The 2021 National Defense Authorization Act (the NDAA) was enacted into law over a presidential veto on 1 January 2021. A portion of the NDAA, the Corporate Transparency Act (the Act), imposes new beneficial ownership reporting requirements on certain businesses formed or registered to do business in the United States. While many of the details concerning the implementation of the Act are not yet known, the Act brings the United States closer in alignment with global peers on anti-money laundering (AML) regulations and should enhance the ability of United States law enforcement to combat money laundering, the financing of terrorism and other financial crimes.  It also projects to significantly affect the way U.S. businesses approach formation matters and early-stage financing.

The Act requires certain reporting companies to submit to the Financial Crimes Enforcement Network (FinCEN)¹ a report identifying each beneficial owner and applicant, and providing certain identifying information. Though the key operative terms are defined in the Act (as further outlined below), the Act requires the Secretary of the Treasury (the Treasury Secretary) to promulgate regulations² (Regulations) describing in greater detail the reporting requirements, procedures, and standards within one year after the enactment of the Act. Accordingly, significant practical questions remain and the full impact of the Act’s requirements will be heavily shaped by such future Regulations. 

Required Contents of Report to Fincen

In the mandated report to FinCEN, a reporting company must identify each of its beneficial owners and applicants by providing the following information:

• Full legal name; 

• Date of birth; 

• Current residential or business street address; and 

• Unique identifying number from (i) a non-expired U.S. passport; (ii) a non-expired state or federal identification document, (iii) a non-expired state-issued driver’s license, or (iv) if a beneficial owner does not have any of the aforementioned documents, a non-expired foreign passport.

Effective Date of Reporting Obligations

Pursuant to the Act, the reporting obligations and other requirements thereunder shall take effect on the date on which the Treasury Secretary promulgates the Regulations (the Effective Date)—no later than one year from the enactment of the Act.

Reporting companies formed in the United States or registered to do business in the United States after the Effective Date will (in addition to applicable state filing requirements) need to submit to FinCEN a report with the required information at the time of formation or registration (as applicable), representing a significant deviation and additional imposition from current practices with respect to entity formations in the United States generally. Reporting companies that are (i) formed in the United States prior to the Effective Date or (ii) registered to do business in the United States prior to the Effective Date must submit a report containing the required information within two years of the Effective Date. In the event of a change to any of the information required to be included in the report, a reporting company will need to submit an updated report to FinCEN within one year from such change. The Treasury Secretary possesses the authority to increase the frequency of such requirement pending the outcome of a cost-benefit analysis.

Definition of Reporting Company

The core definition for “reporting company” in the Act is broad, but it is subject to numerous exceptions that considerably narrow its scope. Under the core definition, a reporting company is any corporation, limited liability company (LLC) or similar entity that is either (i) created by filing a document with the secretary of state or similar office of any state or Indian Tribe; or (ii) formed under the law of a foreign country but registered to do business in the United States by filing a document with any secretary of state or similar office of any state or Indian Tribe. It remains to be seen which entities will be deemed to constitute a “similar entity” to a corporation or LLC, such that they will presumptively be required to report unless an exclusion applies.

The broad core definition of “reporting company” is, however, restricted by the inclusion of a list of more than 20 classes of entities that are expressly excluded. Such entities (Exempt Entities) include the following:

• An issuer with a class of securities registered under the Securities Exchange Act of 1934 (the ’34 Act) or which is otherwise subject to periodic reporting requirements, or registered with the Securities and Exchange Commission, under the ’34 Act (including, for clarification, a publicly traded company);

• A bank, bank holding company, credit union, registered investment company, investment adviser, or insurance company as such terms are defined in other federal statutes and regulations, along with certain other entities engaged in financial services or otherwise highly-regulated entities;

• An entity that (i) filed a tax return indicating more than US$5,000,000 in gross receipts or sales in the previous year, and (ii) has 20 or more full-time employees, and (iii) has a physical operating presence in the United States; 

• An entity that satisfies all of the following criteria: (i) in existence for over one year; (ii) not engaged in active business; (iii) not owned, directly or indirectly, by a foreign person; (iv) in the preceding 12-month period, did not experience a change in ownership or send or receive funds in an amount greater than US$1,000 (including all funds sent to or received from any source through a financial account or accounts in which the entity, or an affiliate of the entity, maintains an interest); and (v) does not otherwise hold any kind or type of assets, including an ownership interest in any corporation, LLC, or other similar entity;

• An entity in which the ownership interests are owned or controlled, directly or indirectly, by certain other types of Exempt Entities (Subsidiary Entities); and

• Such other classes of entities as the Treasury Secretary, with the written concurrence of the Attorney General and the Secretary of Homeland Security, may, by regulation from time to time, determine should be exempt from the requirement on the basis that gathering this information for such class of entity would not serve the public interest and would be of limited use for national security, intelligence, and law enforcement purposes.

