BOI reporting is the US requirement, run by FinCEN under the Corporate Transparency Act, for many companies to report the real people who own or control them to a central registry. The goal is to strip the anonymity from shell companies that criminals use to move and hide money.
What is BOI reporting, in plain English?
BOI reporting is about answering one deceptively hard question: who really owns this company? Created under the Corporate Transparency Act and administered by FinCEN, it requires many companies formed or registered in the US to file information about their beneficial owners, the individuals who ultimately own or control the entity, and in some cases the people who created it.
The reports go into a central, non-public registry that FinCEN maintains. It is not a public directory; access is limited to authorized users such as law enforcement and, under conditions, financial institutions. The point is to give investigators a reliable way to pierce the layers of shell entities that have long been used to hide the human beings behind the money.
For a compliance team, the crucial nuance is that this registry supports your own work; it does not replace it. You still run beneficial-ownership due diligence on your customers. The registry is another data point, not a substitute for asking the question yourself.
The registry versus your own CDD
What changes | The BOI registry | Your CDD program |
Who files or collects | The reporting company files with FinCEN. | You collect ownership data from the customer. |
Purpose | A central record for authorized users. | Your own risk decision on the account. |
Access | Restricted and conditional, not open. | Held and used inside your institution. |
Your duty | You cannot simply rely on it. | You must still verify beneficial owners. |
Who is involved?
Who | Their role |
Reporting company | A covered entity that must file its beneficial owners and, where required, company applicants. |
Beneficial owners | The individuals who ultimately own or control the company and whose details must be reported. |
FinCEN | Administers the Corporate Transparency Act and maintains the central BOI registry. |
Financial institutions | May, under conditions and with consent, access registry data to support their own due diligence. |
What it looks like in practice
In practice
An onboarding team is reviewing a new business customer that is a small holding company owned, on paper, by another company. In the past this layered structure would have forced a slow back-and-forth to establish who the humans behind it are.
The analyst still runs full beneficial-ownership due diligence, collecting and verifying the owners directly. The registry data, where accessible, becomes a cross-check: if what the customer discloses does not line up with what has been reported, that mismatch is itself a signal worth escalating. The registry sharpens the review; it does not end it.
Why it matters to operators
Anonymous shell companies are one of the oldest tools in money laundering, and BOI reporting is aimed squarely at that gap. For operators it changes the information landscape: for the first time there is a central place where ownership is supposed to be recorded, which can support investigations and give a reference point when a customer's story does not add up.
The catch is that this is a moving target. Since its rollout, the scope of which companies must report, the exemptions, and who can access the data have shifted more than once. Relying on how the rules worked a year ago is a real risk, so teams need to track the current requirements rather than assume last year's understanding still holds.
Operator notes
- It supports, not replaces. You still owe beneficial-ownership due diligence; the registry is a cross-check, not a shortcut.
- Scope keeps shifting. Which entities must report and which are exempt has changed; verify the current rule, not a prior version.
- Access is conditional. Financial-institution access to registry data comes with consent and use restrictions; treat it carefully.
- Mismatches are signals. A gap between reported owners and what a customer discloses is worth escalating.
- It flows from the CTA. The reporting duty exists because of the Corporate Transparency Act, so track both together.
Quick questions
Is the BOI registry public?
No. It is a non-public registry maintained by FinCEN. Access is limited to authorized users such as law enforcement and, under specific conditions, financial institutions with customer consent.
Does BOI reporting replace my beneficial-ownership CDD?
No. It complements your due diligence but does not replace it. You still have to identify and verify beneficial owners of your customers under your own program.
Who has to file a BOI report?
Many companies formed or registered to do business in the US, subject to a set of exemptions. Because the scope has changed over time, you should confirm the current requirements rather than assume.
What is the relationship between BOI reporting and the CTA?
The Corporate Transparency Act is the statute that created the reporting duty. BOI reporting is the mechanism that carries out the CTA, run by FinCEN.
Can I use registry data instead of asking the customer?
Generally no. Even where you can access it, the registry is a reference and cross-check. Your program still requires you to collect and verify ownership information directly.
Why does the scope keep changing?
The regime has been subject to rulemaking and legal developments that have adjusted who must report and who can see the data. That is why tracking the current state is essential.