Beginning January 1, 2024, the Corporate Transparency Act (CTA) will require most entities formed or registered to do business in the United States to disclose detailed information regarding their owners, officers, and control persons to the U.S. Department of the Treasury (Treasury) Financial Crimes Enforcement Network (FinCEN). The CTA implements the most significant revisions to the U.S. anti-money laundering/countering the financing of terrorism (AML/CFT) compliance framework in more than 20 years, applying sweeping beneficial ownership disclosure requirements with vast impacts on U.S. business, as well as foreign entities and individuals with U.S. business interests.
The CTA received broad bipartisan support at its passage in 2021, with the laudable aims to enhance transparency about ownership of corporate structures in the United States and thereby strengthen the federal government's efforts to combat money laundering, corruption, sanctions evasion, and other illicit activities that may be perpetrated through the anonymity provided by corporate structures. The penalties for noncompliance, both civil and criminal, are stringent and include significant fines and up to two years' imprisonment.
Although the CTA's disclosure requirements will become effective January 1, 2024, there are still many unknowns and significant ambiguities as to how this new law will be implemented and enforced. Notably, FinCEN is not prepared to provide access to the reporting database until January 1, increasing anxiety regarding how affected entities will develop procedures to comply with these complex rules in time to meet reporting deadlines. There is also critical rulemaking that remains to be finalized regarding access to the information provided to FinCEN, as well as related rules regarding the interplay of CTA reporting with customer due diligence obligations applicable to U.S. financial institutions.
In this article, we provide an overview of the rule with references to open questions and key ambiguities that remain to be addressed, discuss liability and likely enforcement trends, and provide suggested compliance considerations for impacted entities and individuals.
A Brief Overview of the CTA
Starting on January 1, 2024, the CTA will require most U.S. entities and foreign entities registered to do business in the United States to identify their Beneficial Owners to FinCEN. There are 23 exemptions to the CTA, which are discussed in more detail below.
Unless exempt, domestic and foreign entities are required to report to FinCEN if they are "created by the filing of a document" or "registered to do business by the filing of a document" with a secretary of state or similar office in any U.S. state or tribal jurisdiction. This will sweep in all manner of corporations, limited liability partnerships, limited liability companies, general and limited partnerships, and even business trust. Importantly, trusts will typically not be covered by the rule, as they are generally created by a trust agreement or trust deed rather than a state filing. Entities required to report are known in the parlance of the CTA as "Reporting Companies."
Reports will be filed electronically through a secure, cloud-based system that is accessible only to federal law enforcement for specifically designated purposes. Banks subject to customer due diligence obligations under the Bank Secrecy Act (BSA) are also likely to have access, though the breadth of that access remains undetermined, as discussed in more detail below.
The Reporting Company must report its full legal name, any alternative names through which it engages in business, its business street address in the United States, jurisdiction of formation or registration, and Taxpayer Identification Number (TIN).
Reporting Companies will also be required to provide detailed information to FinCEN about all "Company Applicants" and "Beneficial Owners," as each of those terms is defined under the CTA. They will be required to disclose each individual's full legal name, date of birth, current residential or business street address, and a unique identifying number from an acceptable identification document (e.g., a driver's license or passport) as well as a copy of that document—or the individual's FinCEN identifier (FinCEN ID).
A FinCEN ID may be issued by FinCEN to individuals or entities upon request. Collection of FinCEN IDs in lieu of personal information will offer significant efficiencies and risk mitigation in so far as it will shift the burden of maintaining and updating accurate information regarding individual Beneficial Owners from the Reporting Company to the individual holder of the FinCEN ID.
Who Are Company Applicants?
Company Applicants will include (1) the individual who directly and physically files the document that creates a domestic entity or registers a foreign entity, as well as (2) the individual who is primarily responsible for directing or controlling such filings. For example, in the case of a law firm forming an entity, a paralegal and partner will likely be expected to be reported. In the case of a formation done through a third-party corporate service provider, their personnel responsible for filing the formation documents will be Company Applicants, as well as the individual who engaged them and directed the formation be made.
Company Applicants will be permitted to use their business address if they are exclusively serving as a Company Applicant in the course of business. However, each individual is only permitted to hold one FinCEN ID. Thus, if for any reason an individual needs a FinCEN ID for nonbusiness purposes (i.e., they are a Beneficial Owner of an entity in their personal capacity), then their residential address will be required to be reported.
