8 minute read | January.05.2024
The U.S. Treasury Department’s Financial Crimes Enforcement Network (FinCEN) has issued a final rule (the Access Rule) regarding access to and use of beneficial ownership information (BOI) maintained by FinCEN.
The Access Rule details the circumstances under which FinCEN can disclose BOI to authorized recipients. It also spells out how FinCEN will protect that information and outlines data protection protocols and oversight mechanisms for those who receive beneficial ownership information.
The rule takes effect February 20, 2024. It is the second of three FinCEN rulemakings to implement the Corporate Transparency Act (CTA).
The first rule, the Beneficial Ownership Reporting Rule, took effect January 1, 2024. As covered previously, it requires certain domestic and foreign companies created, or registered to conduct business, in the United States to report information to FinCEN regarding their beneficial owners – individuals who directly or indirectly own or control 25 percent or more of the ownership interests of a reporting company or who exercise substantial control over such an entity.
Companies created or registered after January 1, 2024 must also report information on certain individuals involved in the creation or registration.
The final Access Rule largely tracks FinCEN’s proposed rule (see our prior client alert), with several key changes to address concerns commenters raised during the rulemaking process.
The Access Rule permits these recipients to access BOI, provided they meet required security and confidentiality protocols:
FinCEN declined to permit other financial institutions, such as money services businesses, to access the BOI database, but indicated it intends to evaluate whether to expand access.
FinCEN also clarified that:
Financial institutions are not required to access FinCEN’s BOI database. FinCEN and various bank regulators issued an interagency statement clarifying that the Access Rule does not create a new regulatory requirement for banks to access BOI in FinCEN’s database or any supervisory expectation that they do so.
FinCEN plans to grant access to its BOI database in phases, as follows:
The Access Rule does not provide a time frame for access.
All authorized recipients except foreign recipients will have direct access to the BOI database, but financial institutions and supervisors will have more limited access than their federal, state, local, and Treasury counterparts. In particular, covered financial institutions may only request information on customers that have provided consent and will not be permitted to conduct broad searches for BOI. Financial institutions will submit identifying information specific to a reporting company and immediately receive an electronic transcript with that entity’s BOI. FinCEN expects that financial institutions will use Application Programming Interfaces (APIs) to access the BOI database.
The CTA establishes BOI as “sensitive information” and imposes strict security and confidentiality requirements on its collection, storage, and use. The Access Rule includes safeguards to prevent unauthorized disclosure or use of BOI. In maintaining BOI, FinCEN must adhere to the Federal Information Security Management Act’s “High” standards, which are the highest level of security controls that U.S. government agencies must apply to unclassified information. Additionally, the Treasury Department has established a process to escalate data breaches and compromises.
Unauthorized use of BOI includes unauthorized access to BOI or violation of security and confidentiality requirements in connection with access.
To access BOI collected by FinCEN, domestic agencies must establish:
Agencies must also enter into an agreement with FinCEN specifying their standards and procedures to protect BOI, and restrict access, conduct audits, and provide FinCEN with reports and certifications.
Financial institutions accessing BOI must develop and implement administrative, technical, and physical safeguards reasonably designed to protect BOI. These requirements can be satisfied by using the same safeguards as those required by Section 501 of the Gramm-Leach-Bliley Act and its implementing regulations. Financial institutions are also required to certify that each request for BOI satisfies the applicable criteria.
Foreign requesters obtaining BOI under an applicable treaty, agreement, or convention must comply with all applicable handling, disclosure, and use requirements of the applicable treaty, agreement, or convention. Foreign requesters obtaining BOI pursuant to a request from a trusted foreign country must establish standards and procedures to protect the security and confidentiality of the BOI, maintain the BOI in a secure system, and restrict access. Recipients of BOI are generally prohibited from re-disclosing it, with certain exceptions.
The rule authorizes penalties for anyone who knowingly discloses or uses BOI except as authorized by the CTA, including civil penalties of $500 for each day a violation continues. Criminal penalties include a fine of up to $250,000 and/or imprisonment for up to five years. If a violation occurs during the commission of other violations of U.S. law, violators can face fines of up to $500,000 and imprisonment for up to 10 years.
FinCEN may suspend or revoke a financial institution’s access to the BOI database for violations of the Access Rule.
FinCEN will issue a third rule, by January 1, 2025, to revise the Customer Due Diligence Rule and bring it into conformance with the CTA and the Access Rule. FinCEN also deferred consideration of certain comments raised on the proposed access rule to address in the third rulemaking or future guidance.