The Company Transparency Act: What U.S. Companies Should Do Currently

For years, U.S. law enforcement watched dirty money hide in plain sight through anonymous shell companies. The Corporate Transparency Act, or CTA, was Congress’s answer: a federal beneficial ownership reporting regime that pulls secrecy into view. It went live January 1, 2024, with the Financial Crimes Enforcement Network, FinCEN, managing the system. The rules are deceptively simple, but the deadlines, definitions, and edge cases are where businesses stumble. If you form companies for clients, run a closely held enterprise, or serve as in-house counsel, you need a working plan that blends legal understanding with practical workflow.

This piece explains who must report, what must be filed, when it is due, and how to avoid the predictable traps. It also addresses the March 2024 district court ruling that questioned the CTA’s constitutionality, and what that means for companies not party to that case. Most importantly, it gives you a pragmatic way to operationalize compliance without turning your corporate records into a mess.

What the CTA requires in plain terms

The CTA requires “reporting companies” to submit beneficial ownership information, or BOI, to FinCEN. The report identifies the entity, its “beneficial owners,” and, for newly formed entities, its “company applicants.” Beneficial owners are flesh-and-blood people who either exercise substantial control over the company or own or control at least 25 percent of its ownership interests. The report includes legal names, dates of birth, residential addresses, and a unique identifying number with an image of the document, often a passport or driver’s license. FinCEN stores this in a non-public database accessible to law enforcement and certain other requesters under strict protocols.

The statute carries civil and criminal penalties for willful failure to report or update, and for willful submission of false information. This is not a “file and forget” form. If beneficial owners change, or if an owner moves and gets a new driver’s license, you may owe an update within a fixed window.

Who is a “reporting company,” and who is not

Most small corporations, LLCs, and similar entities formed by filing with a secretary of state are “reporting companies.” That includes entities formed under state or tribal law and foreign entities that register to do business in the United States. The dragnet is wide, by design. But Congress carved out 23 categories of exempt entities, mostly those already under heavy regulation or transparent enough to pose less risk.

The most useful exemption for operating businesses is the “large operating company” category. To qualify, an entity must have more than 20 full-time employees in the United States, more than 5 million dollars in U.S. gross receipts or sales reported in its prior-year federal tax return, and a physical office in the United States. Miss any one of the three, and the exemption fails. Many groups assume they qualify because the overall company is big, but if the legal entity itself does not meet all three criteria, you still must report. This trips up holding companies that have minimal payroll and aggregate revenue at a parent instead of the subsidiary level.

Other common exemptions include banks, credit unions, money services businesses, registered broker-dealers, investment companies and advisers, insurance companies, public accounting firms, public utilities, and tax-exempt nonprofits. There is also an exemption for subsidiaries wholly owned by exempt entities, but it is narrower than it sounds and does not cascade indefinitely.

A practical point: if you are relying on an exemption, document it. Save the tax return page showing gross receipts, payroll records showing full-time employees, and the lease for the physical office. Compliance is not only filing on time, it is also demonstrating why you did not file when asked two years from now.

Beneficial owners: control, ownership, and the gray in between

FinCEN uses a two-prong definition. First, a person who owns or controls at least 25 percent of the ownership interests. Second, a person who exercises substantial control over the reporting company. Either prong creates beneficial owner status.

Ownership is more than straight equity. It includes capital or profits interests in an LLC, convertible instruments, options, and arrangements to act in concert. If ownership is layered through a holding company, you must look through to natural persons and apply a reasonable method to allocate the indirect percentage. In practice, trace the chain of entities until you reach humans, compute the person’s effective stake, and see whether it meets or exceeds 25 percent. Ask for cap tables that are current, not last year’s draft.

Substantial control is where the law reaches beyond math. A person has substantial control if they serve as a senior officer, have authority over appointment or removal of senior officers or a majority of directors, or direct or have substantial influence over important decisions. It also sweeps in anyone who exercises control through board representation, financing arrangements, informal understandings, or rights associated with debt that function like equity. In a typical privately held company, the CEO, COO, and CFO are often beneficial owners under the control prong even if they own no equity. In a private equity portfolio company, the managing director who can approve budgets or major transactions may be a beneficial owner, as may the fund’s designee on the board.

