Introduction
FinCEN BOI reporting underwent a fundamental shift in March 2025. Under the Corporate Transparency Act (CTA), qualifying entities must disclose identifying information about the individuals who own or control them — and recent rule changes have reshaped exactly who that applies to.
Many compliance teams have drawn the wrong conclusion from that shift. The March 26, 2025 Interim Final Rule (IFR) does not eliminate BOI compliance broadly. Foreign reporting companies still have active filing obligations. Financial institutions still carry independent beneficial ownership collection duties under the Customer Due Diligence (CDD) Rule, and the IFR left those obligations intact.
This article explains what BOI reporting is, why it exists, how the current process works, who is now exempt, and what the regulatory shift means for fintechs, payments companies, and financial institutions operating in the US.
Key Takeaways
- As of March 26, 2025, US domestic entities are fully exempt from FinCEN BOI filing; only foreign-formed companies registered in the US must file
- US persons are exempt from being reported as beneficial owners of foreign reporting companies
- Financial institutions' CDD obligations under 31 CFR 1010.230 remain fully intact and were not changed by the IFR
- A final rule is expected later in 2025 and may revise or end the domestic exemption — monitor for updates
- Filing BOI information with a state agency, bank, or the IRS does not satisfy a federal FinCEN BOI filing obligation
What Is FinCEN BOI Reporting?
BOI reporting is the process by which qualifying entities submit identifying information about the individuals who directly or indirectly own or control them to the Financial Crimes Enforcement Network (FinCEN), via its secure BOI E-Filing system at no cost.
The goal is a centralized, non-public federal database that law enforcement, national security agencies, and select financial institutions can access to detect financial crime, sanctions evasion, and terrorist financing.
What gets reported for each beneficial owner:
- Full legal name and date of birth
- Residential address
- A unique identifying number from an acceptable government-issued document (such as a passport or driver's license)
- An image of that document
What gets reported about the company itself:
- Legal name and any trade or DBA names
- Current US street address (no P.O. boxes)
- Jurisdiction of formation and Taxpayer Identification Number (TIN)
BOI Reporting vs. the CDD Rule
These two obligations are frequently confused, and mixing them up carries real compliance risk.
Filing a BOI report with FinCEN (governed by 31 CFR 1010.380) is legally distinct from a financial institution's obligation to collect beneficial ownership information from customers under the Customer Due Diligence Rule at 31 CFR 1010.230. Complying with one does not satisfy the other. Both operate under separate legal authority and require independent compliance action.
Why BOI Reporting Was Established — And What Changed in 2025
The Legislative Origins
Congress passed the Corporate Transparency Act in January 2021 as part of the Anti-Money Laundering Act of 2020 (Public Law 116-283). The CTA addressed a recognized gap in the US AML/CFT framework: anonymous shell companies were routinely used to conceal illicit proceeds and evade sanctions, with little centralized mechanism to identify the natural persons controlling them.
The original Reporting Rule, published September 30, 2022 (87 FR 59498), took effect January 1, 2024. It required a wide range of US and foreign entities to file BOI reports with FinCEN at company formation or registration.
The Legal Turbulence of Late 2024
Shortly after the first filing season opened, multiple federal courts intervened. Beginning in late 2024, injunctions in cases including Texas Top Cop Shop, Inc. v. Garland temporarily suspended BOI enforcement, creating significant uncertainty for businesses and compliance teams about whether and when they needed to file.
The March 2025 Interim Final Rule
On March 26, 2025, FinCEN issued the Interim Final Rule (90 FR 13688), which narrowed the definition of "reporting company" to cover only foreign-formed entities registered to do business in a US state or tribal jurisdiction.
Key outcomes of the IFR:
- All US domestic entities (corporations, LLCs, and similar entities formed under US law) are categorically exempt
- US persons are exempt from being reported as beneficial owners, even for foreign reporting companies
- FinCEN accepted public comments through May 27, 2025 and has stated its intent to issue a final rule later in 2025
The current exemption is not permanent law. Compliance teams should monitor for the forthcoming final rule, which may restore domestic entity obligations.
How the FinCEN BOI Reporting Process Works
Under the current IFR, the filing obligation applies only to foreign reporting companies. If your organization has foreign-registered subsidiaries, affiliates, or counterparties doing business in the US, the steps below determine what reporting is required.
