Last week saw a truly seismic change in the Anti Money Laundering landscape. In the USA, FinCen announced that The Corporate Transparency Act no longer applies to US companies or US persons. What began as an interim rule in March 2025 is now permanent: domestic entities are exempt from beneficial ownership reporting, and FinCEN will delete the data US persons already submitted.
Foreign entities registered to do business in the US are a different story. They remain “reporting companies” and they still face Beneficial Ownership Information (BOI) filing deadlines but they also don’t have to disclose any US persons in their ownership chain.
Let’s look at the positives first. For millions of small business owners, this is unambiguous relief. The CTA was administratively brutal for entities it was never really designed to catch — a two-person LLC running a coffee shop was filling out the same beneficial ownership form as a shell company built to launder money. That asymmetry and the overhead cost and hassle that came with it is gone. However, relief for small business is not the same as risk eliminated. It’s worth being precise about what actually changed.
The CTA’s entire premise was that anonymous US shell companies are a preferred vehicle for money laundering, sanctions evasion, and illicit finance — a conclusion Treasury itself has made repeatedly, including in its own National Money Laundering Risk Assessments. Removing the reporting obligation doesn’t get rid of the vehicle but it does mean that we can no longer track what’s happening behind the curtain of ultimate beneficial ownership.
One thing this rule does not touch: bank due diligence obligations.
This is the point I see missed most often in the CTA / compliance conversations. FinCEN’s 2016 Customer Due Diligence rule which details the requirements for banks to collect beneficial ownership information at account opening is a separate regulation from the CTA. It is untouched by this rollback. We are now left with this weird twilight zone where banks still have to ask the question but now have no way of centrally verifying the accuracy of the answer!
To satisfy the regulator, the banks now must depend on a spaghetti of internal KYB tooling, commercial data providers, adverse media and old-fashioned analyst judgment. Missing something or getting it wrong can still attract strictures and fines from the regulator, the lack of the CTA database notwithstanding.
Banks will need to significantly up their spending and resourcing of Due Diligence to ensure that they stay on the right side of the regulator. Perhaps it is an opportunity for them to relook at their Due Diligence technology and upgrade to new-age platforms.
What are the operational implications?
It is not entirely clear where this lands. The regulator may well come up with further guidance and directives on the way forward. Immediately however, some changes can be foreseen.
- On paper, domestic entity onboarding gets faster but I wonder if it really does. With the diligence burden on institutions’ own KYB stack, and disparate information sources being researched, it might actually slow down further!
- Foreign reporting company obligations are now the sharper edge of enforcement focus. Expect more scrutiny where filings do still occur.
- RegTech and KYB vendors that built products assuming a FinCEN BOI cross-check as a data source need a Plan B. That data source is being deleted.
- “The government verified it” was never a strong control. It’s now not even an option. Banks need to rapidly invest in a number of alternative information sources.
Treasury is right that the CTA, as implemented, was disproportionate for the vast majority of small businesses. That criticism was fair. But removing an imperfect transparency mechanism without replacing it with anything is not the same as solving the problem it was built for. The illicit finance risk hasn’t been deregulated. It’s just been handed back to the institutions least equipped to see it centrally — with less credible data, not less exposure.
I believe that this change increases the risk of money laundering and other illicit activities. Which seems to be the exact opposite of what any regulator might desire.
, an independent military force, and allied militias in Sudan raped several dozen women and girls in West Darfur’s capital, El Geneina, and those fleeing to Chad between late April and late June 2023, Human Rights Watch said today. The assailants appear to have targeted people because of their Massalit ethnicity and, in some cases, because they were known activists.){kind=link}