Governance, Risk and Compliance

What the New FinCEN Reporting Requirements Mean For MSPs

Share
Continuous compliance

In late 2022, the Financial Crimes Enforcement Network (FinCEN) implemented the Corporate Transparency Act’s (CTA) beneficial ownership information (BOI) reporting provisions. The rule was put in place to address a malicious practice: Illicit actors using shell and front companies to mask their identities and launder money through the United States. This is a national security issue, yes, but it's also detrimental to U.S. economic prosperity because it allows criminals to illegally access and transact in the U.S. economy, while disadvantaging small U.S. businesses who are playing by the rules. FinCEN's BOI reporting requirements make it harder for illicit actors -- like drug traffickers, fraudsters, corrupt actors such as oligarchs and proliferators -- to use shell companies to launder their money or hide assets.

To prevent this, all companies with companies with fewer than 20 full time employees or under $5 million in gross receipts or sales that have a physical operating presence in U.S. must submit beneficial owner information by January 1, 2025, said Gib Olander, chief product officer, Northwest Registered Agent.

"Companies with more than 20 full-time employees with over $5 million in gross receipts or sales with a physical operating presence in the U.S. are exempt," Olander told ChannelE2E. "There are others who are exempt; regulated entities, banks, credit unions, insurance companies, registered investment advisors and public accounting firms that are already subject to extensive federal regulations are exempt as well as certain nonprofit organizations that qualify as tax exempt under the internal revenue code. For them, there's already enough regulation on them and that information is already provided," he said.

Many organizations that meet this criteria are MSPs and MSSPs and may be subject to the FinCEN reporting requirements.

Olander added that organizations that must file this information are assured that the information is secure and is not made public. Even so, many SMBs might want to use a registered agent, which is a person or company that is legally authorized to receive legal documents and other important notifications on behalf of a business. They act as a point of contact for the business, and are responsible for forwarding any documents to the business owner in a timely manner. Some of the documents a registered agent may receive include subpoenas, legal notices, government correspondence, tax notices, notice of garnishment proceedings and litigation documents. 

A business owner may be able to act as their own registered agent if they have an official street mailing address and are available during business hours to receive documents. However, using a registered agent service can offer more privacy and reliability. 

The actual BOI information a business must provide is actually quite simple, Olander explained. The rule requires a reporting company to identify itself and report four pieces of information about each of its beneficial owners: Name, birthdate, address and a unique identifying number and issuing jurisdiction from an acceptable identification document (and the image of such document). Additionally, reporting companies created after January 1, 2024, must provide the four pieces of information and document image for company applicants.

If an individual provides their four pieces of information to FinCEN directly, the individual may obtain a “FinCEN identifier,” which can then be provided to FinCEN on a BOI report in lieu of the required information about the individual.

The rule took effect on January 1, 2024, and reporting companies created or registered before January 1, 2024 have until January 1, 2025 to file their initial reports. Reporting companies created or registered after January 1, 2024, will have 30 days after receiving notice of their creation or registration to file their initial reports. Once the report is filed, there's no need to re-up, Olander said, unless something about the beneficial owner changes or the business changes hands.

Reporting companies have 30 days to report changes to the information in their previously filed reports and must correct inaccurate information in previously filed reports within 30 days of when the reporting company becomes aware or has reason to know of the inaccuracy of information in earlier reports.

Organizations that don't file this information will be penalized, Olander explained. The fines are $500 per day for each day the information is not filed. While this wouldn't be a significant financial hardship for a large enterprise, for an SMB, it could be serious.

At the same time, FinCEN is trying to make compliance easier from an administrative standpoint and more cost-effective for small businesses and other reporting companies. FinCEN stated in September 2022 that it estimated it would cost reporting companies with simple management and ownership structures—which FinCEN expects to be the majority of reporting companies—approximately $85 apiece to prepare and submit an initial BOI report. In comparison, the state formation fee for creating a limited liability company (LLC) can cost between $40 and $500, depending on the state.

"You can go to FinCEN's site and do this yourself, or you can hire someone to take care of it for you," Olander said. "We've seen prices all over the map -- but we'll do it for you for $25. The biggest struggle for SMBs is when something like this is a surprise. So, we want to make sure that the awareness is there and that companies are complying with the law," he said.

You can find more information at the FinCEN website and in the FAQ here.

Sharon Florentine

Sharon manages day-to-day content on ChannelE2E and serves as senior managing editor for CyberRisk Alliance’s Channel Brands. She also covers enterprise-class technology companies, strategic alliances and channel partner strategies. Sharon is a veteran tech journalist and editor with more than 25 years experience in the industry, and has previously held key editorial, content and leadership positions at Techstrong Group, CIO.com, Ziff Davis Enterprise and CRN.