The final rule adopts the March 2025 interim rule, extends the U.S. person exemption to company applicants, and releases U.S. FinCEN ID holders from open-ended updates. What it leaves in place is the part most firms need to plan around.
FinCEN has issued a final rule adopting, with limited changes, the interim final rule of March 26, 2025 that narrowed beneficial ownership information reporting under the Corporate Transparency Act. The interim posture that firms have been operating under for more than a year is now the permanent rule. It takes effect on publication in the Federal Register.
The headline is familiar: domestic entities do not report. The details that matter to compliance programs are in what the final rule added, what it deliberately left alone, and one deadline that has not received much attention.
Four changes, three of them affirmations and one an expansion.
What the final rule does
Four changes, three of them affirmations and one an expansion.
Domestic reporting companies remain exempt. FinCEN affirms its exercise of the Secretary’s authority under 31 U.S.C. 5336(a)(11)(B)(xxiv) to exempt the entire class. Entities that met the old definition of “domestic reporting company” are exempted from the new definition, and “reporting company” now means foreign entities registered to do business in the United States.
The U.S. person exemption now covers company applicants. Under the interim rule, a foreign entity first registered on or after January 1, 2024 still had to report a U.S. person who qualified as its company applicant, even though it did not report U.S. person beneficial owners. FinCEN agreed with commenters that the logic applied equally to both, and the final rule exempts reporting companies from reporting U.S. person company applicants and exempts those individuals from providing the information.
U.S. FinCEN ID holders are released from updating. The interim rule left in place the requirement that a FinCEN ID holder update or correct the underlying information within 30 days of a change, without limitation. That produced an odd result: U.S. persons who had obtained an ID in anticipation of reporting remained under a lifetime update duty for information no longer required to be reported. The final rule removes that requirement for U.S. persons. Non-U.S. holders remain subject to it, on the reasoning that their information either is currently reportable or is likely to be again.
The exemption moved. FinCEN relocated the U.S. person exemption out of the beneficial owner definition at 1010.380(d) and into 1010.380(b)(5), among the provisions on the content, form and manner of reports. This is not cosmetic. FinCEN says the original placement invited misreading of the exemption’s scope, and created cross-reference problems in other rules that borrowed the BOI definition of beneficial owner.
What it leaves alone
Three provisions drew comment and survived without change.
The 30-day filing window stands. Commenters asked for 90 days, and asked FinCEN to align the deadline with receipt of an EIN or with foreign regulatory calendars. FinCEN declined, reasoning that a company already devoting effort to registering as a foreign business can devote a small increment more to registering with FinCEN at the same time, and pointing filers to existing guidance on the EIN sequencing problem.
The special rule for foreign pooled investment vehicles is affirmed as written in the interim rule. Where no individual with substantial control is a non-U.S. person, no beneficial owner is reported.
The penalty provisions are unchanged. Commenters argued the penalties are disproportionate for what one called a paperwork violation and proposed a scaled system. FinCEN kept the willfulness standard, noting that willfulness is well established in caselaw and that enforcement would not rest on inadvertent mistakes or unawareness of the requirement.
The deletion sweep, and the date inside it
The issue commenters raised most often was not the rule text. It was the data already sitting in FinCEN’s beneficial ownership IT system — reported by millions of companies before the interim rule, and no longer required.
FinCEN agreed that privacy, information security and public trust argue for removing it. It expects to use previously filed reports to identify domestic reporting companies and their beneficial owners and company applicants, to work with the National Archives and Records Administration, and to delete records for individuals who submitted an identifying document it reasonably believes came from a U.S. person, such as a U.S. passport or driver’s license.
Three practical limits on that. FinCEN does not anticipate asking U.S. companies or persons to request removal, and does not intend to confirm deletion to any individual filer; it will post notice on its website when the process is complete. It intends to run the sweep once, not periodically. And it does not anticipate deleting U.S. person information included in a filing made more than 180 days after publication of the rule — inadvertently or otherwise.
That last point is the operational one. If your firm, or a service provider filing on your behalf, is still populating U.S. person fields out of habit or out of an old template, the window in which that data gets cleaned up closes. Confirm what your filer is actually submitting before it does.
The Customer Due Diligence Rule is still the live obligation
A number of commenters asked FinCEN to follow its own logic and dismantle the 2016 CDD Rule. If collecting beneficial ownership from domestic entities is not highly useful, they argued, why must financial institutions still collect it from legal entity customers at account opening?
FinCEN declined, and the reasoning is worth reading closely because it sets supervisory expectations. The two rules serve different purposes under different authorities. The reporting rule collects information at entity formation; the CDD Rule collects it at the customer relationship. FinCEN says the narrowing “should not be interpreted as diminishing the value of BOI in general,” and that CDD compliance remains an important part of a covered institution’s AML program.
FinCEN did acknowledge a list of CDD questions it has not answered: whether it will issue policy or engage in rulemaking, what institutions should do about the still-extant BOI database, how to reconcile discrepancies between reported BOI and information the institution collects itself, whether reduced federal collection implies an increase in institutions’ own diligence obligations, and how regulator guidance might change. It says it is still legally required to revise the CDD Rule and can now refocus on it.
Read that as notice. The gap between what the government collects and what your firm is expected to know has widened, and FinCEN has said out loud that the widening may cut against you. A domestic legal entity customer’s ownership is now something you establish and document yourself, with no federal record to check it against.
What to do in the next quarter
- Confirm what is actually being filed for any foreign entity you control or advise. U.S. person beneficial owner and company applicant fields should be empty.
- Separate your FinCEN ID population by nationality. Non-U.S. holders still owe updates within 30 calendar days; U.S. holders owe nothing.
- Update CIP and CDD procedures that cite the BOI reporting rule or assume a federal database is available for corroboration.
- Document how you resolve ownership discrepancies. This is the CDD question FinCEN has flagged and not yet answered, which makes your own reasoning the record.
- Revisit the shell and front company typologies in your risk assessment. The federal collection that was meant to address them no longer covers domestic entities.
