Beneficial Ownership Reporting Requirements

June 2023 By Ryan D. Robinson and Marianne Luu-Chen

This article discusses the beneficial ownership reporting requirements imposed by the new FinCEN rule that becomes effective on January 1, 2024.

The US Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) issued the final beneficial ownership information (BOI) reporting requirements rule (BOI rule or rule) on September 29, 2022. The rule takes effect on January 1, 2024, and will impose disclosure obligations on more than 32.5 million existing entities. All entities that are created by filing a document with a secretary of state will be required to submit BOI unless the entity qualifies for an exemption. While the rule imposes obligations at the entity level and does not directly subject lawyers to its requirements, it will significantly impact trust and estate and business lawyers’ practices. This article addresses the rule’s background and purpose; key provisions of the rule, including who is considered a beneficial owner and what information is required to be reported; penalties for noncompliance; and practical guidance for trust and estate and business lawyers.

Background and Motivation for the Rule

FinCEN promulgated the BOI rule to implement section 6403 of the Corporate Transparency Act (CTA),1 a federal law passed in 2021 requiring reporting of company and beneficial owner information to FinCEN. A main objective of the rule is to “prevent and combat money laundering, terrorist financing, corruption, tax fraud, and other illicit activity.”2 The rule is intended to address deficiencies in the United States’ existing regulations combating threats to the integrity of the international financial system.3

Many of these threats are carried out through shell companies, which are entities that can be used to conceal their owners’ true identities. Although shell companies have legitimate and legal uses, they provide anonymity that can facilitate illicit and illegal acts around the globe. They allow billions of dollars to be transferred across borders every year to unknown owners.4 Shell companies are used to evade taxes and government sanctions, launder money, and finance terrorists.5 The Treasury Department estimates that roughly $300 billion from financial crime is susceptible to money laundering every year in the United States alone.6 Federal legislative and regulatory efforts to combat money laundering gained momentum following the 2022 Russian invasion of Ukraine, when domestic and foreign shell companies were used to evade sanctions imposed on Russia.

The rule complies with recommendations provided by the Financial Action Task Force (FATF), an international, intergovernmental task force that the United States helped found.  Over 30 countries have implemented some form of central register of beneficial ownership information, and more than 100 countries, including the United States, have committed to implementing beneficial ownership transparency reforms.7 By requiring the reporting of BOI and providing law enforcement, the intelligence community, regulators, and financial institutions access to a central BOI registry, the rule is intended to “diminish the ability of illicit actors to obfuscate their activities through the use of anonymous shell and front companies.”8

Who Does the Rule Affect?

The rule applies to domestic and foreign entities and requires a reporting company to provide information to FinCEN regarding (1) the reporting company itself, (2) each beneficial owner of the reporting company, and (3) the reporting company’s company applicant(s). Reporting companies created before January 1, 2024, are not required to report company applicant information but must report information regarding the reporting companies and each beneficial owner. The rule places the obligation to disclose information on the reporting company itself and does not impose any direct obligation on lawyers. The information required to be reported is listed in the accompanying table.

Reporting Companies

A “reporting company” is defined broadly to include any entity that is “a corporation, limited liability company, or other similar entity” and that is either (1) created by filing a document with a secretary of state or a similar office under the laws of a state or Indian tribe or (2) formed under the laws of a foreign country and registered to do business in the United States by filing a document with a secretary of state or a similar office under the laws of a state or Indian tribe.9

Because this definition includes only entities created by filing a document with a secretary of state or similar office, it may exclude many sole proprietorships, general partnerships, and certain types of trusts.10 Registering for a business license or similar permit does not in itself make an entity a reporting company.

The rule also provides 23 categories of entities that are exempt from the new reporting requirement. Many of the exempt entities are already required to disclose BOI under other state or federal laws, including publicly traded companies, banks, and insurance companies.11 Other entities are exempt because they are unlikely to be shell companies used for illicit purposes, including companies with (1) more than 20 full-time employees, (2) more than $5 million in gross sales, and (3) a physical office in the United States (large operating entities). Tax-exempt entities are also exempt from the rule. Inactive entities are exempt if they (1) were formed before January 1, 2020, (2) are not owned by any foreign persons, (3) are not engaged in an active business, (4) hold no assets, (5) have had no change in ownership in the prior 12 months, and (6) have not received more than $1,000 in the last 12 months.

