FinCEN’s Beneficial Ownership Rollback: A Setback for the Fight Against Financial Crime

Today, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) finalized a significant rollback of the Corporate Transparency Act (CTA) beneficial ownership information (BOI) reporting regime. The final rule makes permanent the exemptions first established through FinCEN’s March 2025 interim final rule: U.S. companies are no longer required to report beneficial ownership information to FinCEN, and U.S. persons are no longer required to provide such information in connection with foreign reporting companies. FinCEN also eliminated ongoing update requirements for U.S. persons who previously obtained FinCEN identifiers and announced that it intends to delete previously reported information relating to U.S. persons from the BOI database.

Treasury characterizes the action as a victory for small businesses and a reduction in unnecessary regulatory burden. That objective is understandable. The original CTA reporting regime imposed compliance obligations on millions of legitimate businesses, many of which had little or no connection to illicit finance. The final rule reflects Treasury’s determination that the costs imposed on those businesses outweighed the incremental law-enforcement and national-security value of collecting their ownership information.

But from a financial-crime perspective, the decision represents a meaningful step backward.

The fundamental issue is not whether every American small business should have been required to provide information to the federal government. The more important question is whether the United States should maintain a reliable, centralized capability for identifying the real people behind U.S.-formed legal entities when those entities can be used to facilitate fraud, money laundering, sanctions evasion, corruption, tax crimes, terrorism financing, or other illicit activity.

In my view, the answer should have been yes.

What the Corporate Transparency Act Was Intended to Accomplish

The CTA was enacted in 2021 as part of the Anti-Money Laundering Act of 2020 and amended the Bank Secrecy Act (BSA) to establish federal beneficial ownership reporting requirements for many corporations, limited liability companies, and similar entities. The original implementing rule, effective January 1, 2024, required covered entities to report identifying information about themselves, their beneficial owners, and, for newer entities, certain company applicants.

The policy objective was straightforward: make it more difficult for criminals and other bad actors to hide behind anonymous corporate structures.

That matters because a corporation or LLC can be perfectly legitimate, or it can be a shell, front company, or layer in a complex ownership structure designed to obscure the person ultimately controlling the entity. Before the CTA, identifying that person could require investigators, regulators, financial institutions, and other authorities to piece together information from state corporate records, subpoenas, financial institutions, tax records, foreign jurisdictions, and other sources.

The CTA sought to create a more efficient federal source of ownership information.

That capability was particularly important because the United States had historically lacked a comprehensive federal mechanism for identifying the beneficial owners of many privately held companies formed under state law. The CTA was intended, among other things, to help address that gap.

What FinCEN Did Today

The final rule fundamentally changes that framework.

Domestic reporting companies are now exempt from BOI reporting altogether. Foreign entities registered to do business in the United States remain subject to reporting requirements, but the final rule generally excludes U.S. persons from the information that foreign reporting companies must report. U.S. company applicants associated with foreign reporting companies are also exempt. In addition, U.S. persons who previously obtained FinCEN identifiers are no longer required to update or correct that information.

Most significantly, FinCEN intends to delete previously reported information concerning U.S. persons that is no longer required under the final rule. FinCEN expects to identify U.S. persons using information contained in previously filed BOI reports, including identifying documents such as U.S. passports and driver's licenses. It intends to conduct the deletion in a single sweep rather than through an ongoing process and does not intend to provide individual confirmation that a record has been deleted.

Foreign entities reporting under the revised regime will continue to provide BOI concerning foreign individuals.

Treasury's position is that this is a more targeted, risk-based approach: rather than collecting information on nearly all American small businesses, the government will focus its BOI collection on foreign entities operating in the United States, which Treasury views as presenting greater national-security and illicit-finance risk.

That rationale addresses the burden side of the equation. It does not, however, eliminate the financial-crime risks created by the resulting information gap.

Why This Is a Setback

1. It removes a federal transparency mechanism precisely where criminals can exploit it

The central weakness of the new regime is geographic rather than technological: a foreign actor seeking to obscure ownership may have an incentive to establish a U.S. domestic entity rather than a foreign entity registered to do business in the United States.

That distinction matters.

