For FinCEN’s beneficial ownership launch, the hardest design problem was shrinking

The week

On New Year’s Day 2024, millions of American small business owners acquired a federal obligation most of them had never heard of. The owner of a two-person landscaping LLC, a family that holds a rental property through a company, a start-up founder who incorporated online over a weekend: all were suddenly expected to tell a Treasury bureau who really owned and controlled their business.

On January 1, 2024, the Financial Crimes Enforcement Network, or FinCEN, the Treasury bureau that collects financial intelligence to fight money laundering, began accepting beneficial ownership information reports under the Corporate Transparency Act of 2021. A “beneficial owner” is the real person behind a company, as opposed to the name on the paperwork. The idea was to make it harder to hide money behind anonymous shell companies, businesses that exist on paper but have no real operations.

The launch date had a symmetry to it. The Corporate Transparency Act became law on January 1, 2021, when Congress overrode a presidential veto of the annual defense authorization bill that carried it. It was one part of the Anti-Money Laundering Act of 2020, the largest overhaul of U.S. anti-money laundering law in years. Three years of rulemaking separated the statute from the first filing.

The law required many corporations, limited liability companies and similar entities to report the individuals who own or control them, with exemptions for categories such as large operating companies and already regulated entities like banks. Companies existing before 2024 had until January 1, 2025 to file; companies created during 2024 had 90 days from formation.

The definitions decided who had to act. A beneficial owner was any individual who exercised substantial control over the company or owned or controlled at least 25 percent of its ownership interests. The rules listed 23 types of exempt entity. One was the large operating company. It needed more than 20 full-time employees in the United States, more than $5 million in gross receipts or sales on its prior-year federal return, and a physical office in the country. Companies formed from 2024 onward also had to report their company applicants: the person who filed the formation document and, where several were involved, the person mainly responsible for directing the filing.

The 90-day window for companies formed during 2024 was itself a late adjustment. The original rule gave new companies 30 days; FinCEN extended that for 2024 only in a rule finalized weeks before launch, while companies formed from 2025 would return to 30 days. Owners also had to file an updated report within 30 days of any change to the information reported. Willful failures carried civil penalties of up to $500 for each day a violation continued, a figure adjusted for inflation, and criminal penalties of up to two years in prison and a $10,000 fine. Filing itself cost nothing.

FinCEN launched a free online filing system and a FinCEN identifier that individuals could obtain once and share with companies. The identifier is a reference number that stands in for a person’s sensitive details, so that someone who owns several companies does not have to hand over a passport image again and again. In its rulemaking, FinCEN had estimated about 32.6 million reporting companies in the first year. That is a filing population on the scale of a national tax program, but aimed at people who mostly had no compliance staff and no idea the agency existed.

Requesting a FinCEN identifier for an individual required a Login.gov account, the federal government’s shared sign-in and identity verification service, tied to the person receiving the identifier. Filing a company report did not. The two routes reflected a deliberate choice about how much identity checking each transaction needed.

The reports went into a non-public database. Unlike the United Kingdom’s register of people with significant control, which anyone can search, the U.S. system was built for government and, with consent, bank users. That choice shaped both the privacy promise to filers and the security burden on the agency.

Two further pieces completed the picture. In December 2023, FinCEN finalized rules on access to the data, including by banks for customer due diligence with the customer’s consent, the checks banks carry out to know who they are dealing with. And a cloud hung over the launch: a constitutional challenge to the law, filed in 2022, was pending in federal court in Alabama. The program opened its doors while a court was still deciding whether it should exist at all.

States were moving too. In late December 2023, New York enacted its own LLC transparency law, with a later effective date, showing that the federal program would not be the only beneficial ownership obligation small companies might face.

Beneficial ownership reporting was designed to close a gap that let anonymous shell companies move illicit money. To the people who had to comply, it looked different: a new federal filing for owners of small businesses, many of whom had never heard of FinCEN. Seen as a public service, the filing itself raised design problems of its own.