Importantly, the Company Applicant is not (necessarily) the person who files the CTA report. They may undertake no services whatsoever in relation to CTA reporting notwithstanding their role in forming the entity. Company applicants' details—or FinCEN ID—are required to be reported in the entity's CTA report by whomever files that report and will be available to law enforcement as potential contacts in relation to future questions regarding the Reporting Company's activities.
Also, Reporting Companies formed prior to January 1, 2024, will not be required to report Company Applicants.
Who Are Beneficial Owners?
"Beneficial ownership" is defined very broadly and includes any and all individuals who, directly or indirectly, either:
- Exercise "substantial control" over a Reporting Company. Substantial control individuals required to be reported under the rules explicitly include: (1) senior officers (for example, "president, chief financial officer, general counsel, chief executive officer, chief operating officer, or any other officer, regardless of official title, who performs a similar function"); (2) anyone with authority over the appointment or removal of any senior officer or a majority of the board of directors (or similar body); and (3) anyone else who "directs, determines, or has substantial influence overimportant decisions made by the reporting company" or has "any other form of substantial control over the reporting company." Whether a particular member of the board of directors meets any of these criteria is a question that the Reporting Company must consider on a director-by-director basis.
- Own or control at least 25% of the ownership interests of a Reporting Company, to include rights such as a "put, call, straddle, or other option or privilege of buying or selling" that are treated as exercised and calculated at the present time for purposes of meeting the CTA ownership reporting threshold. In determining whether an individual is a "Beneficial Owner" by virtue of ownership, interests held directly and indirectly must be considered, as well as aggregated interests across multiple intermediate entities (e.g., a smaller stake held by an individual through multiple intermediate owner entities may aggregate to a 25% or greater stake in the Reporting Company and trigger reporting).
With regard to Reporting Companies owned by trusts or similar arrangements, Beneficial Owners will include any of the following, to the extent that the interest of the trust (or aggregated interest of multiple trusts through which they may be Beneficial Owners) represents a 25% or greater ownership interest in the Reporting Company:
- Trustees of the trust or other individuals (if any) with the authority to dispose of trust assets (e.g., protectors, investment committee members, etc., depending on the terms of the trust agreement).
- Any beneficiary who (1) is the sole permissible recipient of income and principal from the trust or (2) has the right to demand a distribution of or withdraw substantially all the assets from the trust.
- Any grantor or settlor who has the right to revoke the trust or otherwise withdraw the assets of the trust.
This may also include grantors who retain substitution rights that would allow them essentially an option to own a 25% or greater interest in a Reporting Company by substituting alternative assets into the trust.
Given the breadth of this definition, an individual may be a Beneficial Owner under multiple analyses. Importantly, the Reporting Company will only need to include information for everyone determined to be a Beneficial Owner, without reporting any information explaining the basis for or reasoning behind that determination. Thus, once a determination is made that a particular individual's ownership interests or control over a Reporting Company triggers reporting, there may be no practical need to confirm whether there exists an alternate basis on which they may be considered a Beneficial Owner.
Helpfully, FinCEN recently adopted a modification to the rules allowing Reporting Companies that are wholly owned by and have identical Beneficial Owners to other Reporting Companies to report the FinCEN ID of their parent company rather than completing a duplicative report. This will create significant efficiencies in complex corporate structures in so far as subsidiary reporting can be streamlined, and updates to CTA reports can be maintained in a single parent company CTA report.
Also, where Beneficial Owners are exempt entities (as described in more detail below), the Reporting Company may include the names of the exempt entities in lieu of information regarding beneficial ownership of the entity.
Reporting Timelines
Entities formed after January 1, 2024, will have 90 days to file their initial reports in 2024, per a recently adopted revision to the rules in recognition of the complexity of this reporting requirement. After 2024, entities will have 30 days to report after formation, barring further regulatory proposals by FinCEN that could extend that timeline. Entities formed before January 1, 2024, will have until January 1, 2025, to make their initial filing.
In addition to the initial reporting, Reporting Companies must report any changes regarding CTA reports within 30 days of the change. This includes changes to senior officers, equity ownership, and contingent rights. Notably, if FinCEN IDs are reported in place of personal details, the burden will be on the individuals to update FinCEN as to changes.
