FinCEN has published a flurry of Beneficial Ownership information in the last two weeks which has led many financial institutions to question how any of this information applies to them, and how their account opening processes will be affected by the new rule going into effect on January 1, 2024. The good news for financial institutions is that, for the foreseeable future, there is no change to our account opening procedures. All the rules that FinCEN has published to date to implement the Corporate Transparency Act have been targeted at small businesses.
Legal Entity Beneficial Ownership Requirements
In its First Rulemaking which became final September 30, 2022, FinCEN defined which businesses would be subject to the Corporate Transparency Act and when businesses would need to begin reporting their beneficial owners to FinCEN. The final rule gives the estimated 32 million businesses a calendar year beginning January 1, 2024 to register their beneficial owners with the Beneficial Ownership Secure System (BOSS). Businesses created after January 1, 2024 would have 30 days to register their beneficial owners with the BOSS. TCA noted some significant differences between businesses that are required to register with the BOSS and businesses for whom financial institutions request beneficial ownership certifications. Financial institutions are required to obtain beneficial ownership certifications from all legal entities opening new accounts with a few limited exclusions such as government organizations, other financial institutions, or businesses listed on a US stock exchange. In additional to the exclusions that have been in place since May 2018, additional businesses that are not required to register with the BOSS include:
- Businesses with more than $5 million in annual revenue and more than 20 employees
- Money service businesses that are registered with FinCEN
- Tax exempt entities registered with the IRS
Since there is no change the 2018 customer due diligence (CDD) rule, financial institutions will need to continue collecting beneficial ownership information from these entities even though they may not be required to register their beneficial owners with the BOSS.
In a couple of cases, the Final Rule requires legal entities to submit more information to the BOSS than we are required to collect by the 2018 CDD Rule. The September 2022 rule requires that all control prong individuals register their information with the BOSS as opposed to the one control prong we are required to collect. The Final Rule creates a new classification of beneficial owners called a “company applicant.” A company applicant is defined as a person (such as a lawyer or accountant) who prepares and/or files legal documents with the Secretary of State or equivalent to form the corporation. For legal entities created after January 1, 2024, company applicants must be reported to the BOSS along with the ownership and control prong information.
Based on feedback from the small business community, and because there has been minimal communication to the community about the upcoming reporting requirement, FinCEN published a Proposed Rule on September 28, 2023 to extend the timeframe for newly created entities from 30 to 90 days for 2024. If the proposed rule is adopted, the reporting timeframe would revert to 30 days beginning on January 1, 2025. FinCEN acknowledges that it may take time for attorneys and accountants to familiarize themselves with the requirements and want to provide additional time during the initial implementation of the Corporate Transparency Act.
BOSS Data Collection
A few months after it published the initial rule, FinCEN issued an Access and Safeguard Rule Proposal in December 2022. This rule proposed data collection forms that would be submitted to the BOSS, access rights to the data, and penalties for misuse of the data. The proposed rule also introduced the concept of a “FinCEN Unique Identifier” that would allow beneficial owners, control persons, and company applicants to apply for a unique identifier which could be submitted in lieu of a social security number when registering with the BOSS.
The following entities will have access to the BOSS if the proposed rule is adopted as proposed:
- Federal, state, local, and tribal government agencies
- Foreign law enforcement agencies and legal authorities
- Financial institutions (provided they have written consent from the legal entity)
- Federal regulators
- U.S. Treasury employees
Many TCA clients have inquired if they will be required to verify that their customers have properly registered with the BOSS and what steps they should take if a customer refuses to grant consent for employees to access their information. Since FinCEN has not published any revisions to the 2018 CDD Final rule, as of the date of this publication, there are no new requirements for financial institutions to access the BOSS or verify information. It is speculation at this point what requirements FinCEN may put on the industry in the future.
The proposed rule states that financial institutions may only utilize the BOSS to comply with CDD requirements and not for any other purpose. There are significant proposed penalties for misuse of BOSS information.
- $500 per day for each day the violation is not corrected
- Criminal penalties not to exceed $250,000 and five years in prison, or
- Criminal penalties not to exceed $500,000 and ten years in prison if the information is used in connection with another crime (e.g., identity theft)
Once FinCEN does publish a revision to the 2018 CDD Final Rule, our procedures will need to establish adequate controls over access to the BOSS and establish controls and accountability for the proper use of the BOSS.
FinCEN received a lot of negative feedback in the initial comments to this proposed rule. While trying to accommodate the small business industry knowing that it may be difficult to collect all beneficial ownership information within 30 days, the initial submission form included unknown boxes which could be checked to allow the submission to be sent timely. However, law enforcement and the financial industry noted that this would compromise the integrity of the data rendering it useless. On September 29, 2023, FinCEN published a revised BOSS Submission proposed rule that eliminates the unknown option and also includes dropdown boxes on the proposed form to make it more user friendly. This coincides with the previously referenced timeframe extension to 90-days to give additional time to newly formed businesses to gather required information.
Customer Communication
With the mandatory compliance date less than three months away, the biggest challenge facing successful implementation is that there has been little, if any communication with small business owners. FinCEN established a BOI Information Reporting Website which provides educational videos about the Corporate Transparency Act, a Small Entity Compliance Guide, and frequently asked questions. Since financial institutions should avoid providing tax or legal advice to their customers, it can direct customers who inquire about the reporting requirements to this website as well as their own legal counsel or accountant.
Some TCA clients have inquired about sending letters to their business customers to advise them of this upcoming requirement. There is no regulatory obligation that we do this and FinCEN has stated that each jurisdiction where a legal entity is registered (e.g., Secretary of State office) will be responsible for sending letters to notify businesses organized in their jurisdiction of the requirement to submit information to the BOSS. It is a business decision what to communicate to customers, if anything.
Next steps
When the second of three rulemakings were published, FinCEN stated that it does not intend to publish any revisions to the 2018 CDD Rule for approximately one year following the January 1, 2024 small business compliance date. 2024 will be a year of transition as the BOSS is populated with data from new and existing small business beneficial ownership information. Financial institutions can choose to familiarize themselves with small business compliance information, so they know what their customers are required to do, but none of the published rules to date apply to financial institutions. As part of our annual Board of Director training, we can update the Board on the changes that are coming. Keep in mind that once FinCEN published a revised rule, there will be a 60-day comment period and then a future compliance date once a final rule is published. Although TCA cannot guarantee, TCA does not anticipate there being any changes to our account opening processes until at least 2026 and possibly even 2027 as there has been discussion in Congress to postpone compliance dates until better communication to the small business community is done.
Regardless of when and how the rules change, know that your TCA BSA Action Team is here to keep you informed of upcoming regulatory changes and to assist during consulting and audit engagements as rules change. Call us at (800) 934-7347 to schedule your next audit, training, or consulting engagement.