Any agency imposing a new obligation on millions of people faces four design problems, which follow the life of the obligation from start to end: telling people they must act, taking the filing securely, protecting filers from those who exploit the obligation, and narrowing the program cleanly if its legal footing moves. The first three are familiar to anyone who has launched a large public program. The fourth is the one that is rarely planned, and in this case it turned out to matter most.

What a mass public obligation actually involves

From the outside, a new filing requirement looks like a form and a deadline. From the inside, it is a large piece of public infrastructure. It needs a website and a database that stay available and secure while millions of people use them. An identity system has to decide how sure it needs to be that each filer is who they claim to be. A communications program has to reach people who do not read the Federal Register. Then come a help desk, an enforcement policy, a privacy regime governing who may see the data, and a records schedule saying how long it is kept.

Each of those pieces has to work for the least prepared person in the filing population, not the most prepared. A bank’s compliance department will find the guidance and file correctly. A retired couple who set up an LLC years ago to hold a vacation cottage may never hear about the requirement at all. That gap between the most and least prepared filers drives almost every design decision.

The rules as a filer met them

The rules themselves were a design problem. To decide whether it had to file, a company had to work through 23 exemptions. Several turned on facts a small owner rarely tracks, such as headcount thresholds or whether a parent company qualified. Having decided it must file, it had to identify every individual with substantial control, a concept that reaches senior officers and anyone with important decision-making authority as well as owners. Companies formed from 2024 also had to identify their company applicants, often a paralegal or an employee of a formation service whom the owner had never met.

Each of those steps asked a non-specialist to make a legal judgment. Agencies cannot remove that burden entirely, because the definitions come from statute and rule. They can reduce it. Decision trees that walk a filer through exemptions help. So do answers for the most common structures and a clear statement of which questions call for professional advice. Each shifts effort from the filer to the agency, which only has to do the work once.

The stakes are real for both sides. For the public, the risk is penalties, confusion and fraud. For the agency, the risk is a database full of missing or stale data, a flood of help-desk calls, and a loss of public trust that makes the next program harder. The lessons travel well to other agencies, and to businesses that impose obligations of their own on customers or suppliers.

Telling people they must act

Most federal reporting regimes reach regulated entities with compliance staff. This one reached single-member LLCs, family holding companies, small landlords and start-ups formed through state processes that said nothing about federal reporting. Penalties for willful failure to file were significant, which made awareness a fairness question as much as an operational one. It is hard to defend penalizing someone for missing a deadline they had no reasonable way to know about.

The penalty structure sharpened that problem. Civil penalties accrued daily, and the law also carried criminal penalties for willful violations. The willfulness standard offered some protection to people who genuinely did not know. It did not make the experience less alarming, and fear of penalties was exactly the lever that scammers later pulled.

The people best placed to tell them were intermediaries: state secretaries of state, which register entities and send annual reminders; accountants and attorneys who advise small businesses; banks, which open business accounts; and registered agent firms, the companies that serve as a business’s official address for legal papers. An outreach plan for a program like this sets out, for each intermediary, what message it will carry, at what moment, and what material it needs.

Each intermediary had its own constraints

None of the intermediaries was a neutral pipe. State registries formed the companies but ran their own systems under their own laws, and they had no federal duty to carry FinCEN’s message. Accountants faced a professional question: deciding who has substantial control can call for legal judgment, so firms had to decide how far their engagement letters went and whether to refer clients to lawyers.

Banks were in a different position again. Since 2018 they had collected beneficial ownership information from legal entity customers at account opening under FinCEN’s customer due diligence rule. Customers who had certified their owners to a bank could reasonably assume they had already dealt with the matter. A bank relationship manager who mentioned the new filing had to explain that the bank’s form and the FinCEN report were separate, and that the bank could not file on the customer’s behalf.

Registered agents and formation services had commercial incentives. Some offered to file for a fee, which was legitimate when disclosed and harmful when presented as mandatory. An outreach plan that relies on intermediaries has to account for each one’s incentives as well as its reach.