Where a Reporting Company becomes aware of an inaccuracy in a previously filed report, the company will have 30 days after becoming aware of the inaccuracy to file a corrected report. There is a safe harbor from liability if this report is filed within 90 days after the date on which the inaccurate report was filed.
Updating Requirements
If there is any change regarding required information submitted to FinCEN about a Reporting Company or its Beneficial Owners, including any change regarding who is a Beneficial Owner or information reported for any particular Beneficial Owner, the Reporting Company must file an updated CTA report within 30 days of the change. The duty to update means that companies relying on exemptions (as discussed in more detail below) must be mindful of any changes that may change their exempted status and report quickly thereafter. A Reporting Company does not have to file an updated report upon company termination or dissolution.
Again, the use of FinCEN IDs rather than reporting individual beneficial ownership information will provide important efficiencies regarding updates relating to individual Beneficial Owners or Company Applicants. It will also eliminate the need to update multiple reports for each Reporting Company that may be affected by a change to an individual's information previously submitted to FinCEN.
Also, it bears noting that expiration of identifying documents will not require CTA updates to affected reports. The rule states that documents only need to be updated "when the name, date of birth, address, or unique identifying number on such document changes."
CTA Exemptions in a Nutshell
FinCEN has specifically exempted 23 types of entities from reporting, including U.S. Securities and Exchange Commission (SEC) registered issuers, banks, and other types of regulated financial institutions; tax-exempt entities; insurance companies; accounting firms; certain inactive entities; investment companies and investment advisers; pooled investment vehicles; U.S. governmental authorities; and public utilities and large operating companies.
Some of the more complex and common exemptions are discussed in more detail below.
Large Operating Companies
The large operating company exemption applies to entities that meet criteria regarding (1) the entity's number of employees, (2) its operating presence, and (3) its gross receipts or sales. An entity must meet all three criteria to qualify for the large operating company exemption. However, as explained in more detail below, any entity that does not meet this criterion but is a wholly owned subsidiary of an exempt "large operating company" will also be exempt from reporting.
Notably, a large operating company must have more than 20 employees on a full-time basis in the United States, and the CTA does not permit companies to consolidate employee headcount across affiliated entities. The determination as to whether an entity employs more than 20 employees must be made on an entity-by-entity basis. Thus, for instance, parent companies cannot count employees of their subsidiaries, and sister companies cannot aggregate their employees. In addition, any dual employee and employee secondment arrangements must be reviewed closely to determine which entity effectively controls and directs the individual who performs the services. A large operating company must also have an operating presence at a physical office within the United States and must have filed in the previous year federal income tax returns in the United States demonstrating more than $5 million in gross receipts or sales in the aggregate. Unlike the employee head count requirement, the revenue requirement can be met on an aggregated basis based on the reported gross receipts or sales of a consolidated group reported in a consolidated tax return.
Public Company Exemption
The CTA also provides an exemption for entities that are "issuer[s] of a class of securities registered under section 12 of the Securities Exchange Act of 1934" or "[r]equired to file supplementary and periodic information under section 15(d)" of that act. Functionally, this exemption covers entities that are colloquially referred to as U.S. public companies—i.e., entities that have publicly issued securities and are required to periodically submit reports to the SEC. As noted below, this exemption will also apply to wholly owned subsidiaries of public companies. There is no exemption in the CTA for foreign publicly traded companies registered to do business in the United States, but the large operating company exemption may be applicable if its requirements are met.
Pooled Investment Vehicle Exemption
Under the rule, many types of regulated entities—including registered investment advisers (RIAs) and venture capital fund advisers (VC advisers)—are generally exempt from reporting. Relatedly, the CTA exempts from reporting investment vehicles that are "operated or advised by" a CTA exempt RIA, VC adviser, bank, credit union or broker dealer. Under the CTA, these entities are known as pooled investment vehicles (PIVs).
