UBO Verification in the United States (2026): What the Corporate Transparency Act Reversal Means

Last updated: 27 October 2026 · Reviewed against FinCEN’s final rule of 14 August 2026 (91 FR 52508), 31 CFR 1010.380 and 1010.955, FinCEN’s BOI guidance, the Eleventh Circuit opinion of 16 December 2025, New York Department of State guidance, and the Delaware Division of Corporations’ 2025 statistics and August 2026 fee schedule

The United States is the hardest jurisdiction in the developed world to verify a UBO. In 2025 it got harder. In August 2026 that became permanent.

For five years, the Corporate Transparency Act looked like it would change that. A federal beneficial ownership register, mandatory filings for 32.6 million entities, real penalties. Then in March 2025, the Treasury Department reversed course with an interim rule, and on 14 August 2026 FinCEN made the reversal final. Domestic companies are exempt. US persons are exempt. Only companies formed abroad and registered to do business in the US still file.

State-level company registers have always been thin on ownership data. Delaware, the most-used corporate jurisdiction in the US, doesn't collect it at all for LLCs and never has. Wyoming doesn't either. The federal database that was supposed to fix this is now nearly empty by design — and FinCEN has said it will delete the US-person data it already holds.

This guide cuts through it. What the CTA reversal actually means, who can and can't access FinCEN's database, what state registers will tell you, and how foreign obliged entities verify a US UBO when most US entities have no obligation to disclose one.

The 2025 CTA Reversal: What Actually Changed

The Corporate Transparency Act became law on 1 January 2021, as part of the Anti-Money Laundering Act of 2020, and its reporting rule took effect on 1 January 2024. It required approximately 32.6 million existing US entities, plus 5 million new entities each year, to file beneficial ownership information (BOI) with FinCEN. The data was to be stored in a non-public federal database accessible to law enforcement, regulators, and financial institutions for AML purposes.

It lasted barely 14 months as written.

On 2 March 2025, the Treasury Department announced it would suspend enforcement of CTA penalties against US citizens and domestic reporting companies. On 21 March 2025, FinCEN issued an Interim Final Rule. On 26 March 2025, that rule was published in the Federal Register and took immediate effect. On 11 August 2026 FinCEN adopted it as final, effective on publication on 14 August 2026.

The interim rule made three structural changes, and the final rule kept all three:

1. Redefined "reporting company" to mean only entities formed under the law of a foreign country that have registered to do business in a US state or tribal jurisdiction.
2. Exempted all US-formed entities from BOI reporting requirements. Including entities that had previously filed.
3. Exempted US persons from being reported as beneficial owners — even when they are beneficial owners of foreign reporting companies.

The August 2026 final rule went one step further. Foreign reporting companies no longer report US-person company applicants either, and US persons holding a FinCEN ID no longer have to keep it updated. FinCEN also announced a one-time sweep to delete US-person BOI already in its database; US-person data filed after 10 February 2027 will not be deleted. FinCEN received 118 comment letters on the interim rule: 40 supported it, 28 strongly opposed it.

Who Actually Has to File BOI in 2026

Under the interim rule and now the final rule, the universe of entities required to file BOI with FinCEN shrank from approximately 32.6 million to about 28,000. FinCEN reached that figure from IRS data: roughly 63,000 foreign entities registered to do business in the US at the end of 2025, less those that qualify for an exemption.

Specifically, who must still file:

• Foreign reporting companies — entities formed under the law of a foreign country that have registered to do business in any US state or tribal jurisdiction by filing a document with a secretary of state or similar office.

Who does NOT have to file:

• Any entity formed in the US — corporations, LLCs, LPs, statutory trusts, anything created under US state law. Even if previously classified as a "domestic reporting company".
• US persons — even when they are beneficial owners of foreign reporting companies. Foreign entities filing BOI do not list US-citizen UBOs.
• The 23 categories of exempt entities defined under the CTA — banks, credit unions, broker-dealers, public utilities, large operating companies (more than 20 full-time US employees, more than $5 million in US gross receipts and a physical US office), tax-exempt entities, and others (31 CFR 1010.380(c)).

This means an LLC formed in Delaware by a US citizen has no federal beneficial ownership disclosure obligation. An LLC formed in Delaware by a foreign citizen, who structures the entity domestically, also has no federal disclosure obligation — because the entity itself is US-formed.

Where Foreign Reporting Companies File and What They Report

For the foreign reporting companies still required to file, there is exactly one portal, one form, and a small set of rigid deadlines. Here is exactly how it works.

Where to file at a glance

The summary: most US entities have nowhere to file UBO data, because they don't have to. Only foreign reporting companies file federally, and only LLCs formed outside the US and authorised to do business in New York face a state-level obligation. For everyone else — the vast majority of the US economy — there is no UBO submission process at all.

