Skip to main content
Commerce Security Authority
Category: Regulations and Standards

Corporate Transparency Act

Also known as: CTA, Corporate Transparency Act of 2021, CTA beneficial ownership reporting
Simply put

The Corporate Transparency Act is a U.S. federal law enacted in 2021 that was designed to increase transparency about who ultimately owns and controls certain business entities. It requires certain business entities, called reporting companies, to file beneficial ownership information with the Financial Crimes Enforcement Network (FinCEN) unless an exemption applies. The scope of who must report and the enforcement posture have changed over time, so readers should confirm current obligations against the latest FinCEN and Treasury guidance rather than assuming a fixed set of requirements.

Formal definition

The Corporate Transparency Act (CTA), enacted in 2021, establishes a beneficial ownership information (BOI) reporting regime administered by FinCEN, under which entities meeting the statutory definition of a 'reporting company' must, absent an exemption, disclose specified beneficial ownership information. Congress noted in the statute that more than 2,000,000 corporations and limited liability companies are formed under State laws each year, motivating the reporting framework as an anti-money-laundering and illicit-finance measure. Enforcement scope and covered-entity definitions have been materially revised through subsequent Treasury and FinCEN action: on March 2, 2025, Treasury announced it would not enforce penalties or fines against U.S. citizens and domestic reporting companies, and FinCEN's subsequent interim final rule narrowed the reporting requirement, removing it for domestic entities and applying it primarily to foreign reporting companies. Because covered-party definitions, deadlines, and enforcement posture have shifted, practitioners should validate current applicability, filing windows, and exemptions against the operative FinCEN rulemaking and Treasury guidance in effect at the time of assessment.

Why it matters

The Corporate Transparency Act represents a significant shift in how the United States approaches beneficial ownership transparency, an area long identified as a vulnerability for money laundering and other illicit finance. In enacting the CTA in 2021, Congress noted that more than 2,000,000 corporations and limited liability companies are formed under State laws each year, and that the absence of consistent beneficial ownership information at formation created opportunities to obscure who ultimately owns and controls business entities. For fraud, anti-money-laundering, and compliance teams, the underlying policy goal is to make it harder to hide behind opaque corporate structures.

What makes the CTA especially important to track is that its covered-party definitions and enforcement posture have changed materially since enactment. On March 2, 2025, the Treasury Department announced that it would not enforce penalties or fines against U.S. citizens and domestic reporting companies under the CTA. FinCEN subsequently issued an interim final rule that narrowed the reporting requirement, removing it for domestic entities and applying it primarily to foreign reporting companies. This means an obligation that once appeared broadly applicable to newly and previously formed domestic entities has been substantially reduced in scope for those entities.

Because of these shifts, any assessment of who must report, by when, and under what exemptions can quickly become out of date. Practitioners who rely on prior guidance risk either over-complying or misjudging current exposure. The prudent posture is to treat the CTA's obligations as a moving target and confirm current applicability against the operative FinCEN rulemaking and Treasury guidance in effect at the time of assessment rather than assuming a fixed set of requirements.

Who it's relevant to

Compliance officers
Compliance teams must determine whether the entities they oversee still fall within the CTA's narrowed scope. Given that domestic entities were removed from the reporting requirement and the rule now applies primarily to foreign reporting companies, compliance officers should confirm current covered-party definitions, exemptions, and filing windows against the latest FinCEN and Treasury guidance before concluding that an obligation applies.
Anti-money-laundering and financial-crime teams
The CTA was framed as an anti-money-laundering and illicit-finance measure intended to increase transparency about who ultimately owns and controls certain business entities. AML teams should understand both the policy intent and the fact that the operative scope has been reduced, so that beneficial ownership assumptions in their own diligence processes are not based on obligations that no longer apply to domestic entities.
Foreign reporting companies and their advisors
Following FinCEN's interim final rule, the reporting requirement applies primarily to foreign reporting companies. Entities in this category, and the legal or compliance advisors supporting them, should confirm current applicability, filing deadlines, and exemptions directly against the operative FinCEN rulemaking, as covered-party definitions and deadlines have shifted over time.
Legal and corporate governance advisors
Advisors counseling businesses on formation and regulatory obligations need to account for the material changes in CTA enforcement and scope, including the March 2, 2025 Treasury announcement suspending penalties and fines for U.S. citizens and domestic reporting companies. They should advise clients based on the guidance in effect at the time of assessment rather than earlier summaries that predate the narrowing of the rule.