To take advantage of the PIV exemption, the entity must be an investment company, as defined in section 3(a) of the Investment Company Act of 1940 (15 U.S.C. 80a– 3(a)) or an entity that would be an investment company but relies Section 3(c)(1) or (7) of that act, and it is identified on the From ADV by an exempt RIA (or will be in the next annual update). Importantly, the subsidiary exemption discussed below does not apply to entities owned by PIVs. Each such entity must either report under the CTA or qualify for an exemption independently (i.e., as one of the 23 types of entities that are exempt from reporting). However, Reporting Companies owned by PIVs are permitted to report the name of their exempt owners in their CTA reports rather than looking through those entities to their underlying investors.
Tax-Exempt Entity Exemption
This CTA exemption will apply to three categories of entities benefitting from tax exemption:
- Any entity that meets the criteria under 501(c) of the Internal Revenue Code (the Code) (determined without regard to section 508(a) of the Code) and is tax-exempt under section 501(a) of the Code (note that where an entity ceases to be tax-exempt under this provision, they retain their CTA exemption for 180 days after losing tax exemption).
- A tax-exempt political organization as defined under section 527(e)(1) and 527(a) of the Code.
- A trust as described in paragraph (1) or (2) of section 4947(a) of the Code.
It remains ambiguous whether a 501(c) entity must file under the CTA if the entity is awaiting a formal agency determination. It seems likely that most entities in this position will not file under the CTA if they believe their exemption will ultimately be confirmed given the language of the rule, but further guidance from FinCEN would be beneficial.
Inactive Entity Exemption
The CTA also includes a very limited exemption intended to exclude historical entities that are no longer engaged in any activity. This exemption will only apply where the entity: (1) was in existence on or before January 1, 2020; (2) is not engaged in active business; (3) is not owned by a non-U.S. person or entity, whether directly or indirectly, wholly or partially; (4) has had no change in ownership in prior year; (5) maintains no assets anywhere in the world, including interests in other entities; and (6) "has not sent or received any funds in an amount greater than $1,000, either directly or through any financial account in which the entity or any affiliate of the entity had an interest, in the preceding twelve-month period." In light of this provision, there remains some question as to whether a parent or affiliate covering corporate administration services relating to the entity—including regarding CTA reporting advice—would qualify as an indirect transaction that would defeat the exemption.
Subsidiary Exemption
Importantly, the CTA also exempts subsidiaries with "ownership interests" that are "controlled or wholly owned, directly or indirectly" by one or more entities that are otherwise exempt under the CTA. This rule will exempt from reporting the direct and indirect wholly owned subsidiaries of most CTA exempt entities with the exception of subsidiaries of PIVs, money services businesses/money transmitters, inactive entities, and entities assisting tax exempt entities. Subsidiaries of these entities will have to report under the CTA or otherwise qualify for an exemption independently (i.e., as one of the 23 types of entities that are exempt from reporting).
Embedded within the text is an important limitation to the exemption's scope: it is unlikely to apply when the subsidiary is only partially owned by an exempt entity or exempt entities. While the exact contours of the "control" prong are unclear, the exemption is conceptually intended to capture only those situations where exempt entities own the subsidiary or control "its ownership interests" (majority control over the board or operational decisions, for example, would seem unlikely to meet this requirement). Hopefully, FinCEN will provide clarity on the definition of "control" for purposes of this important exemption.
It also bears emphasizing that the subsidiary exemption is strictly applied to entities downstream in an ownership chain from the exempt entity; holding companies, sister companies, and other affiliates of exempt entities will not benefit from exemption unless they meet the criteria independently.
Acknowledging the burdens of reporting for complex corporate structures and desiring to avoid duplicative reporting, FinCEN has adopted a few key provisions that will ease the burden of reporting for affiliated companies.
First, where a Reporting Company is wholly or partially owned by an exempt entity (for example, a PIV, public company, or large operating company), the Reporting Company may include the names of the exempt entities in lieu of providing information regarding any individual Beneficial Owner when an individual is a Beneficial Owner of the Reporting Company exclusively by virtue of the individual's ownership interest in the exempt entity. Second, where a Reporting Company is wholly or partially owned by another Reporting Company, the subsidiary will be permitted to report the FinCEN ID of their parent company rather than completing a duplicative report to the extent that the Beneficial Owners of the entities are the same. These two CTA reporting efficiencies only satisfy the ownership prong of the "beneficial ownership" reporting requirements. The Reporting Companies impacted will still be required to report any individuals who "substantially control" the entity and are not reported on the parent/owner entity reports, such as senior officers or managers of the Reporting Company.