FinCEN estimates that approximately 11% of the 36.5 million entities expected to exist by  January 1, 2024 (the effective date) will be exempt from the rule.12 Large operating entities and tax-exempt entities are projected to represent nearly 70% of exempt entities. FinCEN estimates that it will cost reporting companies with a simple ownership structure $85 to prepare and submit their initial BOI reports, but for reporting companies with complex ownership structures the estimated cost exceeds $2,500.13

Beneficial Owners

FinCEN requires a reporting company to identify and provide information for all beneficial owners of the reporting company. Beneficial owners are the persons who ultimately own or control the company. Consistent with the CTA, the BOI rule defines a beneficial owner as any individual who, directly or indirectly, (1) exercises substantial control over the reporting company, or (2) owns or controls at least 25% of the ownership interests of the reporting company.14

The “substantial control” component for identifying beneficial owners is likely the most subjective aspect of the rule. Substantial control can be exercised directly or indirectly, including by a trustee of a trust. An individual may be determined to have substantial control and deemed a beneficial owner if they (1) serve as or exercise the authority of a senior officer of the reporting company (including as general counsel); (2) have authority over the appointment or removal of any senior officer; (3) direct, determine, or have substantial influence over important decisions made by the reporting company; or (4) have any other form of substantial control over the reporting company.15 FinCEN clarifies that a lawyer advising a reporting company does not inherently qualify as a beneficial owner: “FinCEN does not envision that the performance of ordinary, arms-length advisory or other third-party professional services to a Reporting Company would provide an individual with the power to direct or determine, or have substantial influence over, important decisions of a Reporting Company.”16

The rule’s definition of ownership interest is intended to be broadly construed and includes a catchall provision to capture any “instrument, contract, arrangement, understanding, relationship, or mechanism used to establish ownership,” including instruments that are convertible into such interests.17 When calculating an individual’s ownership percentage, all options or similar interests of the individual are treated as having been exercised. An individual may directly or indirectly own or control an ownership interest of a reporting company, including through another individual acting as a nominee, custodian, or agent on behalf of such individual. Ownership or control of a parent company or other intermediary entity that owns or controls ownership interests in the reporting company can also qualify an individual as a beneficial owner of a reporting company.18

Regarding ownership interests held by trusts, multiple individuals can be deemed to own or control the same ownership interest. Under the rule, certain individuals with a relationship to a trust that holds at least 25% of the ownership interests could be treated as beneficial owners, including:

• an individual trustee or other individual with the power to dispose of trust assets;
• a beneficiary of a trust who is the sole permissible recipient of income or principal of the trust, or who can withdraw substantially all of the assets from the trust; and
• the grantor of any trust if the grantor has the right to revoke the trust or otherwise withdraw assets from the trust.19

It is unclear whether a trust protector would be deemed to own or control an ownership interest held by a trust. Therefore, a lawyer should counsel clients on the potential additional reporting requirements that could be triggered by naming a specific individual as a trust protector versus listing criteria for a trust protector who could be appointed by trust beneficiaries if necessary.

There are five exceptions to the definition of beneficial owner:

1. a minor child (provided the reporting company reports the required information regarding a parent or legal guardian of the minor child);
2. an individual acting as a nominee, intermediary, custodian, or agent on behalf of another individual;
3. an individual acting solely as an employee of a reporting company (excluding senior officers);
4. an individual whose only interest in a reporting company is a future interest through a right of inheritance; and
5. creditors of a reporting company.20

Company Applicants

A “company applicant” is both an individual responsible for creating a reporting company by directing or overseeing the preparation of the formation documents and an individual who directly submits the formation documents (if a different person). Under the rule, a reporting company can have a maximum of two company applicants. As it relates to a law firm responsible for forming entities on a client’s behalf, for example, there may be an attorney primarily responsible for overseeing the preparation and filing of incorporation documents and a paralegal who directly files them with a state office to create the reporting company. In this example, this reporting company would report two company applicants—the attorney and the paralegal—but additional individuals indirectly involved in the filing would not need to be reported.21 FinCEN believes that collecting this information about people directing or controlling the formation of the reporting company “would be highly useful to law enforcement, which might be able to draw connections between and among seemingly unrelated reporting companies, beneficial owners, and company applicants based on this additional information.”22