Step 1: Determine Whether Your Entity Qualifies as a Foreign Reporting Company
An entity qualifies if it is:
- Formed under the laws of a foreign country, and
- Registered to do business in a US state or tribal jurisdiction by filing with a secretary of state or similar office
Before concluding a filing obligation exists, verify whether the entity qualifies for one of the 23 statutory exemptions. Confirm eligibility criteria independently for each category — exempt status is never automatic.
Step 2: Identify Beneficial Owners Who Are Not US Persons
A beneficial owner is any individual who:
- Directly or indirectly owns or controls at least 25% of the entity's ownership interests, or
- Exercises substantial control — defined as serving as a senior officer, having authority to appoint or remove key officers or directors, or making important decisions about the company's business, finances, or structure
Under the IFR, US persons are currently exempt from being reported. Only non-US-person beneficial owners must be included in the filing.
Step 3: File via FinCEN's BOI E-Filing System Within the Required Deadline
Filing deadlines under the IFR:
| Registration Timing | Deadline |
|---|---|
| Registered before March 26, 2025 | Initial report due by April 25, 2025 |
| Registered on or after March 26, 2025 | File within 30 calendar days of effective US registration date |
Filing is free and available through FinCEN's web-based platform or as a fillable PDF upload.
Ongoing Obligations After Initial Filing
There is no annual BOI reporting requirement. However, event-driven updates and corrections apply:
- Updated report — due within 30 calendar days of any change to previously reported information
- Corrected report — due within 30 calendar days of discovering an inaccuracy
Beneficial owners who prefer not to share personal information through the reporting company can obtain a FinCEN identifier and submit their BOI directly to FinCEN. Third-party service providers may also file on a company's behalf if authorized.
For fintechs and financial institutions managing multiple foreign-registered entities, tracking these event-driven triggers across an entity structure is where compliance gaps most commonly occur.
Who Must File — And Who Is Exempt
Current Reporting Company Definition
Under the March 2025 IFR, "reporting company" means exclusively an entity formed under foreign law and registered to do business in any US state or tribal jurisdiction. All domestic entities — regardless of ownership structure — are categorically exempt under the current rule.
The 23 Statutory Exemption Categories
Foreign entities may also qualify for exemption. FinCEN's official FAQ lists all 23 categories, including:
- Banks, credit unions, and depository institution holding companies
- Securities reporting issuers, broker-dealers, and registered investment advisers
- Insurance companies and state-licensed insurance producers
- Tax-exempt entities and entities assisting tax-exempt entities
- Large operating companies
- Subsidiaries of certain exempt entities
- Inactive entities
The Large Operating Company Exemption
This exemption matters for many fintech and financial services clients — and it has strict requirements. To qualify, an entity must independently meet all three criteria:
- More than 20 full-time US employees
- More than $5 million in gross receipts or sales on a prior-year US federal tax return
- An operating presence at a physical US office
Employee headcount cannot be consolidated across affiliated entities. Each criterion must be met by the entity itself.
The Final Rule Is Still Coming
The IFR is interim. FinCEN has stated its intent to issue a final rule in 2025, which may reimpose requirements on US companies with foreign ownership or otherwise revise the current exemption structure. Compliance teams should track FinCEN's BOI rulemaking page and Federal Register notices — the current exemptions are subject to change, and programs built around today's rules may need rapid adjustment.
Key Compliance Considerations for Financial Institutions and Fintechs
The CDD Rule Was Not Changed
This is the most operationally significant point after the IFR: financial institutions covered by FinCEN's 2016 CDD Rule (31 CFR 1010.230) are still required to collect beneficial ownership information from their legal entity customers at account opening.
The March 2025 IFR amended 31 CFR 1010.380 — the BOI reporting regulation. It did not amend 31 CFR 1010.230. The BOI filing rollback does not reduce or eliminate CDD obligations for any of the following covered institutions:
- Banks and credit unions
- Broker-dealers
- Mutual funds
- Futures commission merchants
- Introducing brokers
BOI Database Access Is Not Yet Broadly Available
FinCEN's Access and Safeguards Rule authorizes financial institutions to access BOI data for CDD purposes — but only with the reporting company's consent and subject to security and certification requirements. FinCEN's phased rollout designates Phase 5 as the access phase for financial institutions subject to CDD requirements.