Timing matters as much as reach. A state registry’s formation confirmation is a far better reminder than a press release, because it arrives at the exact moment the new obligation begins, in the hands of the exact person who has to act. In the same way, a bank opening a business account can mention the requirement while the owner is sitting across the desk, and an accountant can raise it at year-end. FinCEN produced extensive guidance and frequently asked questions during 2024, and the volume of questions showed how unfamiliar the obligation was.

Take a state business registry that forms several thousand new companies a month. If it adds two sentences and a link to its formation confirmation email, every new company in the state learns about the federal obligation on day one, at almost no cost. If it does nothing, those owners are relying on chance.

Measuring whether people know

Awareness can be measured. An agency can compare filings against the expected population by month and by state, track help-desk questions by topic, and watch for clusters of late filings that suggest a channel failed. Those signals allow a mid-course correction, such as a second wave of registry notices or a targeted campaign through accountants before a deadline. Without them, the agency learns how well it communicated only when the deadline has passed.

Deadlines shape demand in predictable ways. Most people act shortly before a deadline, so filing volumes, help-desk calls and identity verification attempts bunch together in the final weeks. A system sized for average load will slow or fail exactly when the most anxious filers arrive. Capacity planning, staffing for the help line and the timing of reminder waves all follow from that pattern. A program with a single national deadline concentrates the surge; one with rolling deadlines tied to formation dates spreads it.

Taking the filing securely

Reports contained names, dates of birth, home addresses and identity document numbers with images, for millions of individuals. That is precisely the information identity thieves want. The filing system had to accept submissions from people filing once, often without help, without making it easy to file false information or alter another company’s report.

The central tension is identity proofing: the process of checking that a person is who they say they are, for example by verifying a driver’s license or matching a selfie to a passport photo. Strong identity proofing reduces fraud and deters legitimate filers; light proofing does the reverse. Set the bar too high and honest small business owners give up halfway through. Set it too low and fraudsters can file false reports or tamper with real ones.

The FinCEN identifier was a sound design choice. It let an individual who owns several companies submit sensitive details once and be referenced thereafter, which reduces both repeated collection and the number of places the data travels. It works rather like a trusted traveler number at the airport: verify once, then use the number.

Agencies designing similar systems should set the identity assurance level per transaction, following NIST’s digital identity guidelines. NIST, the National Institute of Standards and Technology, publishes widely used guidance that grades how much confidence a system needs in a person’s identity. The principle is to match the checks to the risk: viewing a public guidance page needs none, submitting a report needs some, and changing someone else’s record needs a great deal. Agencies should also provide an assisted route for filers who cannot complete online verification, such as a call center able to take corrections. Some people do not have smartphones, stable addresses or the documents online checks expect, and they still have to comply.

Accessibility and language belong in the same design pass. Federal agencies must make their electronic services accessible to people with disabilities under Section 508 of the Rehabilitation Act, and a long-standing executive order directs them to improve access for people with limited English proficiency. A filing population of millions of small business owners includes many people who run their businesses in a language other than English. Translated guidance and interpreter support on the help line reduce errors as well as complaints.

How the assurance levels work

NIST’s guidelines separate two questions. Identity assurance asks how confident the system is that a person is who they claim to be when an account is created, for example by checking a government document against the person presenting it. Authentication assurance asks how confident it is that the person signing in later is the same one, through passwords, one-time codes or phishing-resistant keys. A program can set each level per transaction rather than for the whole system.

The FinCEN design reflected that split. Obtaining an identifier ran through Login.gov, which handled identity verification. Filing a company report did not require it. The trade-off was explicit: a lower barrier for the filing most people needed to make once, and a stronger check for the identifier that would stand in for a person across many companies. The cost of the lower barrier is that a false report is easier to submit. The agency then needs other ways to detect anomalies, such as patterns of filings from one source or identifiers reused implausibly.

Protecting the data once collected

The access side carried its own safeguards. The access rule finalized in December 2023 limited who could query the database: federal agencies for national security, intelligence and law enforcement work, state and local law enforcement with court authorization, certain foreign requesters through federal agencies, and financial institutions with the reporting company’s consent. The statute also made unauthorized disclosure or use of the information a crime, with penalties far heavier than those for failing to file.