It bears noting here that while trusts are not generally Reporting Companies (unless they are formed by a state filing), they also are not "exempt entities" under the CTA. They are essentially disregarded under the reporting rules, looking through the trust for reporting purposes to the individuals who exercise control and hold significant rights under the trust (as described in more detail above). For this reason, the subsidiary exemption will not apply to entities owned by trusts.
Liability for Failures
Violations of the CTA can trigger civil penalties of $500 per day for each day a violation is outstanding (up to a maximum of $10,000) and criminal penalties of up to two years' imprisonment.
The CTA does not provide for penalties in the case of negligent failures. Instead, these penalties apply only to willful violations. Importantly, a "willful" violation could include circumstances involving "willful blindness" or "conscious disregard" that leads to a failure to file or filing of false or misleading information, substantially expanding the potential for inquiries and enforcement.
Any person (including entities) involved in the filing process can be liable if they willfully (or with willful blindness) provide or attempt to provide false or fraudulent information to FinCEN in a CTA Report (including a false or fraudulent identifying photograph or document); or fail to report complete or updated information to FinCEN. Even more, violations can be direct or indirect. Under the CTA, liability runs to any person who can be said to have (willfully or with willful blindness) "caused the failure" or, regarding failures to file, "was a senior officer of the entity at the time of the failure." This increases the pool of individuals who could be targeted for their role in failures beyond the individual or entity who technically files the report.
Notably, while "Beneficial Owners" are not directly responsible for filing a CTA report under the rule, they may have liability for failures if they refuse to provide required information/documentation and, thus, "cause" a CTA reporting violation by a Reporting Company. In addition, liability for failures may also run to individuals who routinely have oversight responsibility over corporate filings, including senior officers, in-house counsel, and other executives.
On a practical level, we are unlikely to see significant civil enforcement under the CTA in the near term. Initially, FinCEN's limited resources will be focused on public education, resolving ambiguities through issuance of CTA-related guidance, and addressing inevitable technological hurdles relating to the use of the CTA reporting database.
But the delay in enforcement should not be taken to suggest CTA enforcement will be sparse. We should expect to see both civil enforcements pursued by FinCEN and criminal enforcement actions by the U.S. Department of Justice (DOJ) once the administration of the CTA is in hand. And it bears noting that prosecutors will have the benefit of hindsight, as always.
When FinCEN and the DOJ turn to enforcement of the CTA, we will likely see enforcement action tied to underlying misconduct or significant systemic failures to file. It does not appear that the CTA is intended to focus on technical violations, given that there is no provision for liability for negligent violations and the limited resources of relevant regulators.
Access to the CTA Database
As noted above, FinCEN has not yet promulgated a final rule as to who will have access to the database. Under the current proposed access rule, consistent with the underlying law, access is intended to be quite restrictive.
First, the database is to be treated with essentially the highest level of confidentiality applicable to federal governmental records (with the exception of classified status), including significant criminal penalties for misuse and unauthorized access to information, as well as auditing of federal agency access to ensure proper authorities. For the avoidance of doubt, the information in the database will not be publicly accessible nor subject to Freedom of Information Act requests.
The proposed rule would permit U.S. federal agencies broadly engaged in national security, intelligence, or law enforcement activities to access the database where the information would be used in furtherance of those purposes. When a federal agency requests access to run queries of the database, the agency users would be required to submit justification to FinCEN for the searches they run in the database, which would be subject to audit by FinCEN to ensure access is being limited to appropriate circumstances. Notably, Treasury itself would have broader access to the database than other agencies under the current proposal, allowing access to Treasury officers and employees who require it for their official duties or for tax administration. Examples of such access include sanctions investigations, identifying property blocked pursuant to sanctions, and audits, enforcement, and oversight of the CTA framework.
With regard to U.S. state, local, and tribal law enforcement agencies, they would only be granted access to information in the database if "a court of competent jurisdiction" ruled that those agencies should be allowed access to that information. A "court of competent jurisdiction" is defined under the proposed rule as any court with jurisdiction over the underlying criminal or civil investigation that requires the information.
