FinCEN BOI Reporting Requirements in Plain English

Most private companies in the United States will soon need to disclose sensitive ownership and control information to FinCEN, a bureau of the U.S. Treasury Department. The new reporting regime arises under the Corporate Transparency Act (CTA), enacted on January 1, 2021 to strengthen existing anti-money laundering statutes. Rulemaking under the CTA continues,[1] but the reporting framework contained in FinCEN’s “Beneficial Ownership Information Reporting Requirements” rule will begin to be implemented by January 1, 2024. This article is intended to explain the major elements of FinCEN’s published rule but does not cover each and every aspect of the rule.

Overview

Beginning January 1, 2024, any newly formed “Reporting Company” (defined below) must file a Beneficial Ownership Information (BOI) Report within 30 days after formation. Reporting Companies already in existence before January 1, 2024 will have until January 1, 2025 to file their BOI Reports.

In its BOI Report, a Reporting Company not only must provide identifying information about itself but also must disclose sensitive personal information about various covered individuals associated with the company. In the case of a corporation, the list of covered individuals generally includes the company’s senior officers, its directors, and any other individuals who “exercise substantial control” over the corporation. (In the case of LLCs or other non-corporate entities, functionally equivalent positions make up the list of covered individuals.) For entities formed on or after January 1, 2024, the BOI Report must also include certain individuals who filed the paperwork to form the entity.

For each covered individual, the Reporting Company must collect and report the following personal information: full name, current address, date of birth, and proof of identity. Proof of identity requires submitting an image of his or her non-expired driver’s license, passport, or other suitable government-issued ID document. Alternatively, if the particular individual has pre-registered with FinCEN (thereby directly furnishing that same requisite information), then the Reporting Company may provide his or her FinCEN Identifier number instead of collecting and providing the required personal information.

Reporting Companies and holders of FinCEN Identifiers must be alert to changes in or corrections of relevant reported information. Generally, they have only 30 days to file an update or correction. Failure to timely and accurately file required information can trigger civil penalties and criminal sanctions.

Which Entities Must File Reports?

To appreciate how many entities operating in the U.S. will need to file BOI Reports, it is helpful first to understand what types of entities are not subject to BOI reporting.

Exempt Entities. Here are the major categories of exempt entities:

• Banks and bank holding companies, SEC-registered broker-dealers and investment advisers, SEC-registered mutual funds and other investment companies, SEC-reporting venture capital fund advisers, and certain other categories of government-regulated entities;
• Venture capital funds or other pooled investment vehicles if operated or advised by an already-regulated entity referenced above;
• SEC-reporting public companies;
• Any entity that (i) has more than 20 full-time employees[2] in the U.S., (ii) regularly conducts business at a physical location in the U.S., (iii) filed a federal income tax return for the previous year, and (iv) reported on that tax return more than $5 million in U.S. gross receipts/sales (net of returns and allowances) for that previous year on a consolidated basis (these entities are referred to below as “Exempt Larger Companies”);
• Most tax-exempt organizations, charitable trusts, and private foundations;
• Most tax-exempt political organizations; and
• Governmental authorities or entities.

Importantly, the list of exempt entities also includes wholly-owned subsidiaries of most of these exempt entities, including those of public companies and Exempt Larger Companies.

An inactive entity also is exempt if it (i) was already in existence on January 1, 2020, (ii) holds no assets (including ownership interests in other companies), (iii) during the previous 12-month period neither sent nor received more than $1,000 of funds, whether directly or through a bank account or other financial account, (iv) has no non-U.S. owners, and (v) has not experienced any change in ownership during the preceding 12 months.

Note that the Exempt Larger Companies category will exclude many existing companies. However, newly formed entities cannot qualify for this particular exemption – regardless of employee count – until they have filed a prior year tax return reporting at least $5 million in gross receipts. Once all qualifying conditions are met, the company will need to update its prior BOI Report to show its newly acquired exempt status.

Excluded Entities. Domestic trusts and general partnerships that are created by operation of law without the filing of a formation document with a secretary of state (or similar office) under the law of a State or Indian tribe are excluded from having to file BOI Reports, as are sole proprietorships. Foreign companies are excluded, too, unless and until they register to do business in the U.S. by filing a document with a secretary of state (or similar office) under the law of a State or Indian tribe.

The Remainder. Generally, all other entities with a presence or operations in the U.S. (referred to here as “Reporting Companies”) will need to file BOI Reports.

What Information Must a Reporting Company Report About Itself?

In its initial report, the Reporting Company must disclose to FinCEN the following information about itself: its full legal name and jurisdiction of formation; each other trade name under which it does business; the street address of its principal place of business in the U.S.; and its Employer Identification Number (EIN) or other U.S. Taxpayer Identification Number (TIN).