Those controls matter to filers, but they are invisible to them. A small business owner deciding whether to upload a passport image cannot see the access rule. An agency that explains, in a few sentences on the filing page, who can see the data and under what conditions, gives cautious filers a reason to comply and removes one argument scammers use.

Corrections deserve equal care

Corrections deserve as much design attention as first filings. Owners move, sell stakes and renew passports, and each change triggered an update obligation within a set period. A service that makes the first filing easy and updates hard will accumulate stale data quickly, which undermines the purpose of the registry for the law enforcement users it was built for. A database of ownership records that were accurate two years ago is of limited use to an investigator trying to trace money today.

The identifier helped here as well. Where a company report referenced an individual’s FinCEN identifier rather than personal details, a change of address could be made once, on the identifier. It did not have to be repeated on every company report that named the person. Designing for updates means looking for those points where one change would otherwise have to be repeated many times.

Protecting filers from exploitation

A new mandatory filing is an opening for scams. During 2024, FinCEN warned of fraudulent letters and emails demanding payment for beneficial ownership filing or directing recipients to fake websites. This is phishing, the practice of impersonating a trusted organization to trick people into paying money or handing over information. It thrives wherever people are anxious about an obligation they do not fully understand.

Why this obligation was easy to exploit

Several features made this program a gift to fraudsters. Business formation records are public in most states, so a scammer can assemble a mailing list of newly formed companies with little effort. The obligation was new, so recipients had no prior letter to compare. Penalties were real and widely publicized, which made urgent demands credible. And the agency was unknown to most filers, so a convincing logo and an official-sounding form number were enough.

The scams took several forms: letters demanding fees for a free filing, emails linking to lookalike websites that captured identity documents, and offers from services that implied official status. In December 2024 FinCEN issued an alert on fraud schemes abusing its name, insignia and authorities, which gave banks red flags to watch for in customer activity.

Filing was free, which made the warning easy to state but hard to land, because recipients did not know what a legitimate notice looked like. If you have never received a letter from an agency, you have no way to tell a real one from a fake.

The defense is a published contact policy: how the agency will and will not contact people, a single official web address promoted through every intermediary, and a reporting channel for suspicious contacts. Banks learned this years ago. Their customers are told, repeatedly, that the bank will never ask for a password by email. The message works because it is simple, consistent and repeated through every channel.

Consumer protection agencies and state attorneys general can amplify the warnings. Intermediaries can repeat them at the moment a client is most likely to be targeted, such as just after forming a company, when public registration records make new owners easy to find. Private filing services also proliferated, some legitimate and some predatory, and a clear statement that filing directly with the agency costs nothing protects filers from both.

The operational side of scam defense

A published contact policy is the foundation. The operating work comes after it. An agency can monitor for lookalike domains and request takedowns, publish examples of known fraudulent letters so filers can compare, and give intermediaries a short paragraph they can paste into their own messages. A government domain is a useful trust signal, but only if filers have been told to look for it. Reports of suspicious contacts are intelligence: they show which channels scammers are using and which populations they are targeting.

Banks have a role on the receiving end. Payments to fake filing services pass through customer accounts, and the red flags in an alert help fraud teams spot them. For a community bank or credit union with many small business customers, a brief notice reminding them that the filing is free can prevent losses that would otherwise end up as disputed payments.

Narrowing the program cleanly

The fourth problem is the one agencies rarely design for. The law had been challenged since 2022, and on March 1, 2024 the federal court in Alabama held that it exceeded Congress’s powers and barred enforcement against the plaintiffs, while FinCEN continued to require filing by everyone else. Filers and their advisers then had to follow litigation to know their obligations. In principle, an accountant with some clients covered by the court’s order and others not could have to give different answers to near-identical businesses.

A court order defined a population the agency could not see

The Alabama order showed how hard narrowing can be. FinCEN said it would not enforce the law against the individual plaintiff, the companies he owned or applied for, the National Small Business Association, and members of that association as of March 1, 2024. Membership in a private association on a given date was not a field in any FinCEN system. The agency could not look up who was covered. Covered companies had to know it themselves, and an adviser had to ask each client.

