FinCEN Ends BOI Reporting for US Companies — What Financial Institutions Need to Know for AML Compliance

Key Points

• Domestic entities are exempt from BOI reporting, but CDD obligations remain. FinCEN’s March 2025 interim final rule exempts entities created in the United States from BOI reporting under the Corporate Transparency Act, while leaving covered financial institutions’ independent CDD obligations under 31 C.F.R. § 1010.230 unchanged.  
• The BOI database is no longer a comprehensive verification source for domestic entities. Because U.S.-created entities generally have no BOI filing obligation, financial institutions should not rely on the FinCEN database as a complete source for beneficial ownership verification and should maintain appropriate documentary and non-documentary verification procedures.  
• Foreign reporting companies remain subject to BOI reporting, but the database may not contain U.S.-person beneficial owners. Financial institutions may therefore need to obtain and verify beneficial ownership information directly, particularly where the available BOI does not provide a complete ownership picture or other risk factors warrant additional due diligence.  
• Financial institutions should review BOI-dependent compliance workflows. Institutions should inventory CDD, onboarding, periodic-review, and EDD processes that reference FinCEN BOI; identify appropriate alternative verification sources and procedures; and update policies, procedures, systems, and training as necessary.

FinCEN’s decision to exempt all domestic reporting companies from beneficial ownership information (BOI) reporting has significant implications for financial institutions’ anti-money laundering (AML) compliance programs. The change removes a filing obligation for many U.S. businesses, but it does not change the need to determine who owns, controls, and benefits from a legal entity. Covered financial institutions must continue to identify and verify the beneficial owners of legal-entity customers under their customer due diligence (CDD) obligations, although FinCEN has provided limited relief from repeating that process when an existing customer opens a new account. This alert explains what changed and the steps institutions should take to adjust their controls.

Background: What the Final Rule Changed

As discussed in our recent client alert on FinCEN’s permanent end to BOI reporting for U.S. companies, FinCEN used its authority under the Corporate Transparency Act (CTA) to exempt all domestic reporting companies from BOI reporting. The rule effectively removes domestic reporting companies from the definition of “reporting company” in 31 C.F.R. § 1010.380. It also exempts foreign reporting companies from reporting BOI for U.S.-person beneficial owners and exempts U.S. persons from providing that information. Foreign reporting companies remain subject to BOI reporting for non-U.S.-person beneficial owners. This distinction — relief for domestic companies, but not a complete end to BOI reporting — frames the AML compliance implications discussed below.

Key Implications for AML Compliance Programs

1. CDD Obligations Remain in Effect — Continue Collecting and Verifying Beneficial Ownership

• The central compliance point is straightforward: the rollback of BOI reporting did not repeal or modify the 2016 CDD Rule. The Corporate Transparency Act (CTA) makes that clear, stating: “[n]othing in this section may be construed to authorize the Secretary of the Treasury to repeal the requirement that financial institutions identify and verify beneficial owners of legal entity customers under section 1010.230(a).”  
• That obligation applies to financial institutions — including banks, broker-dealers, mutual funds, futures commission merchants, and introducing brokers in commodities — and requires them to collect and verify beneficial ownership information from legal-entity customers at account opening.

2. The BOI Database Provides Less Coverage — Reassess Verification Workflows

• Congress contemplated that financial institutions could access BOI filed with FinCEN to corroborate information obtained directly from customers — not to replace CDD. The CTA describes the database’s intended use as helping institutions “confirm the beneficial ownership information provided directly to the financial institutions to facilitate . . . compliance with anti-money laundering, countering the financing of terrorism, and customer due diligence requirements”.  
• Because domestic companies are now exempt from filing, the FinCEN BOI database will not contain records for most U.S. entities. Institutions should therefore treat it as a limited, supplemental source — not a presumed checkpoint — for domestic customer onboarding.  
• Institutions that built workflows around the database should now identify each dependency, replace it with reliable documentary and non-documentary sources, and establish escalation procedures for ownership information that remains incomplete or inconsistent.