In general, the Act appears to be drafted to exclude from coverage those companies exhibiting greater indicia of legitimacy or that are (or are subsidiaries of entities that are) already highly regulated, and to instead focus on entities that pose the greatest perceived AML risk (e.g., “shell” companies or companies otherwise with little to no employees, assets, or operating presence). In practice, this means the beneficial ownership reporting requirements in the Act will likely most significantly affect startup companies and other small businesses that are neither (i) public or large private entities nor (ii) belonging to one of the other classes of highly-regulated entities expressly excluded.

It is important to note that (i) certain Exempt Entities (e.g., Subsidiary Entities) may still be required to submit a report to FinCEN under the Act, although the information required to be included in such report is more limited, and (ii) it is likely that Exempt Entities will nonetheless be required to make an affirmative election to be exempt from the beneficial ownership reporting requirements and the Regulations will likely require such Exempt Entities to apply for an exemption with FinCEN.  

Definitions of Beneficial Owner and Applicant

An “applicant” is defined in the Act as any person who files such documentation to form a reporting company or registers a reporting company to do business. The Act defines a “beneficial owner” as “an individual who, directly or indirectly, through any contract, arrangement, understanding, relationship, or otherwise (i) exercises substantial control over the entity; or (ii) owns or controls not less than 25 percent of the ownership interests of the entity.” However, the following persons are expressly excluded from the definition of “beneficial owner” under the Act:

• A minor child, as defined in the State in which the entity is formed, if the information of the parent or guardian of the minor child is reported in accordance with the Act; 

• An individual acting as a nominee, intermediary, custodian, or agent on behalf of another individual;

• An individual acting solely as an employee of an entity and whose control over or economic benefits with respect to the reporting company is derived solely from employment status;

• An individual whose only interest in the reporting company is through a right of inheritance; or

• A creditor of the reporting company, unless the creditor qualifies as a beneficial owner under the core definitions outlined above.

Under the Act, a beneficial owner is determined by an economic interest or control test, although the Act leaves a great amount of uncertainty as to the interpretation and application of both prongs. For instance, with respect to an ownership prong, the Act leaves open questions as to how reporting companies should report beneficial owners in certain situations involving indirect owners/controllers, particularly where direct owners are other entities and individual ownership becomes more diffuse further up such chains of entities. Similarly, substantial control is not defined under the Act, although indicia of such control could include such factors as possession of special voting rights, appointment or veto powers, and/or approval of operational or strategic decision-making. Nonetheless, a reporting company conducting such analysis will need to evaluate potential beneficial owners in light of both the “25 percent ownership” and “substantial control” tests outlined in the Act. It is likely that guidance on the significant questions surrounding the determination of who is a beneficial owner, including on the interpretation of “substantial control” under the Act, will be included in the Regulations to be issued by the Treasury Secretary in the coming year. 

Additionally, in the event that an entity is excluded from the definition of “reporting company” because it is a Subsidiary Entity of one or more Exempt Entities, it will be necessary only to list the name of each such Exempt Entity in its report provided to FinCEN, without the information otherwise required to be reported to FinCEN for beneficial owners.

Penalties for Violations of The Act; Safe Harbor for Certain Reporting Violations

The Act outlines certain penalties applicable to reporting violations and unauthorized uses or disclosures of beneficial ownership information.

Under the Act, it is unlawful for any person to (i) willfully provide, or attempt to provide, false or fraudulent beneficial ownership information, including a false or fraudulent identifying photograph or document, to FinCEN; or (ii) willfully fail to report complete or updated beneficial ownership information to FinCEN. Liability for such violations includes (a) a civil penalty of not more than US$500 for each day that the violation continues or has not been remedied; and (b) a fine of not more than US$10,000, imprisonment for not more than two years, or both. 

The Act provides a safe harbor against civil or criminal penalties for certain reporting violations to the extent a person (i) has reason to believe that any report submitted by such person in accordance with the Act contains inaccurate information; and (ii) in accordance with the Regulations to be issued by the Treasury Secretary, voluntarily and promptly, and in no case later than 90 days after the date on which the person submitted the report, submits a report containing corrected information. Such safe harbor does not apply if the person acted for the purposes of evading the reporting requirements under the Act or had actual knowledge that any information contained in the report was inaccurate.

Separately, the Act makes it unlawful for any person to knowingly disclose or knowingly use the beneficial ownership information obtained by such person through a report submitted to FinCEN or a disclosure made by FinCEN as permitted under the Act. Penalties for such unauthorized disclosure or use consist of (i) a civil penalty of not more than US$500 for each day that the violation continues or has not been remedied; and (ii) (a) a fine of not more than US$250,000, imprisonment for not more than five years or both; or (b) if the violation occurred in connection with violation of another U.S. law or as part of a pattern of any illegal activity involving more than US$100,000 in a 12-month period, a fine of not more than US$500,000, imprisonment for not more than 10 years, or both.