That was not a failure of the agency’s engineering. Courts define the scope of their orders, and no data model can anticipate every population a court might choose. The design lesson is narrower: the populations a program itself defines, by entity type, by formation date, by domestic or foreign status, should be recorded in a form that can be queried. When the eventual narrowing came, it followed exactly such a line.

A program on contested ground can be built to narrow without chaos, and the techniques are not exotic.

• Clean definitions. Its rules can define populations cleanly, so that a court order or policy change affecting one group can be applied without re-deciding everyone else’s status.
• Tagged records. Its systems can tag records by the legal basis on which they were collected, so that data from a population later exempted can be isolated, restricted or deleted. A tag is simply a label stored with each record that lets the system find every record in a category at once.
• A standing status page. Its communications can carry a standing page that states, simply and with a date, who must file today.
• A retention schedule. Its retention schedule can say what happens to records if the requirement ends.

Each of these costs little at launch and a great deal to retrofit. Adding a field to a database before it holds millions of records is trivial; reconstructing, after the fact, which legal basis applied to each record can be very hard. They also protect the agency’s credibility with the public, which it will need for the next obligation it launches.

What a status page has to do

A status page sounds trivial and rarely is. It must state, with a date at the top, which populations must act, by when, and what changed since the last version. Earlier versions should stay available, because advisers need to show what the rule was on the day a client filed or did not. Subscribers should be able to receive updates by email, since few people check a page daily.

The harder part is the approval chain. A court order can arrive late on a Friday, and the page is only useful if it changes within hours. Agencies can prepare draft wording for the likely outcomes of pending litigation, such as a loss, a win, a partial ruling or a stay, and agree in advance who can approve publication. Counsel reviews the drafts calmly before the ruling rather than under pressure after it.

Retention written for the program’s whole life

Retention rules are usually written for a program that continues. The statute required FinCEN to keep beneficial ownership information for at least five years after a reporting company terminated. That floor answered how long to keep data while the program ran. It did not answer what should happen to data from people the program no longer covered. That question needed a separate decision when the time came.

For federal agencies, records schedules approved by the National Archives govern disposal, and changing them takes time. An agency that writes its contingencies into the schedule at launch, including what happens if a category of filer is exempted, avoids a scramble later. State agencies work under their own records laws, which often follow a similar approval process.

The objection that planning for retreat invites it

Some officials would resist this advice. Designing a program to shrink might look like an admission that its legal basis is weak, and litigants could cite the contingency plans as evidence. Resources spent on exits are not spent on launch. Those concerns are real, and they argue for discretion in how the planning is described, not for skipping it. Clean population definitions and tagged records serve ordinary operations too: they make analysis, enforcement targeting and audits easier. A retention schedule with contingencies is routine records management. None of it needs to be framed as preparing for defeat.

One registration program, four decisions

To see how the four problems interact, suppose a state agency launches a new annual registration for short-term rental hosts. Perhaps 80,000 households will have to register, most of them people who rent out a spare room or a holiday cottage and have never filed anything with the agency before.

On awareness, the agency’s first instinct is a press release and a page on its website. A better plan maps the intermediaries: the rental platforms that send hosts messages, the county tax offices that already collect lodging taxes, local tourism boards and the accountants who prepare hosts’ returns. Each gets a short message, a date to send it and a link. The platform reminder, arriving in the app hosts already check daily, will do more than any amount of coverage in the news.

On secure filing, the agency decides that viewing guidance needs no login and that submitting a registration needs a basic identity check. Changing the bank account linked to a registration needs a strong one, because that is the change a fraudster would most want to make. It sets up a phone line where staff can help hosts who fail the online checks, and it makes updating a registration a two-minute task.

On scams, the agency publishes, before launch, a short statement: registration is free; we will never call to ask for payment; the only official site is this address. It asks the platforms and county offices to repeat it word for word. When fake “registration services” appear, as they will, hosts already know the rule.