Implementing the Rule

Under the rule, FinCEN will create mandatory reporting forms as well as a secure national database that will maintain the submitted BOI. In addition to the BOI rule, FinCEN will publish two additional rules to implement the CTA. Notice was published on December 15, 2022, for the first additional rule, which will allow certain individuals or entities to access BOI as authorized by the CTA.23 The comment period closed on February 14, 2023. Another upcoming rule will address amendments to FinCEN’s existing Consumer Due Diligence (CDD) rule. FinCEN also intends to publish compliance and guidance documents to assist reporting companies with rule compliance.

Important Dates and Deadlines

A reporting company created or registered before the rule’s effective date (January 1, 2024) will have until January 1, 2025, to file its initial BOI report, while a reporting company created or registered on or after January 1, 2024, will have 30 calendar days after receiving notice of its creation or registration to file its initial report.

Compliance with the rule is an ongoing responsibility. A reporting company is required to file an updated report whenever there is a change to any “required information previously submitted to FinCEN concerning a reporting company or its beneficial owners, including any change with respect to who is a beneficial owner or information reported for any particular beneficial owner.”24 For example, this means that an updated report will need to be filed whenever (1) a change in the capital structure of a reporting company results in a new individual owning 25% or more of the entity or in an individual’s ownership dropping below 25%, (2) a beneficial owner dies, or (3) a reporting company or a beneficial owner changes their address. FinCEN estimates that nearly 20% of reporting companies will be required to file an updated report in any given year.25

Changes to information in a previously submitted BOI report must be filed in an updated report submitted within 30 calendar days of the change. If a reporting company filed an inaccurate report, then it must file a corrected report within 30 calendar days of the date it becomes aware, or has reason to know, that the report is inaccurate.

Protection of Reported Information

All reports filed under the CTA and its implementing regulations will be exempt from search and disclosure under the Freedom of Information Act of 1966. The CTA authorizes FinCEN to disclose BOI under specific circumstances to five general categories of recipients:

1. US federal, state, local, and tribal government agencies requesting BOI for specified purposes;
2. foreign law enforcement agencies, judges, prosecutors, central authorities, and competent authorities;
3. financial institutions using BOI to facilitate compliance with CDD requirements under applicable law;
4. federal functional regulators and other appropriate regulatory agencies acting in a supervisory capacity assessing financial institutions for compliance with CDD requirements; and
5. the Treasury Department.26

FinCEN acknowledged the “sensitivity inherent in collecting any personal identifying information and takes seriously the need to maintain the highest standards for information security protections for information reported to FinCEN . . . .”27 Information will be maintained in a registry called the Beneficial Ownership Secure System (BOSS), which will be cloud-based and will meet the highest Federal Information Security Management Act (FISMA) level—FISMA High. A FISMA High rating establishes standards for baseline information security controls to reflect that losing the confidentiality, integrity, or availability of system information would have a severe or catastrophic adverse effect on the organization maintaining the system, including on organizational assets or individuals.28

In some instances, reporting residential street addresses may present significant challenges, such as ensuring the safety of victims of domestic violence and other crimes. FinCEN plans to address these concerns in the future, likely as a part of additional rulemaking to establish parameters and safeguards for accessing and protecting BOI.29

Penalties

The BOI rule establishes civil and criminal penalties for persons who “willfully provide, or attempt to provide, false or fraudulent beneficial ownership information . . . or “willfully fail to report complete or updated beneficial ownership information” to FinCEN.30 The civil penalties include fines of up to $500 for each day a violation continues or has not been remedied. Persons who criminally violate the rule may be fined up to $10,000, imprisoned for up to two years, or both.