As commenters to the rule observed, foreign persons, corrupt officials, foreign criminal organizations, and hostile states could potentially use domestic U.S. entities to avoid the BOI reporting requirements applicable to foreign reporting companies. Commenters specifically raised concerns involving money laundering, fentanyl trafficking, tariff evasion, sanctions evasion, and other illicit activity.

This creates a potential regulatory arbitrage opportunity: the very corporate structure that can be used to obscure beneficial ownership may also be the structure that avoids federal BOI reporting.

That is a troubling outcome for anyone whose job is to identify the person behind the entity.

2. It makes criminal investigations more difficult and potentially slower

A centralized BOI database was never intended to replace investigative work. Its value was in accelerating it.

When investigators encounter a suspicious company, the question is often deceptively simple: Who actually owns or controls this entity?

Without a centralized source, investigators may need to reconstruct ownership through subpoenas, bank records, corporate documents, intermediaries, foreign legal-assistance requests, and other investigative techniques. The final rule's commenters specifically warned that removing domestic BOI would make it harder to uncover basic ownership information and force continued reliance on time-consuming subpoenas and international legal assistance.

For victims of financial crime, that delay matters.

Every additional investigative step can provide a fraudster more time to move funds, dissolve entities, establish replacement companies, transfer assets, or move activity across jurisdictions.

The issue is therefore not simply whether investigators can eventually determine beneficial ownership. It is whether they can determine it quickly enough to prevent additional harm.

3. It creates a meaningful national-security vulnerability

The implications extend well beyond traditional money laundering.

Commenters raised concerns about U.S. companies being used by foreign criminal networks and adversaries for money laundering, sanctions evasion, weapons proliferation, tariff evasion, fentanyl trafficking, and activities affecting the U.S. defense supply chain.

A domestic corporation can provide an appearance of legitimacy. It can obtain a bank account, enter contracts, acquire property, conduct trade, establish vendor relationships, and participate in the U.S. economy.

If the ownership behind that corporation is intentionally obscured, the corporate entity itself can become a vehicle for disguising foreign influence.

This is particularly concerning in an environment in which financial crime, cybercrime, sanctions evasion, corruption, and geopolitical competition increasingly intersect.

4. It weakens the information ecosystem on which financial institutions depend

Perhaps the most important issue for financial-services executives is that the rollback does not eliminate the industry's need to understand beneficial ownership.

FinCEN explicitly states that the CTA reporting rule and the Customer Due Diligence (CDD) Rule serve different purposes. The CDD Rule continues to require covered financial institutions to obtain beneficial ownership information from legal-entity customers, and FinCEN affirms that CDD remains an important component of AML/CFT programs.

This creates an important asymmetry.

The government is no longer requiring many domestic entities to provide BOI to FinCEN, yet financial institutions remain responsible for obtaining and using beneficial ownership information as part of their AML programs.

The result is a less centralized information environment.

A financial institution may collect information from its customer, but that information cannot necessarily be compared against a comprehensive federal database. Commenters specifically highlighted this problem. After the 2025 rollback, financial institutions could no longer reliably check BOI against a national database for accuracy, while law enforcement lacked an efficient mechanism for accessing BOI maintained by individual institutions.

For BSA Officers and Chief Compliance Officers, that means potentially greater reliance on internal processes, external data providers, investigative research, and judgment.

In other words, the government reduces its own centralized information collection while financial institutions continue to bear significant responsibility for identifying the same risks.

5. It destroys potentially valuable historical intelligence

The decision to delete previously collected U.S.-person BOI deserves particular attention.

FinCEN's stated rationale is understandable from a privacy and cybersecurity perspective. Information that the government no longer needs to collect should not necessarily be retained indefinitely. Indeed, commenters raised legitimate concerns about privacy, cybersecurity, identity theft, and potential misuse of sensitive information. FinCEN agreed that privacy, information security, and public trust support deleting information that would not have been collected under the final rule.

But deletion has another consequence: historical information cannot be used if it no longer exists.

The database represented a newly created investigative asset. Even if a company was legitimate when its BOI was reported, that same company could later become involved in fraud, corruption, sanctions evasion, money laundering, or another financial crime.

Historical ownership information can be highly relevant when investigators reconstruct relationships among entities and individuals over time.

