BOI reporting for borrowers or debt-funded businesses

Major scope change (Interim Final Rule, March 26, 2025): FinCEN adopted an interim final rule narrowing the Corporate Transparency Act (CTA) BOI reporting requirements so that “reporting companies” are now limited to certain foreign entities that have registered to do business in the United States. The interim final rule removed the obligation for entities created under U.S. law (formerly known as “domestic reporting companies”) and U.S. persons to report BOI to FinCEN. Current filing obligations (post-IFR): Foreign reporting companies that (a) were registered to do business in the U.S. before March 26, 2025 must file BOI reports by April 25, 2025; and (b) that register on or after March 26, 2025 have 30 calendar days after receiving notice that their registration is effective to file an initial BOI report with FinCEN. What information a BOI report contains (per the BOI rule): If required to file, a reporting company must identify itself and report for each beneficial owner: full legal name, date of birth, current residential or business address, and a unique identifying number from an acceptable ID (and an image of that ID) along with certain company-identifying information. Company applicants are reported only in certain circumstances (generally for entities created or registered on or after January 1, 2024). Timing for updates and corrections: If any required information changes, a reporting company must file an updated BOI report no later than 30 calendar days after the change. There is a safe-harbor that may avoid penalties if inaccuracies are corrected within 90 days of the deadline for the original report. Exemptions remain important: Prior to and after the IFR, FinCEN’s framework includes numerous exemptions (23 enumerated exemptions under earlier guidance), including many nonprofits, certain large operating companies, subsidiaries, and others. Companies that become newly exempt must generally file a “newly exempt entity” report or an updated report within 30 days of losing or gaining exempt status as described in FinCEN guidance; read the exemption criteria carefully. Enforcement and penalties: Willful failure to report, update, or correct BOI may result in civil penalties (historically up to $500 per day, adjusted for inflation) and criminal penalties (potential fines and imprisonment up to 2 years and/or fines up to $10,000). FinCEN has indicated outreach and phased enforcement; timely correction within safe-harbor windows can mitigate penalties. Interaction with lenders and financial institutions: Even after the IFR, financial institutions remain subject to other rules (Bank Secrecy Act/Customer Due Diligence rules) requiring collection of beneficial ownership information for certain customer relationships (e.g., when opening accounts). FinCEN issued notices to financial institution customers explaining interactions and cautions about fraudulent solicitations. Lenders should continue performing usual KYC/ownership due diligence, and borrower counsel should anticipate lender requests for ownership and control information; creditors may qualify for specific exceptions in the BOI context if their only interest is repayment (creditor exception described in guidance). Privacy and access: BOI reports are stored in a secure, non-public FinCEN database. Access is narrowly defined (law enforcement, certain federal agencies, and other authorized requesters under specified criteria). Practically, business owners should still plan for confidentiality in lender-customer communications and contract clauses governing use of ownership data. State-level considerations: There is no single statewide substitute that universally replaces FinCEN BOI reporting for U.S. companies following the IFR. However, state filing/formation requirements and some state-level transparency initiatives may require collection or disclosure of officer/agent information on formation documents; obligations and thresholds vary by state. Recommend checking the Secretary of State and other state-level guidance for any state-specific beneficial ownership or registration-related information requirements, and flag states where formation/registration paperwork or agent-of-service filings may require disclosure of owner/manager names or addresses. Immediate takeaway for US domestic borrowers: After the March 26, 2025 interim final rule, most U.S.-formed entities are no longer required to file BOI reports with FinCEN; however, lenders may still request ownership information as part of credit underwriting and KYC, and some borrowers may still be foreign entities subject to FinCEN. Verify entity status (domestic vs. foreign) before assuming no BOI exposure. Checklist for lenders and borrowers: 1. Verify whether the borrower is a “reporting company” under current FinCEN definitions (post-IFR: primarily foreign entities registered to do business in the U.S.). 2. If the borrower is a reporting company, gather required BOI elements: company identification, each beneficial owner’s name, DOB, address, ID number and issuing jurisdiction, and ID image; plan for secure document handling and storage. 3. Include contract representations/warranties and covenant language requiring borrowers to notify lenders within 30 days of any material changes to ownership or exempt status (to align with FinCEN’s 30-day update deadline). 4. Maintain internal secure storage and limited-access procedures for BOI and sensitive ID images; limit dissemination and include data-destruction timelines. 5. For lenders: continue standard BSA/CDD routines; do not rely solely on FinCEN filing status — collect ownership/control info necessary for credit risk and AML compliance. 6. Monitor FinCEN guidance and Federal Register notices for further regulatory changes (the BOI regime has changed via IFR and could be revised again).