The new rules for Beneficial Ownership in 2024
Overall, 2024 may prove to be a pivotal year for potential changes to Customer Due Diligence programs and policies.”
The Financial Crimes Enforcement Network (FinCEN) continues to issue rules and guidance relating to Beneficial Ownership following the enactment of the Corporate Transparency Act (CTA) in 2021. Many banks continue to anticipate the release of the third and final rule which will arguably contain the biggest changes for impacted institutions under the CTA. Overall, 2024 may prove to be a pivotal year for potential changes to Customer Due Diligence (CDD) programs and policies.
The Reporting Rule
In the first final rule, FinCEN established the beneficial ownership information (BOI) database per 31 CFR 1010.380. This rule released in Sept. 2022, often referred to as the Reporting Rule, compiles information provided by business entities into a main database to assist in anti-money laundering (AML) efforts by financial institutions and government agencies. Starting Jan. 1, 2024, most entities created in or registered to do business in the United States are now required to report BOI to FinCEN. The FinCEN website also allows individuals and reporting companies to request a FinCEN identifier, although FinCEN identifiers are not required to be obtained. Generally, this Reporting Rule did not contain specific changes for financial institutions to make. While some banks may now be choosing to include reference to FinCEN’s website and the BOI filing information requirements or E-Filing system as part of general resources offered to commercial customers, this is not explicitly required under the final Reporting Rule.
The Access Rule
The second final rule, known as the Access Rule was released in Dec. 2023, with FinCEN setting forth the protocols for disclosure of BOI. The Access Rule dictates which “authorized recipients” have access to the information from the filed BOI reports which are maintained in the nonpublic database, named “Beneficial Ownership Technology System.” Perhaps the most important part of the Access Rule for banks is that financial institutions subject to CDD requirements are deemed “authorized recipients” under these provisions.
Despite the final Access Rule taking effect on Feb. 20, 2024, FinCEN stated that authorized recipients with be given access to the database in different phases over the course of 2024.
The first group granted access is limited to certain key authorized government agencies, while the second group granted access includes Treasury offices and certain Federal agencies engaged in law enforcement and national security activities. Subsequent stages of the rollout are expected to extend access to additional federal agencies engaged in law enforcement, national security and intelligence activities, as well as to state, local and tribal law enforcement partners; and finally, to financial institutions that meet the requirements of the final Access Rule.
It is important to distinguish that the Access Rule itself does not create a different regulatory requirement for banks to access BOI from the database. Further, the Access Rule does not require changes to Bank Secrecy Act/anti-money laundering (BSA/AML) compliance programs designed to comply with FinCEN’s existing Customer Due Diligence rule (the “current CDD Rule”) at this time.
For now, banks may continue to rely on the current CDD rule, and once access to the new database is granted, authorized banks will have the ability to take this information into consideration, pending the release of the third rule.
Under the Access Rule, authorized banks will need to take certain steps to receive permission to view information in the BOI database and maintain the information received in a confidential manner.
In order to receive access to a reporting company’s information in the Beneficial Ownership Technology System, the bank must first receive a reporting company’s consent and “develop and implement administrative, technical, and physical safeguards reasonably designed to protect the information” obtained. FinCEN notes that consent is not required specifically to be in writing but requires consent to be documented, leaving this to the financial institution’s discretion to determine the method of obtaining and documenting each customer’s consent.
Further, if a bank is granted access to the BOI system, then the bank’s regulators will also have access to beneficial ownership information when they supervise the financial institutions. It is likely that further guidance will be released in this area once access is granted to financial institutions as authorized recipients and banks begin requesting consent from companies to obtain the BOI information from the database.
Awaiting the third rule
Authorized financial institutions continue to await the proposal of the third rule, which will be the final implementing rule of the CTA.
The third rule is expected to revise the existing CDD regulations as part of a conforming rule to align with the goals of the CTA. These revisions are projected to ensure the CDD rules follow along with the new BOI database. At this time, it appears unlikely that this third rule containing the CDD changes will be made effective within 2024. As such, aspects of this third rule are expected to carry over into 2025.
FinCEN recently issued Version 1.0 of the “Small Entity Compliance Guide for Beneficial Ownership Information Access and Safeguards Requirements,” that provides useful interpretations for banks to take into consideration relating to the Access Rule. FinCEN notes that the Small Entity Compliance Guide will be updated in the future to include the final requirements from the third rule, referred to in the Guide as the revised CDD Rule.
FinCEN plans to further update the Guide to provide direction on how financial institutions can access BOI from FinCEN. FinCEN has been actively providing insights through updated BOI FAQs to address common issues and questions following the implementation of the two final rules.
While the FAQs may assist in guiding determinations absent clarity in the rules, the FAQs do not replace or fulfill what may be missing from the regulation itself. FinCEN is expected to continue to release further guidance throughout the year.
Overall, 2024 has been an active year for the CTA’s two finalized rules, as the BOI database goes live and access is granted in phases to the defined authorized recipients. As banks await the release of the third and final rule containing the conforming changes to the current CDD rules, it remains to be seen how a bank’s current BSA/AML compliance program and practice will be altered by the third rule once finalized.