...

Corporate Transparency Act regulations will go into effect soon and will affect almost all startup companies

by Gregory S. Fryer, Esq.
Verrill Dana LLP

The days of anonymous ownership and control of U.S. legal entities are coming to an end, and nearly every startup company in America will be called upon to file so-called beneficial ownership information reports (BOI Reports) with FinCEN, a little-known bureau of the U.S. Treasury Department.

The Corporate Transparency Act (CTA) was enacted in January 2021 to strengthen existing anti-money laundering statutes. It creates a massive new reporting regime whose burdens will fall primarily on smaller companies, and generally will not apply to larger companies. FinCEN will use the collected information to construct a database of sensitive PII (personally identifiable information) over 100 million individuals. The CTA requires the database to be protected against disclosure to the public at large but to be broadly available to law enforcement agencies and financial institutions.

Last fall, FinCEN published a 99-page release explaining its implementing rule under the CTA. This article is intended to provide startup company management with a brief overview of key aspects of that rule. Further details about the BOI Reporting rule can be found at: https://www.verrill-law.com/gregory-s-fryer/publications-podcasts.

Existing Entities. If your startup company qualifies as a Reporting Company (and it probably does unless it has more than $5M in revenues and more than 20 employees), you will be obligated to report basic information about the company itself and (with limited exceptions) will be obligated to collect and report certain PII for the following covered individuals (referred to in the FinCEN rule as Beneficial Owners):

• each “senior officer” of the company (President, CEO, CFO, COO, CLO, and so forth); plus, typically, each outside director of the company and any other individual who (other than arising solely from employee status) has substantial influence over important company decisions;
• each controlling person of any investor that holds significant approval or veto rights on important company decisions; and
• any individual who owns or controls (directly or indirectly) at least a 25% stake in the voting power or equity value of the company.

Here are the five items of PII a company must report to FinCEN about each such Beneficial Owner:

• Full legal name (including middle name and suffix, where applicable);
• Date of birth;
• Street address of the primary residence (not a P.O. box or a business address);
• Unique identifying number from one of the following non-expired governmentally issued ID documents: U.S. passport; State driver’s license; or other ID document issued by a State, local government, or Indian tribe.
• A clear image of that same non-expired ID document.

For companies already in existence or to be formed before the end of 2023, the deadline for filing BOI reports will be January 1, 2025. So you do have time to educate yourself about the details of these new requirements, but it is important that you be aware of the looming implications of this for your business. In particular, you need to be aware that you will need cooperation from all covered individuals in order for you to collect the necessary PII. You also will need those people to promptly disclose future changes in that PII, because a Reporting Company has a duty to monitor its reported information and has just 30 days to update any information in its BOI Report that has become inaccurate. For many companies, this duty to update will pose a greater challenge than filing the initial BOI Report.

Companies Formed after 2023. With few exceptions, entities formed after 2023 will have nearly immediate reporting obligations – their initial BOI Report is due just 30 days after the date of incorporation or other formation (measured by the date of filing with the secretary of state or similar office). In addition to the types of covered individuals listed above, new entities will also need to provide PII on one or two “company applicants” – i.e. the individual who made the formation filing with the secretary of state and (if applicable) another individual responsible for supervising the filing.

FinCEN Identifiers. The CTA allows any individual to apply for a FinCEN Identifier – a unique number identifying that individual within the FinCEN database. The application must contain the same PII as a Reporting Company would be obligated to provide, but having a FinCEN Identifier:

• allows a Reporting Company to provide the Identifier number rather than the requisite PII
• avoids the Reporting Company having to collect and store (and protect) the PII; and
• avoids requiring the covered individual to entrust his or her PII to the Reporting Company.

We expect that many angel investors and venture capital firm executives will seek FinCEN Identifiers, and that many lawyers and paralegals who routinely form new entities (thus making them “company applicants”) will do likewise. We also expect that many startup companies will encourage their executives and outside directors to obtain FinCEN Identifiers, and thus simplify the company’s data collection and update obligations.

Non-Reporting Entities. The CTA exempts a long list of larger companies from being treated as a Reporting Company, such as SEC-reporting public companies; banks, insurance companies, and other heavily-regulated firms, including many venture capital firms and other pooled investment vehicles; government agencies (e.g., Finance Authority of Maine) or quasi-governmental entities (e.g., Maine Venture Fund or Maine Technology Institute); and many charitable organizations and foundations.

In addition, there is an exemption for private companies that (i) have U.S. operations and more than 20 full-time employees in the U.S., (ii) filed a federal income tax return (or information return) last year, and (iii) reported at least $5 million of gross receipts on that return. Thus, later-stage startup companies might qualify for this exemption.

An investor entity in a startup company might qualify for one or more of these exemptions. But that is not the end of the inquiry. If the entity has board representation rights or special approval or veto rights, then – regardless of the exemption – one or more individuals associated with the investor will generally be treated as a Beneficial Owner. The startup company will thus need to collect and report PII about (or Identifier numbers for) the exempt entity’s management or other controlling persons. An exempt investor’s passive owners, however, are not subject to BOI reporting (even if they, indirectly, own a 25%+ stake in the startup company) because a special rule allows the startup company to name the exempt entity instead of naming that entity’s indirect owners.

*  *  *

Although the CTA’s reporting deadline is more than a year away, here are some things that startup company CEOs and CFOs may want to start thinking about:

• Roughly, how many directors and senior officers will our company need to report on? Are any of these likely to resist providing PII (or resist applying for FinCEN Identifiers)?
• Are there any investors who have board representation rights or special approval or veto rights? Is it obvious who their controlling persons and major underlying owners are? If not, how difficult will it be to get the investor to volunteer such information to us?
• Does our company have the technical capability needed to protect all PII provided to us for BOI reporting purposes?
• Should our board designate a CTA Officer with responsibility and authority to identify all relevant Beneficial Owners, collect their PII (or FinCEN Identifiers), and monitor for changes in any information included in our BOI Report? Will that person be covered by our indemnification provisions and our D&O liability insurance?
• What is the likelihood that we will seek additional capital from sources that are not current investors in our company, or that we will seek to sell the company – events that may trigger a need to convince third parties that the company has properly handled its BOI reporting obligations?

We suggest that startup companies should remain alert for opportunities to better understand their new CTA obligations, and should consult with legal counsel as they implement their plans for addressing these obligations.