By Henry Meier, Esq.

Days before taking a long winter nap, the Financial Crimes Enforcement Network (FinCEN) released its final regulationsspecifying the conditions under which credit unions and banks will be authorized to access the new Beneficial Ownership Interest (BOI) database. The regulations take effect 60 days after being posted to the Federal Register.

In December 2021, Congress passed the Corporate Transparency Act (CTA). It had two main purposes. First, it aimed to reduce money laundering activity by mandating that corporations,limited liability corporations, and partnerships identify their beneficial owners to FinCEN. FinCEN is responsible for creating and administering a database of this information. The Act defines a beneficial owner as any individual who controls, either directly or indirectly, at least 25% of a corporation, limited liability company or “similar entity.”

A second purpose of the bill was to reduce the regulatory burden placed on financial institutions. Under a 2016 regulation, credit unions were already responsible for identifying beneficial owners. FinCEN was charged with promulgating regulations streamlining these requirements so that they are consistent with the CTA and creating a centralized database.

The regulations passed yesterday explain the conditions under which credit unions will be authorized to receive information from the database; the safeguards they will have to enact to ensure the information they obtain is properly secured; and the penalties for violations of these provisions.

Arguably the most important part of the regulation explains the purposes for which credit unions can seek to utilize the BOI database. Interestingly, the use of the database is not limited solely to compliance with the beneficial ownership regulations. Instead, the information may be requested to satisfy customer due diligence requirements which the regulations describe as:

any legal requirement or prohibition designed to counter money laundering or the financing of terrorism, or to safeguard the national security of the United States, to comply with which it is reasonably necessary for a financial institution to obtain or verify beneficial ownership information of a legal entity customer.

Although the scope of the circumstances under which the information can be requested is broad, FinCEN reserves the right to determine the precise circumstances under which information requests will be honored.

A major source of concern related to this this legislation has been the ability of FinCEN to safeguard the database. Afterall, it will contain the name, date of birth, current residential or business address, and a unique “FinCEN identifier” of each beneficial owner who files to start a business in the country. Institutions seeking to access the database can satisfy privacy requirements by complying with Gramm-Leach-Bliley’s requirements for the protection of personally identifiableinformation (section 501) “modified as needed to account for any unique requirements imposed” by the regulation.

Finally, a joint guidance issued by federal bank regulators, including the NCUA, noted that financial institutions are not mandated to use the BOI database, but if they do so, they will have to comply with these regulations.

If your credit union chooses to access the database, your Bank Secrecy Act policies and procedures should be updated to specify who at your credit union will be authorized to request access to the database, the circumstances under which access will be requested, and who shall have access to the information once it is received. The importance of this last point should not be underestimated, as the information should only be used to comply with the regulation.

Although the statute takes effect on January 1, compliance for the companies required to report to FinCEN is staggered. According to FinCEN FAQ:

A reporting company created or registered to do business before January 1, 2024, will have until January 1, 2025, to file its initial beneficial ownership information report. A reporting company created or registered on or after January 1, 2024, and before January 1, 2025, will have 90 calendar days after receiving notice of the company’s creation or registration to file its initial BOI report. This 90-calendar day deadline runs from the time the company receives actual notice that its creation or registration is effective, or after a secretary of state or similar office first provides public notice of its creation or registration, whichever is earlier. Reporting companies created or registered on or after January 1, 2025, will have 30 calendar days from actual or public notice that the company’s creation or registration is effective to file their initial BOI reports with FinCEN.

Need more information? Reach out to Henry!