses;
• certain U.S. federal and state governmental entities and public utilities;
• investment companies and advisors;
• insurance companies and insurance producers;
• Commodity Exchange Act-registered companies;
• public accounting firms registered pursuant to the Sarbanes-Oxley Act of 2002;
• certain pooled investment vehicles;
• certain tax-exempt entities, including 501(c) entities, political organizations, and charitable trusts;
• “large operating companies” with a U.S. presence; and
• companies whose ownership interests are controlled or wholly owned, directly or indirectly, by one or more entities that themselves qualify for certain of the foregoing exemptions.

FinCEN declined to recognize additional exemptions in the final rule, despite numerous comments on the topic, explaining that the statutory exemptions in the CTA are “carefully circumscribed” and designed to further the CTA’s “overall objective of enhancing financial transparency and making it more difficult for bad actors to conceal their illicit financial activities.”² Broadening the existing exemptions would, in FinCEN’s view, undercut this objective and risk creating loopholes.

FinCEN further states that the standard set in the CTA for recognizing new exemptions is intentionally high: The Secretary of the Treasury and the Attorney General must jointly determine that requiring the entity or class of entities to report BOI would not serve the public interest or assist law enforcement efforts to detect, prevent, or prosecute terrorism, money laundering or other criminal activities.

However, while merely restating the CTA’s list of exemptions, the final rule provides some clarity regarding their application. For instance, it does not impose any filing obligations on exempt entities, including any obligation to affirmatively claim an exemption, despite FinCEN receiving “numerous comments” on this topic. However, if an exempt entity ceases to qualify for an exemption, the final rule requires that entity to file a BOI report with FinCEN within 30 calendar days.³

The final rule also clarifies certain aspects of the “large operating company” exemption, which applies to companies that employ more than 20 employees on a full-time basis in the U.S., maintain an operating presence at a physical office in the U.S. and filed a U.S. federal income tax return for the previous year showing more than $5 million in gross receipt or sales from operations in the U.S. The final rule explains that FinCEN received a number of comments relating to this exemption, including suggestions that an entity that is part of a consolidated group of companies should be able to aggregate its employee headcount with those of its affiliates for purposes of meeting the 20-person threshold, as it may do to meet the $5 million in gross receipts or sales element. FinCEN declined to adopt this change, citing the text of the CTA, which permits consolidation for purposes of the monetary element but references employee headcount on an entity-by-entity basis.

What Information Must Be Reported?

Like the proposed rule, the final rule requires reporting companies to provide FinCEN with BOI information on (1) the reporting company itself; (2) each “beneficial owner” of the reporting company; and (3) the reporting company’s “company applicant(s).” The final rule includes some important adjustments to the specific BOI information required under the proposed rule for each of these categories of persons.

A reporting company must report its full legal name, any alternative names through which it engages in business, its business street address, jurisdiction of formation or registration, and Taxpayer Identification Number (TIN). Unlike in the proposed rule, however, if a reporting company has not yet been issued a TIN, it does not need to provide a Dun & Bradstreet Data Universal Numbering System Number or a Legal Entity Identifier. FinCEN believes that newly created domestic reporting companies will have sufficient time to apply for and receive a TIN within the extended reporting timeframe applicable to such entities (as explained below). Foreign reporting companies that lack a U.S. TIN will be permitted to provide instead a foreign tax identification number with the name of the relevant jurisdiction.

For each beneficial owner and company applicant, reporting companies must disclose the individual’s full legal name, date of birth, current residential or business street address, and a unique identifying number from an acceptable identification document. The final rule, like the proposed rule, incorporates the list of acceptable identification documents in the CTA: a valid U.S. passport, U.S. identification document or U.S. driver’s license, and, if none of these are available, a valid non-U.S. passport. Unlike the proposed rule, the final rule requires reporting companies to specify the jurisdiction that issued the identification document that contains the beneficial owner’s unique identification number. A reporting company is also required to provide a scanned copy of the identification document from which the unique identifying number of the beneficial owner or company applicant is obtained.

