The Challenge Facing Compliance Teams
Since March 2025, when the Treasury exempted domestic companies from Corporate Transparency Act reporting requirements, compliance teams have been asking, "What does this mean for our KYC program?" The lawsuit filed by 21 state Attorneys General against FinCEN highlights the concern, the exemption of over 99.9% of originally covered entities undermines the beneficial ownership infrastructure your due diligence programs rely on.
These concerns come from MLROs at regional banks who built workflows around FinCEN BOI database access, fintech compliance officers explaining to product teams why onboarding just got harder, and BSA officers at credit unions wondering if they're now liable for gaps they can't fill. Here's what you're actually asking, and what the current state of play means for your programs.
Do You Still Need to Collect Beneficial Ownership Info?
Yes. The Treasury's exemption doesn't change your obligations under the Customer Due Diligence Rule (31 CFR § 1010.230). You're still required to identify and verify beneficial owners, individuals who own 25% or more of a legal entity customer or who exercise significant control, at account opening for covered financial institutions.
However, you won't have a centralized FinCEN database for verification. The CDD Rule, effective since May 2018, remains unchanged. Your certification and verification procedures, as well as your customer identification program requirements under 31 CFR § 1020.220, stay the same.
What changes is your ability to cross-reference customer-provided information against a government-maintained registry. You're back to relying on customer attestations, document review, and your own investigative work.
How to Adapt Your KYC Refresh Process
Redesign your process around traditional verification methods and third-party data sources. The BOI database was intended as a shortcut for periodic review. With it off the table for domestic entities, you'll need to request updated beneficial ownership certifications directly from customers, especially for higher-risk clients.
For lower-risk customers, document a risk-based refresh cycle. A stable, low-volume domestic LLC in a low-risk industry might justify a three-year refresh cycle if your risk assessment supports it. A cash-intensive business or a customer in a high-risk sector needs annual or more frequent verification.
Third-party data providers like corporate registries, Dun & Bradstreet, and LexisNexis become more critical. They're not substitutes for customer certification but provide corroborating evidence for your verification procedures.
Accessing BOI Data for Foreign Entities
Yes, but with limitations. Under FinCEN's revised rule, foreign companies operating in the U.S. still have reporting obligations. However, foreign companies don't have to report U.S. company applicants, and U.S. persons with FinCEN identifiers aren't required to update that information.
This creates a verification gap. If you're onboarding a foreign entity with U.S. subsidiaries or U.S. beneficial owners, you'll get partial data at best. Treat BOI database queries for foreign entities as one input among several, not as definitive verification. You're still responsible for independent verification of U.S. persons in the ownership chain.
Impact on Suspicious Activity Report Decisions
The lack of verified beneficial ownership data complicates your SAR narrative. When filing a Suspicious Activity Report, you're required to provide complete information about the subject, including identification and relationship to your institution. Without access to verified beneficial ownership data, you're filing based on incomplete information.
Document the gap explicitly. If you're filing a SAR on a domestic LLC conducting structured transactions and can't verify beneficial ownership beyond customer-provided attestations, state that in the narrative. This isn't a reason not to file but to be more detailed about what you know, what you don't know, and what steps you took to obtain the information.
What If the Lawsuit Succeeds?
You'll face a retroactive reporting and verification problem. If a court vacates the exemption rule and reinstates domestic BOI reporting requirements, companies will need to file reports, potentially with retroactive effective dates. Your customer base will suddenly have filing obligations they thought were eliminated.
Start documenting your current verification procedures now. If you're conducting enhanced due diligence on higher-risk domestic entities despite the absence of BOI data, memorialize that in your CDD files. If the regulatory landscape shifts again, you'll need to demonstrate you maintained reasonable procedures throughout.
Should You Adjust Risk Ratings for Domestic Entities?
Consider it, especially for entity types targeted by the Corporate Transparency Act. The CTA focused on shell companies and opaque ownership structures due to their elevated money laundering risk. If you can't verify beneficial ownership through a government registry, that's an inherent control weakness.
This doesn't mean every domestic LLC automatically becomes high-risk. But if you're applying a risk-based approach, the absence of verifiable BOI data is a factor in your risk assessment. Document your risk rating methodology and the factors you're weighing.
Liability for Missing Beneficial Owners
You're liable for your procedures, not for omniscience. Your CDD Rule obligations require you to establish and maintain written procedures that are reasonably designed to identify and verify beneficial owners. If you've implemented risk-based CDD procedures, documented verification attempts, used available data sources, and escalated to enhanced due diligence when necessary, you're meeting the standard.
The risk is that shell companies and money launderers will exploit the verification gap. If your institution becomes a vehicle for illicit finance because you failed to implement reasonable procedures, you're exposed to enforcement action under the Bank Secrecy Act. But the enforcement standard is whether your program was reasonably designed and implemented, not whether you caught every bad actor.
Next Steps
Monitor the lawsuit's progress. The case is New York v. Financial Crimes Enforcement Network. If the court grants the Attorneys General's request for an injunction, the exemption rule could be blocked before final judgment.
Review your CDD procedures with counsel. If you haven't updated your written procedures since the March 2025 exemption announcement, do it now. Document how you're verifying beneficial ownership without BOI database access.
Check FinCEN's guidance page for updates on foreign entity reporting requirements. The rules for foreign companies are still being interpreted, and you'll need current guidance for any cross-border customers.
And talk to your examiners. If you're uncertain whether your current verification procedures meet the "reasonably designed" standard without BOI data access, ask during your next exam cycle. Better to surface the question proactively than to get cited for deficient procedures after the fact.