Access by foreign law enforcement would be even further restricted to requests for specific information through intermediary U.S. federal agencies authorized under an international treaty, agreement, or convention (e.g., Mutual Legal Assistance Treaty), or otherwise made by law enforcement authorities in a "trusted" foreign country. Unlike the U.S. federal and state law enforcement, foreign requestors would receive data through an intermediary U.S. federal agency specific to their request, as opposed to having open-ended query access to the database.
There has been little controversy over the proposal regarding access by law enforcement. However, the level of access that should be afforded to financial institutions is still very much under debate. The current proposed rule would limit financial institution access to information sought in relation to a specific Reporting Company to meet customer due diligence requirements under applicable law and, critically, only if the Reporting Company consented to the search. This limited access also would apply, by extension, to federal functional regulators and other regulatory agencies supervising financial institutions (except the Office of the Comptroller of the Currency, which may be subject to broader access granted to Treasury agencies). Covered financial institutions subject to FinCEN's existing customer due diligence rule are hoping that the CTA database may significantly alleviate their regulatory burdens and are pressing for broader access that would enhance their Bank Secrecy Act programs by allowing them to query the database to perform "know your customer" checks. These covered financial institutions are also hoping the CTA database can alleviate their existing monitoring obligations for any changes in beneficial ownership information, as Reporting Companies and Beneficial Owners will have this updating obligation under the CTA. They are also pressing for a regulatory safe harbor allowing them to rely on the veracity of information in the CTA database to satisfy their existing verification obligations in FinCEN's rules.
It is unclear when a final access rule will be issued, but at this point, it seems highly likely that the database will begin accepting required information on January 1, 2024, in the absence of clear regulations governing access.
Takeaways: Consistent Policies and Record Keeping Will Be Critical
Many ambiguities remain as to how the CTA will be applied and enforced, particularly with respect to how these rules apply to entities within complex corporate structures. Moving forward, impacted enterprises should consider the following steps to mitigate risks and burdens relating to CTA compliance:
- Develop and implement a CTA compliance policy. As with any high stakes and complex compliance regime, it will be critical to keep detailed records regarding CTA compliance decisions and to adopt and consistently apply an organizationwide policy. Among other aspects, this policy should document enterprisewide decisions resolving critical remaining ambiguities that impact reporting, designate a responsible individual and a process for documenting and periodically reevaluating exemption decisions, and discuss how the company will monitor changes to Beneficial Owners that may require updates to CTA reports (including changes to the application of CTA exemptions) within relatively short timeframes. Ambiguities and questions should be brought to the attention of the general counsel or outside counsel. Even if FinCEN disagrees with an entity's approach, an organization-wide policy and records of this nature will help to demonstrate good faith in reporting decisions and to rebut allegations that anyone within the entity willfully violated the CTA's reporting requirements.
- Evaluate opportunities to maximize reporting efficiencies through reorganization. Enterprises may want to consider adopting a policy that addresses new entity formations that maximizes the advantages of CTA exemptions and streamlines CTA reporting through policies regarding corporate administration and potential shifts as to the individuals within the organization who hold reportable roles in various entities. In the longer term, companies may further consider whether there are opportunities to reevaluate their corporate organization structure to maximize reporting efficiencies and minimize the burden of CTA reporting.
- Inventory existing entities. Larger corporate organization structures and enterprises such as family offices, corporate service providers, accounting firms, and law firms administering many entities should consider adopting a process for inventorying, evaluating, and gathering required information for all affiliated entities under their administration that were formed prior to January 1, 2024, in order to meet the January 1, 2025, reporting deadline.
- Obtain and require FinCEN Identifiers. As previously described, there are advantages to obtaining and requiring FinCEN IDs. Where a Reporting Company is wholly or partially owned by another Reporting Company, the subsidiary will be permitted to report the FinCEN ID of their parent company rather than completing a duplicative report to the extent that the Beneficial Owners of the entities are the same. This will streamline reporting in situations involving multiple subsidiaries. In addition, collection of FinCEN IDs in lieu of personal information will offer significant efficiencies and risk mitigation in so far as it will shift the burden of maintaining and updating accurate information regarding individual Beneficial Owners from the Reporting Company to the individual holder of the FinCEN ID. As a result, Reporting Companies should consider encouraging or even requiring their CTA reportable Beneficial Owners (i.e., owners, senior officers, managers, etc.) to obtain and use FinCEN IDs in employment agreements and other relevant contracts.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.