On narrowing, the agency’s lawyers note that a pending lawsuit argues the requirement should not apply to owner-occupied homes. So the database records, for every registration, whether the property is owner-occupied, and the retention schedule says what happens to records if any category is exempted. If the court rules against the agency, it can identify the affected registrations in an afternoon, post a dated notice that night, and delete or restrict the data on a published timetable.

The registration system also keeps a dated status page from day one, even while nothing is in dispute. When the ruling arrives, the page is updated rather than created, and the platforms and county offices already link to it.

These steps are all cheap. Together they decide whether the program is remembered as a reasonable request handled competently or as a confusing mess that invited fraud and then collapsed.

The costs fall in different places. Mapping intermediaries costs staff time in the months before launch. The assisted phone line is a running cost, sized by how many people fail online checks. The extra data field costs almost nothing if it is added before launch. Those choices are cheap because they are made early, when nothing has yet been built around the wrong assumptions.

The same four problems outside government

For agency heads, the reasons are obvious: compliance rates, help-desk costs, fraud losses and public trust all ride on these choices. But the same logic applies to any organization that tells large numbers of people they must do something new. A bank asking every business customer to recertify its owners, a health system moving all patients to a new portal, a utility requiring customers to re-enroll in a program: each faces the same four problems. Each will be judged by the least prepared person it reaches, and each may one day need to unwind part of what it asked for.

Private organizations unwind obligations more often than they expect. A bank that stops collecting a document after a rule changes should decide whether to keep or purge what it already holds, and state privacy laws and its own retention schedule will shape that answer. A health system that retires a portal must decide what happens to the accounts, messages and proxy permissions inside it. The same tagging and retention discipline applies.

How the problems differ by organization

The four problems take different shapes by sector. A regional bank asking business customers to recertify beneficial owners already has a relationship and a channel, so awareness is easier, but the identity problem is acute: the change most worth faking is a new signer on a business account. A credit union may face the same task with fewer staff and older systems, which makes the assisted route and the update process the main risks.

A broker-dealer collecting new information from clients works under recordkeeping rules that define how long records are kept, so its narrowing problem is less about deletion and more about labeling: which records were collected under which requirement. A health system moving patients to a new portal faces the awareness problem among older patients and the identity problem around proxy access for caregivers. Scammers follow both, sending fake portal invitations to patients who expect a real one.

Agencies differ too. A federal program can rely on Login.gov and a national communications effort, but it depends on states and private intermediaries it does not control. A county program reaches residents directly through local offices, but it may have no identity service of its own and limited ability to monitor scams. Each should design around the piece it controls least.

The financial argument is simple. Getting the design right before launch costs a few weeks of planning. Getting it wrong costs call-center surges, remediation projects, data clean-up and, sometimes, the reputational damage of headlines about confused customers and scammed citizens.

Designed to launch, designed to shrink

A well-designed mass obligation has an outreach plan built around intermediaries and moments, not press releases. Its identity checks match the risk of each transaction, with a human-assisted route, and its update process is as easy as the first filing. It publishes a contact policy before the scammers arrive. And its data structures, communications and retention rules allow the program to shrink in an orderly way if a court or policymaker requires it.

Measures to agree before launch

A program can agree its measures before the first filing. Useful ones include filings against the expected population, the share of filers who abandon the online process partway, help-desk wait times, the volume of correction filings, and reports of scam contacts. A narrowing measure belongs on the list too: the time needed to identify every record in a defined population. If that number is days rather than minutes, the data model needs work before the database fills.

The failures mirror those strengths:

• Assuming that publishing guidance is the same as informing people.
• Designing the system for the confident filer and leaving everyone else to the help desk.
• Treating corrections as an afterthought, so the data decays.
• Warning about scams only after they have spread.
• Building the program as though its legal basis were permanent, so that any change requires emergency engineering and confusing public messages.

These lessons are not unique to government. A bank introducing new customer documentation rules, a health system requiring patients to re-register through a new portal, or an insurer collecting new information from brokers faces the same four problems on a smaller scale.

Who owns each problem

The four problems need four owners. Communications and partner relations own awareness, including the intermediary plan and the measures that show whether it works. The digital service and security teams own the filing system, the identity checks and the assisted route. Fraud, consumer protection and communications share scam defense. Legal, records management and data architecture own narrowing, and they are the group least likely to be convened before launch. A launch checklist that names all four owners makes the gap visible.