Which Individuals Must be Identified as the “Beneficial Owners”?

In its initial report, the Reporting Company must also identify each “Beneficial Owner,” defined as any individual who falls into one or more of the following categories:

• Is a “senior officer” – defined to include each individual (regardless of title) who holds the position or exercises the authority of a president, chief financial officer, general counsel,[3] chief executive officer, or chief operating officer, or who performs a similar function for the Reporting Company;
• Otherwise directs, determines, or has “substantial influence” over important decisions of the Reporting Company. Typically, this typically will include any director (or equivalent) of the Reporting Company and will include any other individual who (directly or indirectly):
  • Has authority over the appointment or removal of any senior officer or a majority of the board of directors (or similar body) of the Reporting Company; or
  • Has a right (by contract or otherwise) to force or block important decisions made by the Reporting Company, such as:
    • Compensation schemes and incentive programs for senior officers;
    • Entry into or termination of significant contracts; or
    • Amendments of any substantial governance documents of the reporting company, or of significant policies or procedures of the reporting company; or
• Owns or controls (directly or indirectly) at least 25% of the total voting power in the entity or at least 25% of the total value of the economic interests in the entity.

The tally of individuals with “substantial influence” need not include individuals whose influence “is derived solely” from status as employees of the company (except for senior officers – they always are reportable as Beneficial Owners). Also excluded are creditors whose influence arises solely through typical rights or interests for payment of a predetermined sum of money – in contrast, a lender who receives equity interests or atypical approval rights will trigger Beneficial Owner disclosures if those rights allow it to force or block important decisions of the Reporting Company.

The 25% ownership threshold of an entity or individual is calculated assuming full exercise of all stock options, convertible notes, or other purchase rights which are held or controlled by that person (whether or not then vested or exercisable), but without assuming exercise by other persons who hold purchase rights. In the case of complex ownership structures with multiple classes of equity, if ownership of 25% or more of the total interests cannot be calculated with “reasonable certainty,” then any individual who owns or controls 25% or more “of any class or type of ownership interest” of the Reporting Company shall be deemed to own or control 25% or more of the ownership interests of that company.

What Must be Disclosed about Each Beneficial Owner?

A Reporting Company’s initial BOI Report must include the following personal information for each individual who is a Beneficial Owner:

• Full legal name (including middle name and suffix, where applicable);
• Date of birth;
• Complete current residential street address (not a post office box or a business address);
• Unique identifying number from one of the following non-expired governmentally issued ID documents: U.S. passport; State driver’s license; or other ID document issued by a State, local government, or Indian tribe. (An identifying number from a non-expired foreign passport may be used if the person has none of the approved domestic ID documents.)
• An image of that same non-expired ID document showing the unique identifying number being used.

Note that the required disclosures stop there – the Rule imposes no requirement to disclose the quantum of ownership or the reason for including the individual among the listed Beneficial Owners. Note, too, that the Reporting Company may substitute the individual’s FINCEN Identifier number (discussed below) in lieu of the required personal information.

The Rule provides a special exception for any individual who is an indirect 25%⁺ owner of a Reporting Company exclusively through one or more exempt entities if the BOI Report instead simply names those entities. Exempt venture capital funds (for example) may prefer this and thereby avoid having to reveal to the Reporting Company the identities of significant participants in the fund. Either way, any fund official (regardless of title) who exercises substantial influence over the Reporting Company (including through board representation or by controlling important veto rights) must be identified as a Beneficial Owner.

For a child who has not reached the age of majority, the Rule also provides a reporting exception if the required personal information is instead provided for the child’s parent or legal guardian.

Which Individuals Must be Identified as “Company Applicants”
and What Must be Disclosed about Them?

FinCEN also wants to know who actually set up the entity. The Rule requires each Reporting Company to identify one or two individuals who were the “Company Applicants,” defined as:

• The individual who directly files the document that first creates or registers the entity in the U.S.; plus
• If more than one individual is involved in the filing of the document, the individual who is primarily responsible for directing or controlling such filing.

For each Company Applicant, a Reporting Company must report the same personal information as for a Beneficial Owner, except that:

• If the Company Applicant regularly forms or registers entities in the course of his or her business, the street address of the business is to be provided, not his or her residence address; and
• If the Reporting Company was formed before January 1, 2024, it need not identify any Company Applicant.

Note that the Reporting Company may provide the FinCEN Identifier number (discussed below) for a Company Applicant in lieu of the required personal information (just as with a Beneficial Owner).

What is a FinCEN Identifier?