Retention of Information Provided to Fincen; Procedure for Access

The information reported to FinCEN will not be publically available, but it can be shared with federal law enforcement agencies. State, local, and tribal law enforcement agencies may obtain information in the FinCEN registry with court approval.  Pursuant to the Act, FinCEN may disclose such information only upon receipt of:

• A request, through appropriate protocols to be established by the Treasury Secretary, from (i) a federal agency engaged in national security, intelligence, or law enforcement activity, for use in furtherance of such activity; or (ii) from a state, local, or tribal law enforcement agency, if a court of competent jurisdiction, including any officer of such a court, has authorized the law enforcement agency to seek the information in a criminal or civil investigation;

• A request from a federal agency on behalf of a law enforcement agency, prosecutor, or judge of another country, including a foreign central authority or competent authority (or like designation), under an international treaty, agreement, convention, or official request made by law enforcement, judicial, or prosecutorial authorities in trusted foreign countries when no treaty, agreement, or convention is available that is (i) issued in response to a request for assistance in an investigation or prosecution by such foreign country; and (ii) that (a) requires compliance with the disclosure and use provisions of the treaty, agreement, or convention, publicly disclosing any beneficial ownership information received; or (b) limits the use of the information for any purpose other than the authorized investigation or national security or intelligence activity;

• A request made by a financial institution subject to customer due diligence requirements, with the consent of the reporting company, to facilitate the compliance of the financial institution with customer due diligence requirements under applicable law; or

• A request made by a federal functional regulator or other appropriate regulatory agency.

Beneficial ownership information for each reporting company must be maintained by FinCEN for not fewer than five years after the date on which the reporting company terminates. 

Conclusions and Practical Implications

The Act represents a significant deviation from previous reporting obligations in the United States and imposes substantial new federal reporting requirements in connection with new business formations and registration of a foreign business in the Unites States. Prior to enactment of the Act, there was no federal requirement to provide any information on the individuals forming, owning, and exercising control over new businesses in the United States. States themselves vary with respect to the information required to be provided to a particular state under state law in connection with formation and foreign registration filings made in such state, although many states currently require little or no identifying beneficial owner information to be contained therein. The Act itself will not impact any such state law requirements—but rather imposes separate, independent federal reporting requirements—and it will remain necessary to comply with applicable state law requirements when forming or registering an entity in a given state. With the advent of the new reporting requirements of the Act, however, sensitive personal information will be required to be provided to an agency of the United States government upon formation or registration of new entities in any state within the United States. While the information to be supplied under the Act should not be generally available to the public, there will likely be reticence regarding how this information is stored and used.  

The Act will not become effective until the Treasury Secretary enacts the Regulations to interpret and implement the Act, and such Regulations should help clarify the many existing uncertainties under the Act. Until that time, there will be significant questions and concerns, particularly among the start-up and small business communities. However, it is not too early for practitioners and reporting companies to begin considering measures to adjust to the requirements under the Act. The obligations under the Act are placed on the reporting company and the reporting company will need to make significant efforts to comply with its requirements thereunder, even if in many instances such reporting company may have little practical ability to obtain the necessary information or may be subject to restrictions on disclosure of information contained in its organizational or other governing documents. Consequently, among others, relevant considerations, and potential amendments to current applicable documents, may include (i) limitations upon or carve-outs to confidentiality clauses in operating agreements or other organizational or governing documents to permit compliance with the Act; and (ii) an express obligation upon, as applicable, stockholders, directors, members, managers and other interest holders and controllers to provide information necessary for a reporting company to submit and update beneficial ownership information, including significant penalties (potentially, if permitted by applicable law, as drastic as forced removal or termination or forfeiture of its interest in an entity) for failure to comply with such obligation.

Promulgating regulations within one year for such a pervasive and intrusive statute will be a daunting task for the Department of Treasury. Balancing the intent of the legislation with the burden on businesses, including small businesses, start-ups and foreign direct investment, will pose a challenge under the Biden administration, which is focused on a “Buy American” agenda to encourage businesses to form or remain in, or to relocate to, the United States. This provides an excellent opportunity for stakeholders to provide input to the Department of Treasury throughout the rule-making process.  

Please feel free to reach out to the authors of this alert if you would like additional information or to discuss the opportunity to provide input on the drafting of the Regulations. 

¹ FinCEN was established in April 1990 by Treasury Order Number 105-08. Its original mission was to provide a government-wide, multi-source intelligence and analytical network to support the detection, investigation, and prosecution of domestic and international money laundering and other financial crimes. FinCEN was made a Treasury bureau by the USA Patriot Act of October 2001. Today, FinCEN is one of the Treasury’s primary agencies to oversee and implement policies to prevent and detect money laundering. 

² Regulations will be promulgated pursuant to the Administrative Procedures Act, which includes a process for stakeholder comments.