A careful approach: identify senior officers by title and function, not just what is on the org chart. If a “Vice President of Finance” functions as the CFO, treat them as a senior officer. Review shareholder agreements and loan covenants that give veto rights over mergers, asset sales, or major expenditures. Substantial control can arise from a voting agreement or credit facility as easily as from equity.

There are limited exceptions. A minor child is reported by noting that a minor is a beneficial owner, but you list the parent or guardian’s information instead, and update when the child reaches the age of majority. A nominee, intermediary, custodian, or agent is not a beneficial owner by virtue of acting on another’s behalf. A creditor is not a beneficial owner solely because of debt, unless the rights tied to the debt give substantial control.

Company applicants: a new compliance wrinkle for formations

For entities formed on or after January 1, 2024, the initial report also identifies up to two “company applicants.” This includes the individual who directly filed the formation document and the individual primarily responsible for directing or controlling the filing. In practice, that often means a paralegal who hit “submit” and the lawyer or manager who oversaw the process. For foreign reporting companies that register to do business in a state after January 1, 2024, the person who filed the registration and the person who directed it are the applicants.

Older entities do not need to report company applicants. But law firms, formation services, and accounting firms that file with secretaries of state should establish a standard practice to collect and store applicant information at the time of formation. You do not want to chase a former paralegal for their driver’s license three months later.

Deadlines and update obligations

Timing depends on when the company was created or registered:

Reporting companies created or registered before January 1, 2024, have until January 1, 2025, to file their initial BOI report.
Reporting companies created or registered during 2024 generally have 90 calendar days from the effective date of creation or registration to file the initial report. FinCEN adopted the 90-day window to cushion the rollout, but it shrinks after 2024.
Reporting companies created or registered on or after January 1, 2025, will have 30 calendar days from the effective date to file.

Updates are mandatory within 30 days after a change. The list of change events is broader than many expect. If a beneficial owner moves and gets a new driver’s license with a new number, that triggers an update. If a CEO resigns and a new interim CEO takes over, that is an update. If a venture round closes and shifts someone’s ownership above or below 25 percent, update. If a minor beneficial owner turns 18 and you previously reported the parent’s information, update.

Corrections for inaccuracies are due within 30 days after the company becomes aware, or has reason to know, that a report was inaccurate. Treat “I thought the address was correct” NOAM GLICK as a prompt to verify and, if needed, correct.

What gets filed, and how the FinCEN identifier helps

You file electronically through FinCEN’s BOI E-Filing System. The report asks for:

Company information: legal name, any trade names or DBAs, principal address in the United States, jurisdiction of formation or registration, and taxpayer identification number.
Beneficial owner information: legal name, date of birth, current residential street address, and a unique identification number from a passport, driver’s license, or other acceptable document, plus an image of that document.
For post-2023 formations, company applicants: similar identifying information, but with a business address if they formed the company in the course of their business.

A practical tool is the FinCEN ID. Individuals can apply directly to FinCEN for a unique identifier and submit their details once. Thereafter, a company can report a person’s FinCEN ID instead of their full personal data and document image. That eases updates and mitigates privacy concerns for executives who do not relish sending a passport image to every small subsidiary. It also reduces the administrative ping-pong when someone serves as a beneficial owner for many entities.

FinCEN IDs must be kept current by the individual holder. If the person’s address or identification document changes, they must update their FinCEN profile, or else companies relying on that ID might end up with stale information. Build this into your internal policy: require executives to maintain their FinCEN IDs and confirm annually.

Penalties and enforcement posture

The statute sets civil penalties of 500 dollars per day for willful violations, up to a cap, and criminal penalties that can include fines and imprisonment for egregious conduct. “Willful” means more than a mistake, but less than malicious intent. If you never established a process, ignored notices, or kept filing incorrect information after being told it was wrong, you are in the danger zone.

I do not expect FinCEN to flood small businesses with penalties during the first year where companies are making a good-faith effort. What I do expect is targeted enforcement in cases involving obvious evasion, nominees, and opaque structures linked to higher-risk activities. Banks, auditors, and buyers in M&A processes will start asking for proof of filing. That market pressure may hit before any government letter arrives.

The litigation cloud, and why it does not remove your duty

In March 2024, a federal district court in Alabama held the CTA unconstitutional as applied to the plaintiff trade association and its members, enjoining FinCEN from enforcing the law against them. FinCEN responded that it would not enforce the CTA against the named plaintiffs but continued implementation nationwide. Other lawsuits followed. Appeals courts will weigh in, and the issue may reach the Supreme Court.