3. Traditional CDD Methods Matter More — Strengthen Documentary and Non-Documentary Checks

• In the absence of a centralized government registry for domestic beneficial ownership, financial institutions should continue to use — and, where risk warrants, strengthen — traditional documentary and non-documentary verification methods. At a minimum, programs should:  
• Review organizational documents, including articles of incorporation, operating agreements, and partnership certificates;  
• Request ownership attestations directly from legal-entity customers;  
• Check public records, including state secretary of state records and tax filings; and  
• Conduct adverse-media screening.

4. Domestic Shell and Front Company Risk May Increase — Recalibrate Risk Assessments

• FinCEN’s rulemaking record expressly warns that eliminating domestic BOI reporting “could result in illicit finance risks.” FinCEN also noted in its 2022 BOI rule that illicit actors “frequently use corporate structures such as shell and front companies to obfuscate their identities and launder their ill-gotten gains through the U.S. financial system.” These warnings make clear that the loss of a centralized registry is not merely an administrative change.  
• Without a centralized registry for domestic entities, AML programs should reassess the risk posed by domestic privately held legal-entity customers, especially those exhibiting shell- or front-company indicators. Practical steps include reviewing risk-rating factors, testing whether ownership discrepancies trigger escalation, requiring corroborating documentation for higher-risk customers, and considering enhanced due diligence or senior-level approval when beneficial ownership cannot be independently corroborated.

5. Foreign Entity Reporting Is Incomplete — Enhance Onboarding Review

• Foreign reporting companies remain subject to BOI reporting, but the FinCEN registry will be incomplete because it excludes information about U.S.-person beneficial owners.  
• AML programs should treat the registry as a partial data point when onboarding foreign legal-entity customers registered to do business in the U.S. If all beneficial owners are U.S. persons, the BOI report will contain no beneficial ownership information. In those cases, institutions should obtain ownership information directly, corroborate it through independent sources, document the gap, and apply enhanced due diligence (EDD) or other escalation measures where the customer’s risk profile warrants.

6. Policies and Procedures Need Updating — Refresh Controls and Training

• The rule should prompt a documented refresh of internal policies, procedures, training materials, and control narratives — not a one-time deletion of BOI references.  
• Key updates should include:  
• Removing references to planned reliance on the FinCEN BOI database for verifying domestic entities  
• Revising risk-assessment frameworks to account for reduced ownership transparency and defined escalation triggers  
• Tracking FinCEN FAQs, guidance, and proposed AML/CFT program-rule updates through a documented governance process  
• Updating onboarding and periodic-review procedures to document alternative verification sources and resolve inconsistent ownership information  
• Establishing escalation procedures for incomplete, inconsistent, or difficult-to-corroborate ownership information  
• Updating customer-risk-rating methodologies and EDD triggers for domestic entities with shell-company or front-company indicators  
• Training relevant personnel on the revised BOI landscape and documenting completion  
• Assigning owners and deadlines for policy, procedure, and control changes, with testing and management reporting

Bottom Line: The rule may relieve U.S. businesses of a filing obligation, but it does not relieve financial institutions of their CDD obligations. The narrower BOI database — and the deletion of previously submitted U.S.-person data — reduces visibility into the beneficial ownership of legal-entity customers and may increase the risk that opaque ownership structures go undetected.

Financial institutions should act now: inventory every CDD, onboarding, periodic-review, and EDD workflow that references the FinCEN BOI database; confirm that alternative verification sources and escalation criteria are documented; and test whether higher-risk domestic and foreign legal-entity customers receive appropriate enhanced review. Institutions should not wait for updated guidance before addressing known workflow dependencies.

Financial institutions should monitor FinCEN’s updated FAQs, guidance on FinCEN.gov, and related AML/CFT rulemaking, and assign responsibility for translating those developments into policy, training, and control updates.

For questions about BSA/AML compliance obligations, enforcement exposure, or how this action may affect your institution’s AML program, please contact Ryan Last, or Edward M. Nogay, or visit our Anti-Money Laundering and White Collar Litigation + Investigations practice pages to learn how Troutman Pepper Locke can help.