The rule defines “persons” as any individual, reporting company, or other entity. While only reporting companies are required to file reports with FinCEN, individual beneficial owners and company applicants may provide information about themselves to reporting companies for the reporting companies to comply with their obligations. Thus, both an individual who provides fraudulent BOI to a reporting company and the reporting company itself may be liable. A person is considered to have failed to report complete or updated beneficial ownership information if they caused the failure or were a senior officer of the entity at the time of the failure. Any assessment as to whether false information was willfully filed will depend on the facts and circumstances surrounding the certification and reporting of the BOI. Inadvertent mistakes by a reporting company conducting due diligence are not likely to constitute a willfully false or fraudulent violation.31 FinCEN stated it intends to “prioritize education and outreach to ensure that all reporting companies and individuals are aware of and on notice regarding their reporting obligations.”32

Practical Guidance

In addition to imposing an obligation on reporting companies, the rule will have an impact on attorneys practicing business and trust and estate law. For example, a lawyer may now need to consider including in an engagement letter whether the scope of work includes compliance with the rule. In addition, a client’s reluctance to disclose sensitive personal information may require advising the client to choose a different entity. A lawyer may consider adding a provision to an operating agreement that would address the entity’s obligations under the rule, identifying the individual responsible for ensuring compliance, and setting forth obligations to provide and maintain current BOI. Confidentiality clauses also may need to be revised to allow reporting companies to disclose the owner’s BOI to FinCEN.

The information required to be reported may take some time to prepare, so attorneys should educate clients about the rule well in advance of the January 1, 2025, reporting deadline for existing companies. Additionally, they may consider assisting clients with implementing policies and procedures to manage this information and to identify when the obligation to file an updated report has been triggered.

An attorney may also consider encouraging clients to apply for a FinCEN Identifier (FinCEN ID). A FinCEN ID is a unique identifying number that FinCEN will issue to individuals or reporting companies upon request, subject to certain conditions. For individuals, FinCEN will issue a FinCEN ID if an individual submits to FinCEN the same BOI required from a beneficial owner or company applicant. FinCEN will then allow a reporting company to use an individual’s or entity’s FinCEN ID in lieu of providing BOI with respect to such individual or entity.33

Reporting Requirements and the Rules of Professional Conduct

Many previous efforts to combat money laundering sought to subject lawyers to client due diligence requirements that might conflict with a lawyer’s obligations regarding attorney-client privilege. One effort, the Establishing New Authorities for Business Laundering and Enabling Risks to Security Act (the ENABLERS Act), was proposed in 2021 to expand the definition of “financial institution” under the Bank Secrecy Act of 1970 to include lawyers involved in forming companies and transferring money into the US financial system. This inclusion would have imposed stringent anti-money-laundering requirements on lawyers, including suspicious-transaction reporting requirements.34 The ENABLERS Act passed the House but was blocked by the Senate in 2022. The American Bar Association (ABA) has worked to ensure that the legal profession generally is not subject to such federal legislation, rules, and regulations.35

Although the ABA supports “reasonable efforts of the United States government to detect, deter, and combat money laundering,”36 it recently passed a resolution opposing any legislation that would require lawyers to flag potentially illicit financial activity by their clients, arguing such a move would violate longstanding principles around client confidentiality.37 The ABA is in the process of updating the ABA Model Rules of Professional Conduct to clarify a lawyer’s client due diligence obligations, particularly as they relate to new clients. The ABA is considering proposed changes to the comments of the Model Rules related to concerns about lawyers facilitating money laundering.38 The proposed amendments focus on providing guidance regarding a lawyer’s existing client due diligence obligations, as the ABA believes the current rules create an enforceable duty to inquire of a client when certain risks are present.39

In advising clients with respect to the BOI rule, lawyers should consider the risk-based approach currently endorsed by the ABA and adopted by Colorado, which “urges lawyers to assess money-laundering and terrorist financing risks by examining the nature of the legal work involved, and where the business is taking place.”40 Under this approach, lawyers may undertake client due diligence in appropriate circumstances to avoid facilitating illegal activity in violation of the Model Rules. Pursuant to a lawyer’s ethical obligations under numerous Model Rules, a duty to inquire further and to possibly to decline or withdraw representation may also arise.41

Conclusion

The penalties for noncompliance with the BOI rule are significant, and reporting companies will need assistance to implement policies and procedures to ensure continuous compliance with the rule. Lawyers practicing business law and trust and estate law should begin thinking about how the rule affects their clients and taking steps to integrate compliance measures.

---

Explore This Issue

This Is What We Owe to Each Other

President’s Message

By J. Ryann Peyton

Amber Paoloemilio

Under Oath

Virtual Technology in Colorado State Courts

The Chief’s Corner

By Brian D. Boatright

Related Topics

Notes