Blog Series: What are the Privacy and Security Concerns under the Corporate Transparency Act?

On January 1, 2024, the Corporate Transparency Act will require millions of U.S. companies to file first-time beneficial ownership information reports with the U.S. Department of Treasury Financial Crimes Enforcement Network. For the next several weeks, Dickinson Law will cover some of the most significant reporting obligations as well as what businesses, financial institutions, and existing entities need to know about the changes.

Under the Corporate Transparency Act (2021), reporting companies will be required to file beneficial ownership information (BOI) reports indicating who the beneficial owners and company applicants are for the entity. Beginning on January 1, 2024, these reports will be filed using the Financial Crimes Enforcement Network’s (FinCEN) secure filing system.

FinCEN has indicated that these BOI reports will be stored in a centralized database and will only be shared with authorized users for purposes specified by law.

According to FinCEN, the database will use rigorous information security methods and controls typically used in the Federal government to protect non-classified yet sensitive information systems at the highest security level. Further, the requirements of the Privacy Act afford individuals the right to privacy of records that are maintained in systems of records by federal agencies and the Privacy Act incorporates the provisions of the Computer Matching and Privacy Protection Act of 1988, including the Computer Matching and Privacy Protection Amendments.

Under the Corporate Transparency Act, only certain users may have access to the BOI reports. Pursuant to the FAQ’s posted by FinCEN, FinCEN will permit Federal, State, local, and Tribal officials, as well as certain officials who submit a request through a U.S. Federal government agency, to obtain beneficial ownership information for authorized activities related to national security, intelligence, and law enforcement. Financial institutions will also have access to beneficial ownership information in certain circumstances, with the consent of the reporting company. Those financial institutions’ regulators will also have access to beneficial ownership when they supervise the financial institutions.

To address concerns with privacy and security, FinCEN is in the process of developing the rules that will govern access to and handling of beneficial ownership information but the timing for publication of these rules is unknown at this time. What is currently known is that the BOI reported to FinCEN will be stored in a secure, non-public database using rigorous information security methods and controls typically used in the Federal government to protect non-classified yet sensitive information systems at the highest security level, according to the FinCEN’s FAQs. FinCEN plans to work closely with those authorized to access BOI to ensure their roles and responsibilities are fully understood to be able to ensure that the BOI reports are only used for authorized purposes and handled in a way that protects its security and confidentiality.

Another layer of protection for individuals and reporting companies is the ability to apply for a “FinCEN identifier”, which can be used in place of the otherwise required personal information about beneficial owners or company applicants. A FinCEN identifier can be issued by an individual or a reporting company only after the information depicted in Chart 1 below is provided to FinCEN.

CHART 1 – Required Information for an Individual or Reporting Company

Beneficial Ownership Information Reporting Requirements, Small Entity Compliance Guide, September 2023 – Version 1.0.

The FinCEN identifier may be useful if an individual or reporting company must be reported as a beneficial owner in multiple reporting companies. For example, an individual may serve as a president or other executive officer of multiple small businesses. In this instance, the individual may not want to provide their personal information to each reporting company to report that the individual is a beneficial owner. Instead, the individual may elect to provide the reporting company with their FinCEN identifier to be reported instead.

It is important to note that if the information that was reported in order to receive the FinCEN identifier ever changes in the future, then the individual or reporting company will be required to update or correct the reported information, as applicable.