For everyone not covered by a court order, the CTA remains in effect. If your company is not a member of the enjoined group named in a specific case, and you file late while waiting for certainty, you are betting that a court will strike down the law across the board before your deadline. That is a risky strategy. The practical advice is simple: comply on schedule and watch the cases. If the law changes, you can stop filing later. If you guess wrong, penalties and cleanup work will exceed the cost of doing it right now.

Common trouble spots that trip up well-meaning companies

Small details create most of the problems. Here are the patterns I have seen in client work and internal audits:

Treating the parent company’s headcount and revenue as if they automatically satisfy the large operating company exemption for each subsidiary. The test is at the entity level. A holding LLC with no employees and 50 million dollars in dividends on a consolidated basis is not exempt.
Missing beneficial owners who qualify under the control prong. General counsel, managing partners, or the board chair with veto rights over capital expenditures often fall through the cracks because they do not hold 25 percent equity.
Failing to assign responsibility for updates. A company files the initial report, then no one owns the process. Six months later the CFO moves states and changes their license. No update is made, and the 30-day clock runs out.
Over-collecting and under-protecting personal data. Teams assemble passport scans in shared folders without access controls. If you collect sensitive documents, secure them. Better yet, use FinCEN IDs where possible and store less.
Misunderstanding company applicant timing. Law firms try to reconstruct who “directed the filing” months after formation. Capture applicant details as part of the formation checklist and avoid guesswork later.

Building a CTA compliance program that fits your size

A one-person LLC needs a different approach than a company with 200 subsidiaries. The right program meets the law, scales with your structure, and does not create busywork.

For closely held entities with a handful of owners, a pragmatic approach is to identify the beneficial owners, collect their information or FinCEN IDs, and file the initial report. Then, embed a reminder in your calendar every quarter to confirm nothing has changed. If you are owner-managed and changes are rare, that may be enough.

For groups with multiple entities, create a central register: a simple spreadsheet or trusted entity management tool that lists each entity, whether it is a reporting company, the filing status, the beneficial owners with their FinCEN IDs, and the assigned “report steward.” The steward is the person responsible for updates. Integrate this with HR and corporate secretarial workflows: when a senior officer is hired, promoted, or leaves, the steward receives an automatic alert; when a financing or cap table change occurs, legal updates the register. Be explicit about timeframes. Thirty days passes quickly, especially across holidays.

Train your legal and finance teams to spot control rights in agreements. If you sign a credit agreement with a negative covenant that requires lender consent for major transactions, ask whether that confers substantial control on a person behind the lender. The answer is usually no, but it is worth checking once. If a sponsor designates two board members with sole authority over strategic moves, the sponsor’s representative may be a beneficial owner. Build a short issue-spotting checklist into every board or financing memo.

Privacy, security, and who can see the data

The BOI database is not public. FinCEN may disclose information to federal and state law enforcement, certain foreign authorities, and financial institutions that have customer consent and need the data for legally required customer due diligence. Financial institutions will not have open-ended access. They must have a reason tied to compliance obligations, and the company must consent to the disclosure.

Even so, companies worry about exposure. You can mitigate by using FinCEN IDs, limiting internal access to BOI documents, encrypting storage, and avoiding email attachments with IDs and document images. If you retain vendors to assist, paper the privacy expectations and confirm how they store and delete personal data. Treat BOI like you treat payroll records: sensitive, necessary, and deserving of controls.

How this intersects with banks, deals, and audits

Compliance rarely lives in isolation. Banks already perform beneficial ownership checks under the Customer Due Diligence rule. That rule is changing to align with the CTA, but in the interim you may face parallel requests: your bank asking for a BO form and proof of CTA filing. For now, be prepared to provide both. Over time, the industry will align processes, but plan for duplication this year and next.

In M&A and private investment, buyers will start including CTA representations and covenants in purchase agreements and operating agreements. Expect to see reps that the target has filed all BOI reports, that its reports are complete and accurate, and that there are no pending updates. Diligence lists will request FinCEN filing confirmations and registers of beneficial owners. If your house is in order, you will move faster and negotiate fewer escrow holdbacks tied to compliance.

Auditors may not directly test CTA filings this year, but they will ask management about compliance with laws and regulations and the existence of penalties or contingencies. Having a documented program simplifies those discussions.