The final rule largely adopts unchanged the proposed rule’s provisions regarding the ability of an individual to use a FinCEN identifier — a unique identifying number assigned by FinCEN to a person — in lieu of providing detailed BOI to a reporting company for submission to FinCEN. An individual may obtain a FinCEN identifier by submitting an application containing the information about themselves that would be required in a report filed by a reporting company.

The final rule similarly permits a reporting company to obtain a FinCEN identifier by submitting an application to FinCEN, but only at or after the time that the entity submits an initial report to FinCEN. However, the final rule does not include the provision in the proposed rule that would have allowed a reporting company with a FinCEN identifier to use it as an individual may. FinCEN received several comments regarding the ways in which a reporting company could use a FinCEN identifier that could result in incomplete or misleading disclosures. As a result, FinCEN reserved the proposed rule’s provision for further review.

Who Are a Reporting Company’s “Beneficial Owner(s)” and “Company Applicant(s)”?

The final rule defines a reporting company’s “beneficial owner” as any individual who, directly or indirectly, either exercises “substantial control” over the reporting company or owns or controls at least 25% of its “ownership interests.” The definitions of these key terms and their treatment in the final rule represent a significant expansion of the concept of beneficial ownership established in the CDD Rule.

Substantial Control. With respect to the control prong of the term “beneficial owner,” the CDD Rule requires covered financial institutions to identify only one individual with significant responsibility to control, manage, or direct a legal entity, such as an executive officer or senior manager. By contrast, the final rule requires reporting companies to identify every individual with “substantial control” over the reporting company.

An individual has “substantial control” if he or she:

(i) serves as a senior officer of the company;

(ii) has authority over appointment or removal of any senior officer or a majority of the board of directors of the company;

(iii) directs, determines, or has substantial influence over important decisions by the company (e.g., the nature, scope and attributes of the business; reorganization, dissolution or merger of the company; major expenditures or investments, issuances of equity, incurrence of significant debt); or

(iv) has any other form of substantial control.

As discussed in our December 17, 2021 alert summarizing the proposed rule, the first indicator is designed to capture persons with substantial control by virtue of their legal authority vis-à-vis the reporting company, the second and third indicators are designed to capture persons with factual authority, and the fourth indicator is a catch-all provision.

The final rule adopted these indicators largely as proposed, but provides some additional clarity by including a non-exhaustive list of how a person may exercise substantial control. For instance, under the final rule, a person may directly or indirectly exercise substantial control over a reporting company by acting as trustee of a trust or similar arrangement, even if the trust itself would not qualify as a reporting company under the definition in the final rule.

In the final rule, FinCEN explains that it departed from the narrower treatment of control in the CDD Rule, despite numerous comments recommending that it adhere closer to the CDD Rule’s definitions and requirements, in order to remain consistent with the CTA’s objective of establishing a “comprehensive” BOI database for all beneficial owners of reporting companies. FinCEN nonetheless acknowledges the breadth of the final rule’s definition of “substantial control,” particularly in light of its decision to retain the catch-all provision as initially proposed. FinCEN said that it will evaluate the need for additional guidance regarding these provisions as it implements and assesses compliance with the final rule.

Ownership Interests. The term “ownership interest” is also notably broader than its analogous concept in the CDD Rule. While the CDD Rule focuses exclusively on the “equity interests” of legal entities, the final rule — thanks to the addition of a catch-all provision to the already expansive definition included in the proposed rule — covers virtually all instruments, contracts, arrangements, or mechanisms used to establish ownership of a legal entity. These include capital or profit interests; convertible instruments; and puts, calls, straddles or other similar options.

An individual may own or control an ownership interest through any contract, arrangement, understanding or relationship, including through joint ownership; through a nominee, intermediary, custodian or agent; through a trust or similar arrangement; or through ownership or control of one or more intermediary entities.

The CDD Rule considers assets held in a trust to be owned only by the trustee. The final rule, however, indicates that the following persons can own or control an ownership interest in a reporting company via a trust or similar arrangement, even if the trust itself is not a reporting company under the final rule’s definition:

• a trustee of the trust or other individual with authority to dispose of trust assets;
• a beneficiary who is the sole permissible recipient of trust income and principal, or who has the right to demand distribution or withdraw substantially all of the assets of the trust; or
• a grantor or settlor who has the right to revoke the trust or otherwise withdraw the assets of the trust.