An individual may seek a unique “FinCEN Identifier” number by filing an application with the same personal information as would be required to be reported about such person in a BOI Report. A Reporting Company may rely upon and cite a person’s FinCEN Identifier number instead of collecting and reporting the person’s personal identifying information. Particularly for those in the business of forming entities and for those who have substantial ownership interests or officer/director positions in multiple companies, the FinCEN Identifier may prove convenient and offers a way to avoid having to expose potentially sensitive personal information to each relevant Reporting Company.

What if Information Changes?

A Reporting Company has just 30 days to file an updated (or corrected) report with FinCEN if the company learns of any change in (or correction to) information it previously reported about itself or about its Beneficial Owners.[4] Likewise, an individual who obtained a FinCEN Identifier has just 30 days to report a change in (or correction to) any information in his or her initial application.[5]

Who is Responsible for the Content of the Report or Application?

It is the responsibility of a Reporting Company to collect and submit to FinCEN in a timely fashion all required information for each Beneficial Owner and each Company Applicant. Each entity filing a BOI Report must certify that the report is “true, correct, and complete.”

Likewise, a person who a FinCEN Identifier application must certify that the application is “true, correct, and complete.”

What are the Penalties for Noncompliance?

The Act makes it unlawful for any person to willfully provide, or attempt to provide, false or fraudulent Beneficial Ownership Information to FinCEN, or to willfully fail to report complete or updated such information to FinCEN. Reporting violations can lead to civil penalties of up to $10,000 and/or fines and imprisonment for up to two years, or both.

Liability extends as well to any person who furnishes false or fraudulent information to the Reporting Company (and thus, indirectly, to FinCEN), including a fraudulently manipulated identifying photograph or document. Liability also can extend to any person who, at the time of the failure, was a senior officer of a Reporting Company that fails to comply with the CTA requirements.

The Release accompanying the final Rule states that “as a general matter, FinCEN does not expect that an inadvertent mistake by a reporting company acting in good faith after diligent inquiry would constitute a willfully false or fraudulent violation.” Even so, the penalties and uncertainties are such that in cases of doubt, overreporting is safer than underreporting.

Who Gets Access to the Information?

Under the Act, FinCEN is required to protect the disclosed information but may share it upon an appropriate request from (among others):

• a Federal agency engaged in national security, intelligence, or law enforcement activity;
• a State, local, or Tribal law enforcement agency, if the request is authorized by a court;
• a financial institution, to facilitate its compliance with customer due diligence requirements under applicable law; or
• the IRS for tax administration and enforcement purposes.

Anticipated Next Steps for FinCEN?

• On December 15, 2022, FinCEN published a Notice of Proposed Rulemaking for a set of rules and protocols for agency and financial institution requests to FinCEN for disclosures of Beneficial Ownership Information, and for the use, storage, and protection of such information. Those rules will need to be finalized during 2023.
• On January 17, 2023, FinCEN published draft formats of its online BOI Report and its online FinCEN Identifier Application. The public comment period for both forms ran through March 20, 2023; numerous comments were submitted. FinCEN has not yet published revised formats that address those comments but will need to finalize its online submission forms before the end of 2023.
  • Both formats will require the filer to obtain a login.gov account, and can be submitted only through that online platform.
  • It presently is unclear whether FinCEN will allow the filing of BOI Reports and (more importantly) FinCEN Identifier applications before the January 1, 2024 implementation date. Several commenters have recommended that early filing be permitted.
• FinCEN is required by statute to publicize BOI Reporting requirements and timelines, and to develop and publish additional guidance for companies and other affected members of the public.
  • Initial guidance was published on March 24, 2023, including a Frequently Asked Questions (FAQ) memo, one-page summaries on key filing dates and key questions, and two brief instructional videos.
  • FinCEN also must publish more detailed explanatory materials labeled as “small entity compliance guides” per the Small Business Regulatory Enforcement Fairness Act of 1996.
• FinCEN will need to develop, test, and implement the information technology platform that it will use to collect and store this confidential information and to allow confidential searches of the resulting database.

Further Thoughts

FinCEN estimates that 32⁺ million entities will meet the definition of a Reporting Company in 2024 (a figure that excludes 4 million exempt entities) and that 5 million new entities per year will add to those ranks. It estimates that 95% of those entities will report 6 or fewer covered individuals. That leaves 1.6 million entities FinCEN describes as having “complex structure” – for those entities, FinCEN estimates that the initial BOI Report will, on average, consume 11 hours of effort (half of which will be attorney time). For many investor-backed companies, however, the burden could be much greater.

In a future article we will address some of the subtleties of “substantial control” and “25% ownership interest” as they relate to investor-backed companies with complex capital structures.