Special cases: trusts, foreign owners, and entities in flux

Ownership through trusts demands careful analysis. If a trust holds 30 percent of an LLC, you do not report the trust as a beneficial owner. You look to the humans who control or benefit. The trustee may be a beneficial owner if they can dispose of trust assets or vote the interests. A grantor may be a beneficial owner if they can revoke the trust or otherwise control ownership. A beneficiary who is the sole permissible recipient of income or principal, or who has a right to demand a distribution, may qualify. These are fact-heavy determinations, and you should document the reasoning used. When trust terms change, revisit the analysis.

Foreign individuals can be beneficial owners and company applicants. They must provide the same identifying information and document image. If a foreign national does not have a U.S. driver’s license or passport, a foreign passport is acceptable. Expect delays in collecting this data across time zones and language barriers. Set realistic internal deadlines that account for those frictions.

Companies in transition face timing headaches. If you plan to dissolve by year-end, but still exist today, you owe a report if you are a reporting company and have not yet filed. If you merge into another entity, you should file an update indicating that the original entity no longer exists. Entities created for a one-off transaction still owe initial filings if they survive formation. The rule does not exempt “temporary” companies.

A short, pragmatic checklist for owners and counsel

Determine whether each entity is a “reporting company,” and, if not, why an exemption applies. Document your conclusion.
Identify beneficial owners under both the ownership and control prongs, and confirm their information or collect FinCEN IDs.
For entities formed in 2024 or later, capture company applicant information as part of the formation process.
File the initial report on time, then assign a named steward and set up alerts for changes in officers, addresses, IDs, and cap tables.
Secure the data you collect, minimize what you store, and train the people who handle filings.

What good looks like in practice

The cleanest programs I have seen share a few traits. The general counsel or corporate secretary owns the policy. The company maintains a master entity list with a status column for CTA filings. Beneficial owners receive a short FAQ explaining why their data is needed, how to obtain a FinCEN ID, and how to update it. The HR system triggers an alert to the steward when executive roles change. The treasury team flags financing events that alter control or 25 percent ownership. A quarterly reminder reviews a short list of change indicators. Nothing fancy, just consistent.

Contrast that with the fire drill model. Someone hears about the CTA in November, realizes 30 entities need reports before January, emails executives for passport scans, stores them in a shared drive, and rushes filings with typos. In February, the COO moves, no one updates the report, and you are already out of compliance. The difference is not budget, it is ownership and cadence.

Trade-offs and judgment calls

The CTA’s control prong pushes you to make close calls. If a lender can block acquisitions over a threshold, do they exercise substantial control? Usually no, because this is a protective right tied to credit, not day-to-day direction. If a minority investor holds a veto over budgets and management changes, they may cross into substantial control. Ask two questions: does this person direct or materially influence important decisions, and do they do so in a sustained way? If yes, treat them as a beneficial owner and move on. The cost of over-including is a bit of extra paperwork. The cost of under-including can be penalties and remediation across multiple entities.

Another trade-off involves centralization. Central control improves consistency and security, but local subsidiaries often move faster with local knowledge. A hybrid works: central policy and technology, local stewards who execute and feed changes back to the register.

Looking ahead

FinCEN will continue to refine guidance. The agency has issued FAQs clarifying large operating company edges, acceptable documents, and definition boundaries. Expect more. The customer due diligence rule for banks will be updated to harmonize with the CTA. As those rules converge, companies may see fewer duplicative requests, but the standard for accuracy will rise as data flows between systems. Regulators and banks will compare a company’s BOI report with onboarding information. Inconsistencies will prompt questions.

States are also watching. Some will build their own reporting regimes or align state records with federal BOI concepts. If you operate across many jurisdictions, track state-level developments to avoid surprises.

The bottom line for businesses

Treat CTA compliance like you treat sales tax registration or payroll withholding. It is a standing obligation that rewards early organization far more than last-minute sprints. Map your entities, decide where you are exempt and where you report, identify your beneficial owners with clear logic, and file. Assign stewardship and embed updates into existing HR, legal, and finance processes. Use FinCEN IDs to reduce friction and protect privacy. Keep a short file that shows how you reached your conclusions.

This is a law designed to make ownership and control visible to the government, not the public. It requires some new habits, not a new department. If you build those habits now, the CTA fades into routine. If you postpone, it becomes another year-end scramble with penalties attached.