What to settle before launch

1. Who exactly must comply, how many have never dealt with us before, and which intermediaries already reach them?
2. For each transaction in the system, how sure do we need to be of the person’s identity, and what happens to someone who cannot verify online?
3. Is updating a record as easy as filing it the first time?
4. Have we published how we will and will not contact people, and is our official web address on every piece of material?
5. If a court narrowed this program next month, could we identify every affected record within a day, and does our retention schedule say what happens to the data?

A program that can answer those five can also keep the dated page that says who must comply today, which is the one piece of communication every filer will eventually need.

Those answers can be written down in a few pages before launch and revisited whenever the program’s legal footing shifts. They are cheapest to settle while the database is empty and the first notices have not yet gone out.

With hindsight

The litigation reshaped the program. In December 2024 a federal court in Texas issued a nationwide preliminary injunction that stayed all filing deadlines, and appeals followed in quick succession. A preliminary injunction is a court order that pauses something while a case is decided; “nationwide” meant it applied to everyone, including people who were not parties to the case. The Supreme Court stayed that injunction in January 2025.

The weeks around that injunction showed the status problem at its sharpest. The Texas order, issued on December 3, 2024 and amended two days later, came less than a month before the main filing deadline. In late December a Fifth Circuit panel lifted it, and FinCEN announced short extensions; days later another panel of the same court restored it. Filers trying to meet a year-end deadline faced reversals within the same week.

The government asked the Supreme Court for a stay on December 31, 2024. The Court granted it on January 23, 2025, with Justice Gorsuch concurring and Justice Jackson dissenting. Even then the requirements stayed paused, because a separate nationwide order from another federal court in Texas remained in force. When that court stayed its own order in February 2025, FinCEN set a new deadline of March 21, 2025.

In March 2025 the Treasury Department said it would not enforce the requirements against U.S. citizens or domestic companies, and FinCEN issued an interim final rule limiting reporting to certain foreign companies registered to do business in the United States. Millions of domestic companies had already filed. Filers and advisers spent much of that period tracking court orders to learn their status, exactly the confusion a dated, plain-language status page is meant to reduce.

The interim final rule, published on March 21, 2025, redefined a reporting company as an entity formed under foreign law and registered to do business in a U.S. state or tribal jurisdiction. Those foreign reporting companies were given 30 days to file, and they were no longer required to report U.S. persons as beneficial owners. A program designed for tens of millions of filers became one aimed at a small fraction of that population.

The narrowing followed a line the program had defined from the start: domestic versus foreign formation. That is the kind of population a well-structured system can identify, unlike the association membership that defined the Alabama order.

In August 2026 FinCEN made the exemption permanent in a final rule and said it would delete information already reported by U.S. persons, which answered the question of what happens to data collected from people no longer required to report. That decision depended on being able to identify which records belonged to which population, which is precisely why tagging records by legal basis matters.

The final rule was announced on August 11, 2026. Foreign reporting companies remained in the program, so it shrank rather than ended. FinCEN’s release did not set out a timetable for the deletion, which leaves the last step, actually removing the data and confirming it is gone, as the part to watch.

Banks were left with a familiar arrangement. The customer due diligence rule that predated the Corporate Transparency Act still required covered financial institutions to collect beneficial ownership information at account opening. For most domestic small businesses, the bank’s form once again became the main place where their owners were recorded. The hoped-for ability to check that form against a federal database largely fell away for them.

The fourth design problem turned out to be the one that decided how the program ended for most filers. For the millions who had filed in good faith, the smoothness of the first filing mattered less in the end. What counted was how clearly they were told their status as it changed, and what became of the personal details they had handed over.

Any large new obligation, public or private, should be launched with its possible narrowing designed in: populations defined cleanly, records labeled by the basis on which they were collected, a single dated statement of who must act, and a retention rule ready for the day the requirement ends. It is inexpensive insurance, and as this program showed, it can be the part that the public remembers.