FinCEN acknowledges that, as a result, it is possible for multiple parties to simultaneously own or control the ownership interests of a reporting company that are held in trust. FinCEN also indicates that its list of persons that may potentially own or control ownership interests held in trust is not exhaustive, as trust arrangements can vary significantly in form.

The final rule also clarifies the method reporting companies should use to calculate an individual’s overall ownership percentage in the entity. The proposed rule contemplated tabulating all of an individual’s ownership interests, aggregated across all types of ownership interests covered by the proposed rule, and dividing that number by the total “undiluted ownership interests” of the reporting company. The final rule amends this calculation method in light of comments FinCEN received expressing confusion as to the meaning of the term “undiluted ownership interests” and the proposed rule’s method of aggregation, among other things.

The final rule specifies that an individual’s total ownership interests are calculated as a percentage of the reporting company’s “total outstanding ownership interests,” with any options or similar interests treated as exercised. The final rule also provides specific guidance for certain types of reporting companies.

For entities that issue capital and profit interests, including entities treated as partnerships for federal income tax purposes, an individual’s ownership interests are his or her capital and profit interests calculated as a percentage of the entity’s total outstanding capital and profit interests. For entities that issues shares, the final rule establishes a “vote or value” methodology: An individual’s ownership interest is the greater of his or her total combined voting power, or the total combined value of all of his or her ownership interests, calculated as a percentage of the total outstanding voting power or total outstanding value, respectively, of all classes of the reporting company’s ownership interests.

The final rule also includes a catch-all provision for these entity types where these calculation methods cannot be performed with reasonable certainty. Under that provision, an individual will be deemed to hold 25% or more of the total outstanding ownership interests in the reporting company if the individual owns or controls 25% or more of any class or type of the entity’s ownership interests.

Exceptions to the Definition of “Beneficial Owner”. The final rule includes the five exceptions to the definition of “beneficial owner” outlined in the CTA and the proposed rule. Specifically, the term does not apply to:

1. a minor child, provided the reporting company includes the BOI information of the child’s parent or legal guardian;
2. an individual acting as nominee, intermediary, custodian or agent on behalf of another individual;
3. an employee of the reporting company, acting solely as employee, whose substantial control or economic benefits from such entity are derived solely from his or her status as an employee;
4. an individual whose only interest in a reporting company is a future interest through a right of inheritance; or
5. a creditor of a reporting company.

The final rule clarifies that the exception for employees does not apply to senior officers that exercise substantial control over a reporting company.

Company Applicant. The final rule adopts the definition of “company applicant” set forth in the proposed rule with certain modifications. The proposed rule specified that, with respect to a domestic reporting company, a company applicant is any individual who files the document that forms the entity and, in the case of a foreign reporting company, any individual who files the document that first registers the entity to do business in the U.S. In both cases, the proposed rule also included within the definition of “company applicant” any individual who directs or controls the filing of the relevant documents. The final rule narrows the definition to cover only “the” individual that directly filed the relevant documents for the reporting company and, where more than one individual is involved in such filings, “the” individual primarily responsible for directing or controlling the filing. These changes limit the potential number of company applicants of a reporting company to a maximum of two individuals.

The proposed rule provided an exception to the company applicant reporting requirement for a reporting company in existence as of the final rule’s effective date where a company applicant died before the initial reporting deadline. In such circumstances, the proposed rule would have required only that the reporting company disclose that fact and any required BOI information on the company applicant that happens to be available to the reporting company. The final rule expands this exception by allowing any reporting company that predates the final rule’s effective date to take advantage of the exception — regardless of whether one of its company applicants is deceased. A preexisting reporting company need only report that it was in existence prior to the effective date, and it is not required to report any BOI information with respect to its company applicant(s).

