Last spring, we briefly discussed the Corporate Transparency Act (CTA). During that discussion, we discussed what the CTA is, who must comply, what is needed for beneficial ownership information (BOI) reports, exemptions, effective dates and the three rulemakings planned to implement the CTA. As a financial institution (FI), you are exempt from the CTA; however, many of your business customers are not. It is important for you, as their FI, to initiate a conversation regarding what the CTA is, how it will affect your customers and any future penalties for noncompliance.

When Does BOI Reporting Become Effective? Effective Jan. 1, 2024, it became mandatory for many companies in the U.S. to file BOI reports regarding their beneficial owners to the Financial Crimes Enforcement Network (FinCEN), a bureau of the U.S. Department of the Treasury. Filing these reports is simple, secure and free of charge. Reporting companies created or registered prior to Jan. 1, 2024, will have until Jan. 1, 2025, to report BOI. Reporting companies created or registered in 2024 must report BOI within 90 calendar days after receiving actual or public notice that its creation or registration is effective. Lastly, reporting companies created or registered on or after Jan. 1, 2025, must file BOI within 30 calendar days after receiving actual or public notice that its creation or registration is effective. Once the initial report is filed, both existing and new reporting companies will have to file updates within 30 days of a change in their BOI. The BOI reporting rule is one of three rulemakings planned to implement the CTA.

Rule Two/Access Rule. On Dec. 21, 2023, FinCEN issued a final rule implementing the Access Rule. The Access Rule prescribes the circumstances under which BOI reported to FinCEN may be disclosed to authorized BOI recipients and how it must be protected. The Access Rule reflects FinCEN’s careful consideration of detailed public comments received in response to its Dec. 16, 2022, “Notice of Proposed Rulemaking” on the topic, along with extensive interagency consultations. The rule states FinCEN is authorized to disclose BOI under specific circumstances to six categories of recipients: (1) U.S. federal agencies engaged in national security, intelligence or law enforcement activity; (2) U.S. state, local and tribal law enforcement agencies; (3) foreign law enforcement agencies, judges, prosecutors, central authorities and competent authorities (foreign requesters); (4) financial institutions using BOI to facilitate compliance with customer due diligence (CDD) requirements under applicable law; (5) federal functional regulators and other appropriate regulatory agencies acting in a supervisory capacity assessing financial institutions for compliance with CDD requirements under applicable law; and (6) treasury officers and employees. Each category of authorized recipients will be subject to specific security and confidentiality requirements, in line with the CTA, to protect the security and confidentiality of BOI.

To access BOI, domestic agencies must satisfy several security and confidentiality requirements set out in the CTA and the Access Rule. The requirements include establishing standards and procedures to protect the security and confidentiality of BOI, entering into an agreement with FinCEN specifying those standards and procedures, establishing and maintaining a secure system for storing BOI, establishing and maintaining auditable BOI request records, restricting access to BOI, conducting audits and providing FinCEN with reports and certifications.

Financial institutions that obtain BOI from FinCEN must develop and implement administrative, technical and physical safeguards reasonably designed to protect the information. Financial institutions will be able to satisfy this requirement by applying to BOI the same security and information handling procedures they use to protect customers’ nonpublic personal information in compliance with Section 501 of the Gramm‑Leach-Bliley Act and its implementing regulations. For each BOI request that it makes, a financial institution will have to certify that the request satisfies applicable criteria. Certain geographic restrictions will also apply.

Violations & Penalties. The CTA makes it unlawful for any person to knowingly disclose or knowingly use BOI obtained by that person from a report submitted to, or an authorized disclosure made by, FinCEN unless such disclosure is authorized under the CTA. The CTA provides civil penalties in the amount of $500 for each day a violation continues or has not been remedied. Criminal penalties are a fine of not more than $250,000 or imprisonment for not more than five years, or both. The CTA also provides for enhanced criminal penalties, including a fine of up to $500,000, imprisonment of not more than 10 years, or both, if a person commits a violation while violating another law of the U.S. or as part of a pattern of any illegal activity involving more than $100,000 in a 12-month period. Violating applicable requirements could also lead to FinCEN suspending or debarring a requester from access to the beneficial ownership (BO) IT system.

Under the Access Rule, “unauthorized use” includes any unauthorized access to BOI submitted to FinCEN, including any activity in which an employee, officer, director, contractor or agent of an authorized recipient knowingly violates applicable security and confidentiality requirements in connection with accessing such information.

Rule Three/Revising Customer Due Diligence. FinCEN will next engage in a third rulemaking to revise FinCEN’s CDD Rule, consistent with the requirements of the CTA. The modification to the current CDD Rule is required to be published by Jan. 1, 2025. The Access Rule does not make any changes to FinCEN’s CDD Rule.

FinCEN will develop compliance and guidance documents to assist reporting companies in complying with these rules. Some of these materials will be aimed directly at and made available to reporting companies themselves. FinCEN has already created the Introduction to Beneficial Ownership Information Reporting brochure and the Small Entity Compliance Guide. Both pieces of material can be found at fincen.gov/boi and can be provided to your customer as educational tools. Furthermore, FinCEN’s website will be updated regularly, and a call center is available by phone or email to assist businesses with additional questions.

This article is for general information purposes only and is not to be considered as legal advice. This information was written by qualified, experienced professionals at FORVIS, but applying this information to your particular situation requires careful consideration of your specific facts and circumstances. Consult a professional at FORVIS or legal counsel before acting on any matter covered in this update.