As of early 2025, broad Phase 5 access has not been confirmed as active. Financial institutions cannot substitute anticipated BOI database access for their own independent CDD collection processes.
Dual Exposure for Fintechs and Payments Companies
Foreign-formed, US-registered fintechs and payments companies may face two simultaneous obligations:
- Foreign Reporting Company Role — active BOI filing duties apply under 31 CFR 1010.380
- Covered Financial Institution Role — independent CDD program obligations apply under 31 CFR 1010.230
These roles require separate legal and compliance analysis. Pillars FinCrime Advisory works with fintechs and payments companies to map these overlapping obligations, design scalable CDD programs, and build compliance frameworks that hold up under regulatory examination.
Common Misconceptions About BOI Reporting
Misconception 1: The March 2025 IFR Eliminated BOI Compliance
Many US business owners — and some compliance teams — have concluded that BOI compliance is simply gone. It is not. The IFR narrowed the filing universe; it did not erase it. Obligations that remain in force include:
- Foreign reporting companies still face active BOI filing deadlines
- Financial institutions retain CDD obligations under existing banking regulations
- Entities undergoing ownership changes may trigger new reporting requirements
Misconception 2: State Filings, Bank Filings, or IRS Filings Satisfy the BOI Requirement
They do not. State business registration filings, bank account opening disclosures, and IRS submissions all serve different legal purposes under separate authorities. None of them satisfies the federal obligation to file a BOI report with FinCEN through the BOI E-Filing system.
Misconception 3: The Domestic Company Exemption Is Permanent
The IFR is an interim measure. FinCEN has explicitly stated its intent to issue a final rule, which may revise or remove the current exemption for domestic entities — particularly those with foreign ownership. Compliance programs built on the assumption that the exemption is permanent are not audit-ready.
Conclusion
As of March 2025, FinCEN BOI filing applies only to foreign reporting companies registered in the US. All domestic entities are currently exempt. But financial institutions' CDD obligations to collect beneficial ownership information from their legal entity customers remain fully intact — unaffected by the IFR.
The distinction between an active filing obligation, an interim exemption, and a separate financial institution CDD requirement is not academic. For fintechs, payments companies, and financial institutions, confusing these three categories creates real compliance gaps — the kind that surface during regulatory examinations.
Precision matters here. A final rule is expected later in 2025, and the current domestic exemption is explicitly temporary. Compliance teams should track FinCEN's rulemaking calendar now — not after an updated rule takes effect.
Frequently Asked Questions
Is FinCEN BOI reporting currently required?
As of March 26, 2025, the Interim Final Rule exempts all US domestic companies and their beneficial owners from BOI filing. Only foreign entities registered to do business in the US that do not qualify for one of the 23 statutory exemptions are currently required to file. Companies should monitor FinCEN rulemaking, as a final rule is pending and could revise the current exemption.
Who is exempt from FinCEN BOI reporting?
Under the March 2025 IFR, all domestic US entities are categorically exempt, as are US persons serving as beneficial owners of foreign reporting companies. Among foreign entities, 23 statutory exemption categories — including banks, large operating companies, and tax-exempt entities — may also remove the filing obligation.
What information must be included in a BOI report?
Reports require two categories of data. Company information includes legal name, trade names, US address, jurisdiction of formation, and TIN. For each non-US-person beneficial owner: full name, date of birth, residential address, and an identifying number and image from a government-issued ID.
What are the penalties for failing to file a BOI report?
Willful violations may result in civil penalties of $591 per day of continuing violation (inflation-adjusted) and criminal penalties of up to two years imprisonment and a $10,000 fine. Under the current IFR, these penalties do not apply to domestic US companies or US persons for BOI filing failures.
Does the March 2025 IFR affect financial institutions' CDD obligations?
No. The IFR amended 31 CFR 1010.380, not the CDD Rule at 31 CFR 1010.230. Covered financial institutions are still required to collect beneficial ownership information from their legal entity customers at account opening as part of their own compliance programs.
What is the filing deadline for foreign reporting companies?
Foreign entities registered before March 26, 2025 were required to file by April 25, 2025. Entities registering on or after March 26, 2025 have 30 calendar days from the effective date of their US registration to file an initial BOI report.