Reporting Timeframes and Penalties for Violations

The final rule retains the proposed rule’s requirement that reporting companies already in existence as of the rule’s effective date to submit initial BOI reports within one year — i.e., by January 1, 2025. The final rule also harmonizes at 30 days the other reporting timeframes established in the proposed rule. Reporting companies created or registered after the January 1, 2024, effective date must file initial BOI reports within 30 calendar days of creation or registration. All companies (whether pre-existing or newly created or registered) will have 30 calendar days to file corrected or updated reports.

The final rule largely adopts the proposed rule’s penalties for reporting violations. The CTA lays out civil and criminal penalties for persons who “willfully provide, or attempt to provide, false or fraudulent beneficial ownership information … to FinCEN’” or “willfully fail to report complete or updated beneficial ownership information to FinCEN.” The CTA establishes civil penalties of up to $500 for each day a violation continues or has not been remedied. Persons that criminally violate the CTA may be fined up to $10,000, imprisoned for up to two years, or both.

Like the proposed rule, the final rule defines “person” in this context to include a reporting company, any individual and any other entity. While only reporting companies are required to file reports with FinCEN, another entity or an individual can violate the CTA where that person causes the reporting company to fail to satisfy its obligations or is a senior officer of the reporting company at the time of the failure.

Conclusion

Although the final rule adopts almost all of the provisions previewed in December 2021 in the proposed rule, it is still likely to create significant compliance challenges for companies that do not maintain the systems and processes necessary to identify, retain and keep current the BOI information that must be reported and updated under the final rule.

The final rule states that FinCEN will prioritize education and outreach to the private sector to promote implementation and facilitate compliance. We also expect FinCEN to publish written guidance prior to the final rule’s effective date to address questions that arise as companies begin tackling their future BOI reporting obligations.

The final rule represents a significant expansion of the United States’ anti-money laundering and countering-the-financing-of-terrorism regulatory framework and its approach to combatting illicit finance. But FinCEN’s work in implementing the CTA is far from over. Once the final rule’s reporting obligations become effective, FinCEN will need to receive, store and maintain an unprecedent volume of information, some of which is particularly sensitive in nature. The CTA requires FinCEN to do so using a secure database and appropriate information security methods and techniques. The final rule states that FinCEN is developing a “Beneficial Ownership Secure System,” or BOSS, to secure the BOI it receives at the highest information security protection level available under the Federal Information Security Management Act. FinCEN also intends to address the regulatory requirements regarding access the BOSS through a future rulemaking process before the final rule’s effective date. FinCEN will also engage in a further rulemaking to amend the CDD Rule and bring it into alignment with the final rule and the future BOSS access rule.

ENDNOTES

1 See our December 21, 2021, client alert, “FinCEN Issues Long-Awaited Proposed Rule To Implement New Beneficial Ownership Reporting Requirements,” for an overview of the proposed rule. Our April 23, 2021, client alert, “FinCEN Commences Rulemaking Process To Implement New Beneficial Ownership Requirements,” addressed the advanced notice of proposed rulemaking under the CTA that FinCEN issued on April 1, 2021.

The CTA was enacted as part of the National Defense Authorization Act (NDAA) for fiscal year 2021, which accompanies a host of other significant updates in the NDAA to the U.S. anti-money laundering and countering-the-financing-of-terrorism legal framework. Those were discussed in our January 7, 2021, client alert, “US Enacts Historic Legislation To Strengthen Anti-Money Laundering and Counterterrorist Financing Legal Framework.”

2 Beneficial Ownership Information Reporting Requirements, 87 Fed. Reg. 59,498, 59,540 (Sept. 30, 2022) (to be codified at 31 C.F.R. § 1010.380).

3 The final rule retains the proposed rule’s provision that extends this reporting requirement by 180 days in the case of an entity exempted from BOI reporting as a tax-exempt 501(c) entity that loses its tax-exempt status.

This post comes to us from Skadden, Arps, Slate, Meagher & Flom LLP. It is based on the firm’s memorandum, “FinCEN Issues Final Rule on Beneficial Ownership Reporting Under the CTA,” dated October 28, 2022, and available here.