For newly formed businesses (Startups), the first few years of operations are integral to the company’s success. Founders are concerned with hiring the right employees, developing intellectual property and products or service offerings, fundraising, investor relations, and now, they will also need to be concerned with the compliance requirements of the Corporate Transparency Act (CTA).

Congress passed the CTA in January 2021 to provide law enforcement agencies with further tools to combat financial crime and fraud. The CTA requires certain legal entities (each, a reporting company) to report, if no exemption is available, specific information about themselves, certain of their individual owners and managers (beneficial owners), and certain individuals involved in their formation to the Financial Crimes Enforcement Network (FinCEN) of the U.S. Department of Treasury. The beneficial ownership information (BOI) reporting requirements of the CTA took effect on January 1, 2024. Those who disregard the CTA may be subject to civil and criminal penalties.

As explained in a prior advisory, a Startup formed on or after January 1, 2024 is unlikely to fall into one of the CTA’s twenty-three (23) exemptions from the reporting requirements, so such Startups will need to file a BOI report with FinCEN within ninety (90) days of its formation (or, if formed on or after January 1, 2025, within thirty (30) days of its formation), with updated BOI reports due within thirty (30) days of any change in the Startup’s BOI as reported to FinCEN.

With complex capitalization tables, demanding investors and bespoke management structures, CTA compliance will present some unique challenges to Startups, founders and officers.

Challenges in Disclosure

1. 25% Owners: Nonexempt Startups must disclose information about each individual that (directly or indirectly) holds 25% or more of the fully diluted equity of the Startup. In order to calculate the fully diluted equity of the Startup, a reporting company must consider the total number of shares that would be outstanding if all derivative instruments were exercised. This would include instruments such as stock options, simple agreements for future equity (SAFEs), convertible debt, and warrants. But the initial BOI report is just the beginning, as the set of persons whose details must be disclosed may change each time a derivative security expires, equity interests are sold, additional funds are raised, or the ownership structure of a corporate investor changes. Any such change may trigger an obligation to file an updated BOI report within thirty (30) days.
2. Substantial Control: Nonexempt Startups must also disclose information about any individual that (directly or indirectly) exercises substantial control over the Startup. This includes:
3.  
   1. Senior officers of the reporting company;
   2. Persons who have the authority to appoint or remove certain officers or a majority of the board of directors of the reporting company;
   3. Persons who direct, determine or have “substantial influence” over important decisions of the reporting company, including decisions about its business, finances or structure; and
   4. Persons who otherwise exercise substantial control over the reporting company.

In the case of Startups, this may require the disclosure of information about all members of the board of directors, as the relatively small size of most Startup boards and the broad authority held by their members could bring those individuals within the definition above.

In addition, certain investors (including investors owning less than 25%) may get captured by the “substantial control” definition based upon their voting rights as owners of preferred stock, their negotiated veto rights over important decisions or actions, or other forms of influence over key appointments and decisions of the Startup. The list of individuals who need to be included in the report will vary based upon the governance structure designed and negotiated by investors in the process of formation and fundraising, and each further round of investment or change in management will need to be scrutinized as a potential trigger for an updated report.

Challenges in Reporting

Each beneficial owner (including those who exercise “substantial control”) will need to provide his or her name, date of birth, current address, and photocopy of an acceptable identification document. While this seems like information that would be easy to obtain, Startups will face challenges.

1.  
   1. Structural Challenges: If the direct “beneficial owner” is an entity instead of an individual, the Startup will need to conduct multiple levels of due diligence to determine the ownership structure and exercise of control at the level of that entity-owner. This may involve collecting detailed information about the ownership and management of complex investment funds and ownership vehicles, many of whom may be reluctant to provide details to founders.
   2. Reluctant Investors: Some investors may be hesitant or refuse to provide their details for personal or data privacy reasons. Others may take the position that the Startup’s legal analysis that they qualify as beneficial owners is unsound. There is no good faith exemption for attempting to comply with the BOI reporting requirements. If the Startup fails to comply with the CTA for any reason (including the acts or omissions of an uncooperative investor, director or officer), the Startup will be out of compliance. Those that willfully fail to comply may face civil and criminal penalties.

Tools for Compliance

1.  
   1. Monitoring Triggers for Updates: As Startups continuously raise funds, the ownership structure of the Startup is constantly subject to change, and the resulting update requirements under the CTA are likely to be time-consuming and tedious for founders and investors. To meet this challenge, the Startup will need to have protocols in place to monitor events likely to trigger an update requirement.
   2. Data Protection and Confidentiality: Startups should consider how they will comply with data protection obligations and confidentiality requirements associated with the collection of personally identifiable information gathered pursuant to the CTA. It may be beneficial to designate a third-party provider to collect and store this information or direct persons to obtain a FinCEN identifier to mitigate risks associated with data protection, which can be costly.
   3. Ability to Gather Information for Disclosure: Startups should include language in their formation and governance documents that requires investors, directors and officers to provide information necessary to facilitate CTA compliance as a condition to investing in or serving the Startup. Startups should also disclose the repercussions for investors and senior officers if an investor, director or officer fails to provide required BOI. Existing and potential investors, directors and officers may resist disclosing the necessary information, and the Startup should be prepared to take action to compel such disclosure, where possible, to avoid liability to the company and personal liability to senior officers.

Additional Authors: Gregory M. Wright, Yezi (Amy) Yan, Jordan R. Holzgen