US Treasury drops beneficial ownership reporting rules; will only apply to foreign businesses

In a major policy reversal, the US Treasury Department announced that it will no longer enforce Beneficial Ownership Information (BOI) reporting requirements for domestic companies under the Corporate Transparency Act (CTA). Instead, these rules will now only apply to foreign businesses operating in the US. The decision, which was first announced Sunday night in a post on X, came as the CTA was put into effect again after a federal judge in Texas had reversed a national injunction in February 2025. which aligns with the Trump administration’s stance that the CTA imposes unnecessary burdens on small businesses, has raised concerns about financial transparency and compliance risks.

What is the Corporate Transparency Act?

The Corporate Transparency Act (CTA) was enacted in 2021 as part of a broader effort to prevent money laundering, tax evasion, and the use of anonymous shell companies for illicit financial activities. The law requires certain businesses to report their beneficial owners—the individuals who own or control them—to the Financial Crimes Enforcement Network (FinCEN). This information helps authorities track and prevent financial crimes.

The recent treasury decision

On March 3, 2025, the US Treasury Department, led by Secretary Scott Bessent, announced that it would not enforce penalties for non-compliance with BOI reporting among US citizens and domestic reporting companies. Instead, the Treasury intends to issue a rule limiting the scope of the CTA to foreign reporting companies only.
“This is a victory for common sense,” said US Secretary of the Treasury Scott Bessent in the announcement.  “Today’s action is part of President Trump’s bold agenda to unleash American prosperity by reining in burdensome regulations, in particular for small businesses that are the backbone of the American economy.”
This move effectively suspends one of the core enforcement mechanisms of the CTA for domestic entities, significantly weakening corporate transparency measures that were originally designed to combat financial crimes.

What does this mean for businesses?

While this policy shift removes immediate reporting obligations for many US companies, compliance teams should carefully assess the ongoing risks and regulatory expectations. Here’s what businesses need to consider:

1. There will be less regulation for domestic businesses, but they’re not risk free

Although BOI reporting is no longer required for domestic entities, existing anti-money laundering (AML) laws and Know Your Customer (KYC) obligations still apply. Banks and financial institutions will continue to require beneficial ownership information as part of their due diligence processes. Companies should maintain internal records in case future regulatory shifts reinstate these reporting requirements.

2. Foreign entities are still subject to BOI

Foreign businesses operating in the US are still subject to BOI reporting requirements under the revised CTA enforcement policy. These companies must ensure they have robust compliance frameworks to avoid penalties and regulatory scrutiny from FinCEN.

3. Financial institutions must still conduct due diligence

Even though the US Treasury is no longer enforcing domestic BOI reporting, financial institutions are still expected to conduct thorough due diligence when onboarding clients and monitoring transactions. Compliance teams should remain cautious, as regulatory expectations around AML compliance and suspicious activity reporting (SARs) remain unchanged.

4. The suspension creates diverging standards

This rollback of BOI enforcement in the US creates a disparity between American and international AML regulations. The UK, EU, and other jurisdictions continue to push for greater corporate transparency, meaning multinational companies will need to comply with stricter rules outside the US. Companies operating internationally should align their compliance strategies with these global standards to avoid potential legal conflicts.

What Comes Next?

The decision to suspend domestic BOI enforcement raises questions about the future of financial transparency in the US. While small businesses may welcome the relief from regulatory burdens, compliance professionals warn that relaxed oversight could make it easier for bad actors to exploit loopholes in the financial system.
For now, businesses should remain proactive in compliance efforts, even if enforcement appears lax. Regulatory policies often shift with political changes, and maintaining strong AML practices ensures companies stay ahead of potential compliance risks.

How can VinciWorks help?

While the US Treasury’s decision significantly alters corporate transparency policy, AML and compliance obligations remain as critical as ever. Businesses—particularly those operating across multiple jurisdictions—must stay informed and prepared for potential shifts in enforcement. Investing in compliance training, robust tracking systems, and AML reporting software will help organisations keep up with this evolving regulatory environment.

Learn more

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.