What Is the Corporate Transparency Act (CTA)? BOI Reporting for Fintechs

The Corporate Transparency Act is one of the most significant expansions of U.S. financial crime law in decades. Enacted in 2021 as part of the Anti-Money Laundering Act of 2020 and effective January 1, 2024, the CTA requires most U.S. companies to report their beneficial owners — the real human beings behind the business — directly to FinCEN.

For fintechs, the CTA is relevant in two distinct and important ways: as a reporting obligation your own company very likely has, and as a compliance context that shapes how you approach beneficial ownership verification for your business customers.

This article covers both dimensions — what the CTA requires of your company and what it means for your compliance program going forward.

What Is the Corporate Transparency Act?

The CTA was enacted to close a long-standing gap in U.S. law that allowed shell companies and anonymous entities to be used for money laundering, sanctions evasion, tax fraud, and other financial crime. Before the CTA, it was possible to form a legal entity in most U.S. states with minimal public disclosure of who actually owned or controlled it. Beneficial ownership information was often entirely absent from state formation records.

The CTA changes this fundamentally. It requires most companies formed or registered in the United States to file Beneficial Ownership Information (BOI) reports directly with FinCEN — creating a federal database of the real individuals behind U.S. businesses that is accessible to law enforcement and, in certain circumstances, to regulated financial institutions.

Who Must File — and Who Is Exempt

The CTA applies broadly to what the law calls reporting companies. Most small and mid-sized companies formed or registered in the United States are reporting companies subject to the filing requirement.

Reporting companies include corporations, LLCs, limited partnerships, and other entities created by filing with a state secretary of state or equivalent authority.

There are 23 categories of exempt entities, but the exemptions are narrow and specific. The most relevant exemptions for fintechs to understand are SEC-reporting public companies, banks and credit unions regulated under federal banking law, registered broker-dealers, insurance companies regulated under state law, tax-exempt nonprofit organizations, and large operating companies defined as having more than 20 full-time U.S. employees, more than $5 million in U.S.-source gross receipts or sales, and a physical operating presence in the United States.

Most early-stage and growth-stage fintechs do not meet all three criteria for the large operating company exemption and are required to file unless another specific exemption applies. The fact that your fintech is a regulated financial institution for BSA purposes does not automatically exempt it from CTA reporting. The exemptions are separate and must each be analyzed independently.

What Information Must Be Reported

BOI reports must include information about two categories of individuals.

Beneficial Owners — an individual who directly or indirectly owns or controls at least 25 percent of the ownership interests of the reporting company, or exercises substantial control over the reporting company. Substantial control includes serving as a senior officer such as CEO, CFO, or COO, having authority to appoint or remove senior officers or a majority of directors, or having significant influence over major decisions of the company.

For each beneficial owner the report must include full legal name, date of birth, residential address, and a unique identifying number from an acceptable identification document such as a passport or driver's license along with an image of that document.

Company Applicants — for companies formed on or after January 1, 2024, the report must also identify the individual who directly filed the formation document with the state, and if different, the individual who directed or controlled that filing. Companies formed before January 1, 2024 do not need to report company applicants.

Filing Deadlines

Companies formed before January 1, 2024 had until January 1, 2025 to file their initial BOI report.

Companies formed during 2024 had 90 days from their formation date to file.

Companies formed on or after January 1, 2025 have 30 days from their formation date to file.

Updates to an existing BOI report must be filed within 30 days of any change to the reported information. This ongoing update obligation is operationally significant — any change in beneficial ownership resulting from a funding round, equity transfer, or leadership change must be reported to FinCEN within 30 days of the change occurring.

How to File

BOI reports are filed through FinCEN's Beneficial Ownership Secure System (BOSS), accessible at fincen.gov/boi. Filing is free. There is no annual renewal requirement — only updates when reported information changes.

Penalties for Non-Compliance

The penalties for CTA violations are serious. Civil penalties of up to $591 per day for each day a reporting violation continues. Criminal penalties of up to $10,000 and up to two years imprisonment for willful violations. The same penalties apply to individuals who willfully provide false or fraudulent beneficial ownership information to FinCEN.

What the CTA Means for Your Compliance Program

Beyond your own reporting obligation, the CTA has significant implications for your KYB program. FinCEN's BOI database is being developed to allow covered financial institutions — including MSBs and banks — access to verify beneficial ownership information provided by their business customers. This is expected to streamline the verification step of the KYB process for covered institutions in the future.

In the meantime, your KYB program must continue to independently collect and verify beneficial ownership from your business customers as required under FinCEN's CDD Rule. The CTA creates a parallel government-maintained registry but does not currently eliminate or replace financial institutions' independent KYB verification obligations.

Frequently Asked Questions

Does a fintech startup need to file a BOI report with FinCEN? 

Most fintech startups that are formed as LLCs or corporations are required to file a BOI report with FinCEN unless they qualify for one of the 23 specific exemptions. Early-stage fintechs typically do not qualify for the large operating company exemption since that requires more than 20 full-time employees and more than $5 million in revenue. If you formed your company after January 1, 2024 and have not yet filed, you are likely out of compliance and should file immediately.

What counts as a change that requires updating a BOI report? 

Any change to the information previously reported — including a change in beneficial ownership resulting from new investment, equity transfer, or changes in control — must be updated within 30 days. Changes include a new investor crossing the 25 percent ownership threshold, a change in senior officers who exercise substantial control, a change in address for a reported beneficial owner, and a beneficial owner obtaining a new identification document with a different number.

Is the FinCEN BOI database public? 

No. The FinCEN BOI database is not publicly accessible. Access is limited to federal agencies for law enforcement and national security purposes, state and local law enforcement with court authorization, financial institutions subject to customer due diligence requirements under certain circumstances, and federal functional regulators overseeing those financial institutions. General public access is not available.

How does the CTA interact with existing KYB obligations for financial institutions? 

The CTA and FinCEN's CDD Rule are separate and parallel obligations. Financial institutions' obligation to collect and verify beneficial ownership from their business customers under the CDD Rule exists independently of the CTA. The CTA creates a government-maintained BOI registry that may in the future be available to financial institutions as a verification tool, but it does not currently replace or reduce institutions' independent KYB verification obligations under the CDD Rule.

How ComplyOne Helps

ComplyOne helps fintechs assess their CTA reporting obligations, prepare and file BOI reports correctly, build the update processes needed to maintain compliance as ownership structures change, and integrate CTA considerations into their broader KYB compliance programs — through advisory services or compliance technology.

Talk to the ComplyOne team to get started.

The information in this article is for general educational purposes and does not constitute legal or regulatory advice. CTA requirements and related FinCEN guidance continue to evolve. Consult a qualified compliance professional for guidance specific to your situation.