For FinCEN’s beneficial ownership launch, the hardest design problem was shrinking
FinCEN opened beneficial ownership filing on January 1, 2024 to tens of millions of small companies while the law faced constitutional challenge. A public obligation at that scale has four design problems, and the last, how it narrows, is rarely planned.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On January 1, 2024, the Financial Crimes Enforcement Network began accepting beneficial ownership information reports under the Corporate Transparency Act of 2021. The law required many corporations, limited liability companies and similar entities to report the individuals who own or control them, with exemptions for categories such as large operating companies and already regulated entities like banks. Companies existing before 2024 had until January 1, 2025 to file; companies created during 2024 had 90 days from formation. FinCEN launched a free online filing system and a FinCEN identifier that individuals could obtain once and share with companies. In its rulemaking, FinCEN had estimated about 32 million reporting companies in the first year. In December 2023 it finalized rules on access to the data, including by banks for customer due diligence with the customer’s consent. A constitutional challenge to the law, filed in 2022, was pending in federal court in Alabama.
Beneficial ownership reporting was designed to close a gap that let anonymous shell companies move illicit money. To the people who had to comply, it looked different: a new federal filing for owners of small businesses, many of whom had never heard of FinCEN. An earlier article in this series looked at what the registry would and would not change for banks. This one looks at the filing itself as a public service. Any agency imposing a new obligation on millions of people faces four design problems, which follow the life of the obligation from start to end: telling people they must act, taking the filing securely, protecting filers from those who exploit the obligation, and narrowing the program cleanly if its legal footing moves.
Telling people they must act
Most federal reporting regimes reach regulated entities with compliance staff. This one reached single-member LLCs, family holding companies, small landlords and start-ups formed through state processes that said nothing about federal reporting. Penalties for willful failure to file were significant, which made awareness a fairness question as much as an operational one.
The people best placed to tell them were intermediaries: state secretaries of state, which register entities and send annual reminders; accountants and attorneys who advise small businesses; banks, which open business accounts; and registered agent firms. An outreach plan for a program like this sets out, for each intermediary, what message it will carry, at what moment, and what material it needs. A state registry’s formation confirmation is a far better reminder than a press release. FinCEN produced extensive guidance and frequently asked questions during 2024, and the volume of questions showed how unfamiliar the obligation was.
Taking the filing securely
Reports contained names, dates of birth, home addresses and identity document numbers with images, for millions of individuals. The filing system had to accept submissions from people filing once, often without help, without making it easy to file false information or alter another company’s report.
Strong identity proofing reduces fraud and deters legitimate filers; light proofing does the reverse. The FinCEN identifier was a sound design choice. It let an individual who owns several companies submit sensitive details once and be referenced thereafter, which reduces both repeated collection and the number of places the data travels. Agencies designing similar systems should set the identity assurance level per transaction, following NIST’s digital identity guidelines. They should also provide an assisted route for filers who cannot complete online verification, such as a call center able to take corrections.
Corrections deserve as much design attention as first filings. Owners move, sell stakes and renew passports, and each change triggered an update obligation within a set period. A service that makes the first filing easy and updates hard will accumulate stale data quickly, which undermines the purpose of the registry for the law enforcement users it was built for.
Protecting filers from exploitation
A new mandatory filing is an opening for scams. Early in 2024, FinCEN warned of fraudulent letters and emails demanding payment for beneficial ownership filing or directing recipients to fake websites. Filing was free, which made the warning easy to state but hard to land, because recipients did not know what a legitimate notice looked like.
The defense is a published contact policy: how the agency will and will not contact people, a single official web address promoted through every intermediary, and a reporting channel for suspicious contacts. Consumer protection agencies and state attorneys general can amplify the warnings, and intermediaries can repeat them at the moment a client is most likely to be targeted, such as just after forming a company. Private filing services also proliferated, some legitimate and some predatory, and a clear statement that filing directly with the agency costs nothing protects filers from both.
Narrowing the program cleanly
The fourth problem is the one agencies rarely design for. The law had been challenged since 2022, and in March 2024 the federal court in Alabama held it unconstitutional as applied to the plaintiffs, while FinCEN continued to require filing by everyone else. Filers and their advisers then had to follow litigation to know their obligations.
A program on contested ground can be built to narrow without chaos. Its rules can define populations cleanly, so that a court order or policy change affecting one group can be applied without re-deciding everyone else’s status. Its systems can tag records by the legal basis on which they were collected, so that data from a population later exempted can be isolated, restricted or deleted. Its communications can carry a standing page that states, in plain language and with a date, who must file today. And its retention schedule can say what happens to records if the requirement ends. Each of these costs little at launch and a great deal to retrofit. They also protect the agency’s credibility with the public, which it will need for the next obligation it launches.
With hindsight
The litigation reshaped the program. In December 2024 a federal court in Texas issued a nationwide injunction, which the Fifth Circuit stayed and then reinstated within days. The Supreme Court stayed that injunction in January 2025, and after a separate injunction was lifted, FinCEN set new deadlines. In March 2025 the Treasury Department said it would not enforce the requirements against U.S. citizens or domestic companies, and FinCEN issued an interim final rule limiting reporting to certain foreign companies registered to do business in the United States. Millions of domestic companies had already filed. Filers and advisers spent much of that period tracking court orders to learn their status, and the change raised questions about data already collected from companies no longer required to report. The fourth design problem turned out to be the one that decided how the program ended for most filers.