FinCEN's CTA Reporting Regime Has Gone into Effect and Will Affect Almost All Startup Companies

This is an update to the August 18, 2023 article published on the Maine Venture Fund's website. The article on this site was orginally published on November 27, 2023 and has been updated since the CTA Reporting Regime went into effect.

The days of anonymous ownership and control of U.S. legal entities have drawn to a close, and nearly every startup company in America is being called upon to file so-called Beneficial Ownership Information (BOI) reports with FinCEN, a bureau of the U.S. Treasury Department.

The Corporate Transparency Act (CTA) was enacted in January 2021 to strengthen existing anti-money laundering statutes. It creates a massive new reporting regime whose burdens will fall primarily on smaller companies, and generally will not apply to larger companies. FinCEN will use the collected information to construct an enormous database of sensitive PII (personally identifiable information) about 100 million individuals or more, ultimately. The CTA requires the database to be protected against disclosure to the public at large but will be broadly available to law enforcement agencies and financial institutions.

In September 2022, FinCEN published a 99-page release explaining its implementing rule under the CTA. This article is intended to provide startup company management with a simplified overview of key aspects of that rule. Further details about the new CTA Rule can be found at: https://www.verrill-law.com/gregory-s-fryer/publications-podcasts.

Existing Entities

If your startup company qualifies as a Reporting Company (and it probably does unless it reported more than $5M in revenues on its latest tax return and has more than 20 full-time employees, as discussed below), you will be obligated to report basic information about the company itself and (with limited exceptions) will be obligated to collect and report specific PII for the following covered individuals (referred to in the CTA Rule as Beneficial Owners):

• the “senior officers” of the company (defined as President, CEO, CFO, COO, CLO); plus typically, each outside director of the company; plus any other individual who has substantial influence (other than arising solely from employee status) over important company decisions (for example, members of the startup company’s board of directors or equivalent governing body will typically be treated as Beneficial Owners);
• each controlling person of any investor that holds significant approval or veto rights on important company decisions; and
• any individual who owns or controls (directly or indirectly) at least a 25% stake in the voting power or equity value of the company.

Here are the five items of PII a company must report to FinCEN about each such Beneficial Owner:

• Full legal name (including middle name and suffix, where applicable);
• Date of birth;
• Street address of primary residence (not a P.O. box or a business address);
• Unique identifying number from one of the following non-expired governmentally issued ID documents: U.S. passport; State driver’s license; or other ID document issued by a State, local government, or Indian tribe; and
• An image of that same non-expired ID document.

For companies already in existence before the end of 2023, the deadline for filing BOI reports is January 1, 2025. Thus for a pre-existing startup company, you do have time to educate yourself about the details of these new requirements, but it is important that you be aware of the looming implications of this for your business. In particular, be aware that you will need cooperation from all covered individuals in order for you to collect the necessary PII. You also will need those people to promptly disclose future changes in their reported PII, because a Reporting Company has a duty to monitor its reported information and has just 30 days to update any information in its BOI report that has become inaccurate. For many companies, this duty to update will pose a greater challenge than filing the initial BOI report.

Companies Formed after 2023

With few exceptions, entities formed after 2023 will have nearly immediate reporting obligations—their initial BOI report is due just 90 days (if formed in 2024) or 30 days (if formed thereafter) following the date of incorporation or other formation (measured by the date the secretary of state or similar office first acknowledges such formation). In addition to the types of covered individuals listed above, entities formed after 2023 will also need to provide PII on one or two Company Applicants—namely, the individual who made the formation filing with and (if applicable) another individual who was primarily responsible for directing or controlling such filing.

FinCEN Identifiers

We expect that many angel investors and venture capital firm managers will seek FinCEN Identifiers, and that many lawyers and paralegals who routinely form new entities (as Company Applicants) will do likewise. We also expect that many startup companies will encourage their own executives and outside directors to obtain FinCEN Identifiers, and thus simplify the company’s data collection and update obligations.

Exempt Entities

The CTA exempts many categories of institutions and larger companies from being treated as a Reporting Company, such as: SEC-reporting public companies; banks, insurance companies, and other heavily-regulated firms; many larger venture capital firms and other pooled investment vehicles; government agencies and quasi-governmental entities; and tax-exempt organizations and foundations.

In addition, there is an exemption for any entity (i) that has operations and more than 20 full-time employees in the U.S., and (ii) whose previous year federal income tax return (or information return) reported more than $5 million of gross receipts (excluding gross receipts from sources outside the U.S.). Many later-stage startup companies will qualify for this exemption.

Most subsidiaries of an exempt entity are also exempt.

Exempt Entity ≠ Free Pass for its Control Persons

An entity that holds equity in a Reporting Company might qualify as an exempt entity. But that is not the end of the inquiry. If the entity has board representation rights or is in a position to exercise special approval or veto rights over important matters, then—irrespective of the exemption—one or more individuals associated with the investor entity will generally be treated as a Beneficial Owner of the startup company. The startup company will thus need to report PII about (or provide FinCEN ID numbers for) any investor entity’s managers or other control persons who constitute Beneficial Owners of the Reporting Company. Purely passive owners of an exempt investor (such as outside limited partners in a private equity fund) may escape BOI reporting (even if holding a 25⁺% stake in the startup company) because a special rule allows the startup company to name the exempt entity instead of naming the passive owner.

Questions for Future Planning

Even though the CTA reporting deadline for a pre-existing startup company is now several months away, here are some questions that its CEOs and CFOs should start considering:

• How many of our directors and senior officers will our company need to report on? Are any of these likely to resist providing PII (and resist applying for FinCEN Identifiers)?
• Are there any investors who have board representation rights or are in a position to exercise special approval or veto rights? Is it obvious to us who their controlling persons and major underlying owners are? If not, how difficult will it be for us to get the investor to volunteer such information to us?
• Does our company have sufficient technical capability to protect all PII provided to us for BOI reporting purposes?
• Should our board designate a CTA Officer with responsibility and authority to identify all relevant Beneficial Owners, collect their PII (or FinCEN Identifiers), and monitor for changes in any information included in our BOI report? Will that person be covered by our standard indemnification provisions and our D&O liability insurance?
• What is the likelihood that we will seek additional capital from sources that are not current investors in our company, or that we will seek to sell the company—events that may trigger a need to convince third parties that the company has properly handled its BOI reporting obligations?

We suggest that startup companies should remain alert for opportunities to better understand their new CTA obligations, and should consult with legal counsel as they design and implement their plans for addressing those obligations.