Incorporator The Journal of U.S. Formation
Start Free Quiz
Editorial 6 MIN READ

FinCEN's BOI rule isn't final yet. The comment file already tells you what will move

The NPRM closed February 7 with roughly 240 comments. For a professional filer, the live questions are timing, company applicant, and the 25% interest

The Editors
Staff, Incorporator.org
6 min read Updated
Contents 7 sections
  1. What the statute forces, and what the rule is choosing
  2. Timing: the number everyone is watching
  3. Company applicant: the definition that hits filers directly
  4. Substantial control: where the fight moved after the ANPRM
  5. CDD Rule alignment: probably a second rule, not this one
  6. What the final rule is unlikely to change, and what to tell clients
  7. Sources

f you incorporate for a living, the FinCEN BOI NPRM at 86 Fed. Reg. 69920 (Dec. 8, 2021) is the rule you have been asked about every week since January. It is not final. The comment period closed February 7, docket FINCEN-2021-0005, with roughly 240 letters on the record and the heavyweights (ABA, AICPA, American Bankers Association, Bank Policy Institute, state bar sections, SBA Office of Advocacy, privacy groups) all in by the deadline.

The final rule will not publish for months. The comment file is a good guide to which pieces of the proposal move, which are fixed by statute, and which stay put. For someone whose job is forming LLCs on a calendar, that is the difference between useful forward guidance and telling clients to wait.

What the statute forces, and what the rule is choosing

The Corporate Transparency Act, Sections 6401-6403 of the William M. (Mac) Thornberry NDAA for FY 2021, codified at 31 U.S.C. § 5336, was enacted January 1, 2021. A "reporting company" is a corporation, LLC, or similar entity created by a filing with a secretary of state, or a foreign entity registered to do business in the United States. Twenty-three categories are exempt by statute: public companies, banks, investment advisers, broker-dealers, certain tax-exempt organizations, and "large operating companies" with more than 20 full-time U.S. employees, prior-year gross receipts above $5 million on a U.S. federal return, and a U.S. operating presence. Beneficial owners are individuals who either exercise "substantial control" or own or control at least 25% of the ownership interests. Civil penalties run to $500 a day, with up to two years' imprisonment and a $10,000 criminal fine for willful violations.

Those pieces are not moving. The 25% threshold, the 23 exemptions, and the penalty ceilings are all statutory. A comment arguing 25% should be 10%, or that LLCs should be exempt, was asking FinCEN to do something FinCEN cannot do.

What the NPRM chose, and what the docket is fighting over, is the inside of that frame: "substantial control," "company applicant," filing deadlines, what address a beneficial owner reports, and whether any of it lines up with the 2016 Customer Due Diligence Rule at 31 C.F.R. § 1010.230.

Timing: the number everyone is watching

The NPRM proposed a 14-day window for new reporting companies after formation, a one-year window for entities in existence on the effective date, 30 days for any change in reported information, and 14 days from discovery for any correction.

The 14-day window drew the largest cluster of comments. Our June 2021 read on the ANPRM flagged this: the statute gives FinCEN discretion, and 14 days is aggressive. A consulting practice that forms an LLC on day one and opens a bank account on day three does not have a beneficial ownership chart pinned down by day fourteen. ABA, AICPA, state bar sections, and small-business advocates pushed for 30 days at minimum; several asked for 90.

Thirty days for new formations is the likely landing spot, with the 14-day clock surviving only for corrections (where the accuracy-of-the-registry argument actually bites). The one-year transition for existing entities is unlikely to move; FinCEN has an operational interest in not flooding its intake system in month one.

Company applicant: the definition that hits filers directly

For the reader who files entities all day, this is the provision to watch. The NPRM reads "applicant" broadly: the individual who actually presses "submit," plus "any individual who directs or controls the filing" of the formation document. The second prong sweeps in the paralegal at the firm, the attorney supervising her, and potentially the client.

Every firm that files for clients commented on this. ABA Business Law Section, several state bars, and the registered-agent trade groups pushed back on two points: the "directs or controls" prong; and the permanent record. Company applicants must report name, date of birth, residential address, and a government-issued ID image, and that record stays with the entity indefinitely. For a registered-agent company filing thousands of entities a year, that is thousands of employees whose personal information lives in a federal database forever.

Two likely moves. FinCEN narrows "directs or controls" toward the person making the substantive decision to form the entity, not the lawyer implementing it. And FinCEN leans on the FinCEN identifier as a workaround: an individual applies once, and the entity reports the ID instead of the underlying information. Anyone who files for a living should plan to obtain a FinCEN ID the day the portal opens.

Substantial control: where the fight moved after the ANPRM

The NPRM's "substantial control" definition has four prongs: senior officer service, authority over the appointment or removal of a senior officer or a majority of the board, direction or substantial influence over important decisions (there is a list), and a catch-all. The catch-all generated most of the traffic.

Industry groups argued it is so open that every minority investor with a veto right, every lender with a negative covenant, and every counterparty with an approval gate is arguably a beneficial owner. Bank Policy Institute was clearest, because banks have to reconcile the CTA against their existing CDD Rule obligations, which use a cleaner "significant responsibility to control, manage, or direct" test. Privacy and small-business commenters came from the other direction: the catch-all invites overreporting because a sensible filer errs toward naming more people.

The catch-all survives (FinCEN wants the anti-evasion tool) but the senior officer and important-decisions lists get tightened and examples get added to the preamble. Reportable owners per entity do not change much at the median; for complex cap tables the number narrows.

CDD Rule alignment: probably a second rule, not this one

The CTA requires FinCEN to revise the 2016 CDD Rule to conform and remove duplicative burden. Banks want that done simultaneously. FinCEN has signaled the CDD revision will be a separate, later rulemaking. Expect the reporting rule first, an access and safeguards rule next, and the CDD revision after that. For a filer, the practical consequence is that for a stretch of 2023 and 2024 a bank's CIP process and FinCEN's entity-reporting process will use overlapping but non-identical definitions.

What the final rule is unlikely to change, and what to tell clients

Four things are worth treating as settled. The 25% threshold is statutory. The 23 exemption categories are not expanding in this rulemaking. The penalty framework is not softening. And the residential-address requirement will not be replaced with a business-address option, because the enforcement rationale for residential addresses was the central design choice of the statute. The FinCEN identifier is the only accommodation on offer; it is in the NPRM and universally supported in the comments, and anyone who files formations should plan to get one.

Nothing has to be filed today. The effective date will be set in the final rule, and the existing-entity transition runs a year from that date. Most commenters expect an effective date in the first half of 2024; FinCEN has room to slip. For new formations in the meantime, keep a clean internal record of who the beneficial owners would be under the NPRM's four prongs, with ID copies and residential addresses on file. Retroactive data collection on 2022 and 2023 formations is the single most painful part of compliance if the final rule lands with substantially the NPRM's shape; contemporaneous collection costs almost nothing.

The filer who treats the NPRM as a preview, not a draft, will have almost nothing to do the week the final rule publishes.

Sources

Keep reading

More from the journal.