Once that information is deleted, a future investigation may have to recreate the ownership history through other sources, assuming those sources still exist and are accessible.

That is not merely a regulatory burden issue. It is a loss of institutional intelligence.

6. It moves the United States further from international beneficial-ownership standards

The final rule also creates a potential international-policy concern.

Financial Action Task Force (FATF) Recommendation 24 calls for countries to ensure that adequate, accurate, and up-to-date information concerning the beneficial ownership and control of legal persons can be obtained or accessed rapidly and efficiently by competent authorities, through a beneficial ownership register or an alternative mechanism.

Commenters argued that the U.S. approach could make the country an outlier as other jurisdictions strengthen corporate transparency regimes and could make the United States comparatively more attractive for illicit financial activity.

The United States does not necessarily need to replicate another country's BOI regime. But it should be mindful of the broader signal it sends.

For financial crime, transparency is not merely a domestic regulatory issue. It is an essential component of international cooperation.

7. The decision may unintentionally increase the burden on financial institutions

There is an important irony in the policy.

Treasury's principal justification is reducing compliance costs for legitimate American businesses. Yet some of that burden does not disappear; it can shift downstream to banks, lenders, fintechs, payment companies, broker-dealers, and other regulated financial institutions.

When centralized ownership information is less available, financial institutions may need to compensate through enhanced customer due diligence, more extensive documentation, additional beneficial-ownership verification, adverse-media research, corporate-record searches, transaction monitoring, investigative escalation, and periodic refreshes.

FinCEN itself acknowledges that the relationship between the revised BOI regime and the CDD framework raises unresolved questions, including whether the reduction in federal BOI collection could actually increase financial institutions' CDD obligations.

That is an issue senior compliance executives should watch closely.

What Financial Services Organizations Should Do Now

The final rule does not mean financial institutions should reduce their focus on beneficial ownership.

Quite the opposite.

Financial institutions should view the change as an increased need to ensure that their own customer-risk processes can stand independently of a centralized government database.

At a minimum, Chief Compliance Officers, Chief Risk Officers, and BSA Officers should consider:

Reassessing beneficial-ownership verification. Determine whether existing processes assumed the availability of FinCEN BOI and whether alternative sources are now required.

Reevaluating higher-risk domestic entities. Pay particular attention to complex ownership structures, newly formed entities, nominee arrangements, unexplained changes in ownership, foreign connections, high-risk jurisdictions, unusual transaction activity, and businesses whose activities are inconsistent with their stated purpose.

Strengthening entity-resolution capabilities. The ability to connect people, companies, addresses, accounts, transactions, and related entities becomes more important when centralized government data is less comprehensive.

Reviewing CDD and EDD procedures. The final rule does not eliminate the CDD Rule. FinCEN expressly states that CDD remains important to AML/CFT programs.

Reassessing investigative escalation. Institutions should ensure investigators have practical methods for establishing beneficial ownership when customer-provided information is incomplete, inconsistent, or suspicious.

Monitoring future regulatory developments. FinCEN has acknowledged that it must address the CDD Rule in light of the changes to the BOI reporting framework.

The Bigger Picture

There is a legitimate policy debate about the appropriate regulatory burden imposed on millions of legitimate small businesses. Treasury has made that case clearly, and the final rule reflects a deliberate decision to prioritize burden reduction and target federal BOI collection toward foreign entities. FinCEN also acknowledges that broader BOI reporting would likely provide some additional usefulness in addressing shell-company abuse.

But financial-crime policy should ultimately be judged not only by the burden imposed on legitimate businesses, but also by the cost imposed on victims when criminals successfully exploit gaps in transparency.

The Corporate Transparency Act was an attempt to close one of those gaps.

Today's decision reopens it.

For financial institutions, the message should therefore not be that beneficial ownership has become less important. The opposite is true. As federal visibility decreases, the importance of institutional visibility increases.

The organizations best positioned to manage the resulting risk will be those that treat beneficial ownership not simply as a regulatory data field, but as a foundational component of financial-crime risk management.

The question for the financial-services industry is no longer whether the government will provide a comprehensive means to determine “Who owns this company?”

Increasingly, that responsibility will fall back on the financial institution.