Inside CTA

Beneficial Ownership Information (BOI) Reporting
The Corporate Transparency Act (CTA) established a requirement for certain entities, defined as reporting companies, to file beneficial ownership information with the Financial Crimes Enforcement Network (FinCEN). BOI generally identifies the natural persons who own or control a reporting company. The scope of who must report has changed through subsequent rulemaking, so practitioners should confirm current applicability against the latest FinCEN guidance rather than assuming the original scope still applies.
Reporting Company
A category of entity subject to CTA reporting obligations. Following the FinCEN interim final rule issued March 21, 2025, the requirement was removed for domestic (U.S.) reporting companies, and the rule was narrowed to apply to foreign reporting companies. Which entities are currently in scope depends on the applicable rule as amended; readers should verify against current FinCEN publications.
Foreign Reporting Company Obligations
Under the March 21, 2025 interim final rule, foreign entities that qualify as reporting companies generally remained subject to BOI reporting, with a new filing window (generally described as a 30-day window). Exact deadlines and qualifying criteria depend on the specific rule text and any later amendments, which should be confirmed against the current published rule.
Enforcement Posture
A March 2, 2025 Treasury press release indicated that enforcement was suspended with respect to U.S. citizens and domestic reporting companies. This was a targeted enforcement position rather than a wholesale halt of all CTA enforcement. Enforcement scope may change, so practitioners should track FinCEN and Treasury announcements for the current stance.
Relationship to Payment Security and Compliance Programs
The CTA is a U.S. anti-money-laundering-related transparency statute administered by FinCEN and is separate from payment card security standards such as PCI DSS. CTA obligations do not substitute for, and are not governed by, PCI DSS, PCI PIN, PCI P2PE, PCI 3DS, or the PCI Software Security Framework.

Common questions

Answers to the questions practitioners most commonly ask about CTA.

Did FinCEN reinstate beneficial ownership information (BOI) reporting for domestic companies in March 2025?
No. The interim final rule issued by FinCEN on March 21, 2025 did not reinstate BOI reporting for domestic entities; it removed the reporting requirement for domestic (U.S.) reporting companies and narrowed the rule's scope to foreign reporting companies. Descriptions stating that reporting was reinstated for U.S. companies misstate the effect of that rule. Because CTA obligations have shifted through rulemaking and related actions, confirm current requirements against the official FinCEN source rather than relying on a fixed characterization.
Was March 21, 2025 a universal BOI filing deadline for most companies?
No. March 21, 2025 was not a general filing deadline applicable to most companies. Under the interim final rule of that date, domestic entities became exempt from the reporting requirement, while foreign reporting companies were generally addressed under a separate, narrowed framework with their own timing. Treating that date as a blanket deadline for most filers misstates both who is covered and by when. Verify any applicable timeframe against the current FinCEN guidance for the specific entity type in question.
How do I determine whether an entity is currently within the scope of BOI reporting?
Scope determination depends on the entity's classification under the current rule, which narrowed the reporting requirement to foreign reporting companies and exempted domestic (U.S.) reporting companies. Because scope has been modified through interim rulemaking, an entity's obligation should be assessed against the definitions and exemptions in the currently published FinCEN rule and guidance rather than against earlier descriptions. When status is uncertain, confirm directly with the official source or qualified counsel.
What should compliance teams do about earlier BOI filing procedures they had prepared under the original rules?
Compliance teams should re-verify those procedures against the current FinCEN rule before acting, since the requirement was removed for domestic reporting companies and narrowed for foreign entities. Procedures built on the earlier, broader scope may no longer apply to the entities they were designed for. Treat prior workflows as provisional and reconcile them with the current published requirements and any entity-specific timing that FinCEN establishes.
How does the current enforcement posture affect a compliance program's risk assessment?
Enforcement posture has shifted through official actions, including a suspension of enforcement announced for U.S. citizens and domestic reporting companies, and should be treated as subject to change. A risk assessment should reflect the entity's actual classification under the current rule and the enforcement statements applicable to that classification, rather than assuming uniform enforcement across all entity types. Because posture and scope can be updated, periodically reconfirm against the official FinCEN and Treasury communications.
How should a practitioner keep obligations current given the changes to the CTA framework?
Because the CTA framework has changed through interim rulemaking and related enforcement actions, practitioners should monitor the official FinCEN publications and confirm each entity's obligations against the current rule rather than relying on a fixed prior description. Establish a process to check for updates to scope, exemptions, and any applicable timing for the relevant entity type, and document the source and date of the guidance relied upon, since these details depend on the current published standard.

Common misconceptions

FinCEN reinstated BOI reporting for most companies on March 21, 2025.
The interim final rule issued March 21, 2025 removed the reporting requirement for domestic (U.S.) reporting companies and narrowed the rule to foreign reporting companies. It did not reinstate a universal reporting obligation.
There is a single March 21, 2025 filing deadline that applies to most companies.
Domestic entities became exempt under the interim final rule, while foreign reporting companies generally received a new filing window (described as a 30-day window). There is no universal deadline applicable to most companies; obligations and timing vary by entity type and should be confirmed against the current rule.
Treasury halted all CTA enforcement in early 2025.
The March 2, 2025 Treasury press release indicated enforcement was suspended specifically for U.S. citizens and domestic reporting companies. This was a targeted position, not a blanket end to all CTA enforcement.

Best practices

Confirm current CTA applicability for each entity against the latest published FinCEN rule, since the scope changed to exempt domestic reporting companies and narrow the requirement to foreign reporting companies.
For foreign reporting companies, verify the specific filing window and criteria in the current rule text rather than relying on the original CTA deadlines.
Do not assume a universal March 21, 2025 filing deadline applies; determine deadlines based on entity type and the applicable amended rule.
Track FinCEN and Treasury announcements for changes to enforcement posture, recognizing that the March 2, 2025 suspension applied specifically to U.S. citizens and domestic reporting companies.
Treat CTA/BOI obligations as separate from payment card security standards such as PCI DSS, and manage them through appropriate legal and compliance channels rather than folding them into PCI programs.
Document the basis for any determination that an entity is exempt or in scope, and revisit that determination when FinCEN issues further rulemaking or guidance.