The filing portal

FinCEN operates the Beneficial Ownership Secure System (BOSS), a web-based portal at boiefiling.fincen.gov. There is no paper alternative. There is no third-party intermediary required. Filing is done directly by the entity or its authorised agent.

• No filing fee. FinCEN does not charge for BOI report submission. Any third party charging a "FinCEN filing fee" is doing so as a service charge, not a government fee.
• No paper forms. Correspondence referencing a "Form 4022" or "Form 5102" is fraudulent, as FinCEN warns on its BOI page. FinCEN does not have a Form 4022 or Form 5102, and BOI is never sent by mail.
• Login.gov authentication. Filers create a Login.gov account, then access BOSS to submit reports.

What goes into a BOI report

Each foreign reporting company must report three categories of information.

A "beneficial owner" remains any individual who, directly or indirectly, either (a) owns or controls 25% or more of the entity's ownership interests, or (b) exercises substantial control over the entity. The 25% threshold and the substantial control test both apply — an individual meeting either qualifies. Critically, US persons meeting either test are no longer reported.

Filing deadlines

Different deadlines apply depending on when the foreign entity registered to do business in the US.

The 30-day window is strict and applies to every type of change — new beneficial owners, changed addresses, ownership percentage adjustments, changes in identification documents, even renamed entities.

Penalties for non-compliance

Failure to comply by foreign reporting companies attracts both civil and criminal penalties. The exemptions removed domestic entities and US persons from liability altogether; the final rule confirms that the penalty provisions continue to apply to foreign reporting companies and foreign persons.

Penalties apply to:

• Wilful failure to report complete or updated BOI
• Wilful provision of false or fraudulent BOI
• Unauthorized disclosure or use of BOI by recipients (separate penalty regime)

Officers, directors, and beneficial owners can be held personally liable for the entity's failures to comply. There is a safe harbour: a reporting company that files a corrected report within 30 days of learning of an inaccuracy, and no later than 90 calendar days after the inaccurate report was filed, is treated as having corrected it in time.

Who Can Access the BOI Database — and How

FinCEN stores BOI in a non-public database with strict access controls. Disclosure is limited to six categories of authorised recipients under the Beneficial Ownership Information Access and Safeguards Final Rule, in effect since 20 February 2024.

The full six-category access list

1. US federal agencies engaged in national security, intelligence, or law enforcement activity
2. State, local, and tribal law enforcement agencies with court authorization
3. Foreign law enforcement, judges, prosecutors, central authorities via a US federal intermediary, under treaty or formal request
4. Financial institutions with customer due diligence requirements under applicable law, with the reporting company's written consent
5. Federal functional regulators supervising those financial institutions for CDD compliance
6. US Department of the Treasury officers and employees for tax administration or BOI inspection

What's deliberately missing

This is the critical contrast with EU regimes, and the structural reason the US is uniquely opaque for commercial KYC:

• No public access at all. Unlike the post-2022 EU UBO regime, the US BOI database has never had any public-facing search interface. There never has been one and the CTA does not authorise one.
• No journalist or NGO access. No "legitimate interest" tier exists. The US framework explicitly omits this category.
• No general commercial use. Financial institutions cannot query BOI for credit decisions, pricing, or general business purposes. Use is limited to AML/CFT compliance.
• No bulk queries. Even authorised financial institutions get one transcript per request, per reporting company customer, with that customer's consent. There is no bulk download, no API for general use, no aggregator licensing.
• Geographic restrictions. A financial institution that receives BOI may not make it available to anyone physically located in, or store it in, China, Russia, a state sponsor of terrorism or a jurisdiction under comprehensive US sanctions (31 CFR 1010.955).
• Foreign obliged entities have no direct route. A non-US bank, asset manager, or compliance team has no direct access to FinCEN BOI. Indirect access exists only via foreign government request through MLAT or treaty-based mechanisms.

How financial institutions actually access BOI in practice

Even for authorised US financial institutions, the access workflow is highly constrained:

1. The financial institution obtains the reporting company customer's written consent to query FinCEN. Consent is documented and kept for five years after it is last relied upon.
2. The institution certifies its purpose and the documented consent to FinCEN and queries FinCEN's beneficial ownership IT system for that specific reporting company.
3. FinCEN returns a single electronic transcript containing that reporting company's current BOI — and, since 2025, never the details of a US-person owner, because those are no longer reported.
4. The institution uses the transcript solely for the customer due diligence purpose authorised under applicable law. Re-disclosure is prohibited except to specific regulators.
5. Each query is logged and may be audited by FinCEN. Misuse triggers separate civil and criminal penalties under the Access Rule.

State-level beneficial ownership filings

With the federal CTA narrowed, states have debated filling the gap with their own BOI regimes. New York is the one that has a law in force.

The NYLTA is the first US state-level UBO register, and it mirrors the federal narrowing almost exactly. Filing runs through the Department of State’s secure filing system, but the data is not public: it is exempt from New York’s Freedom of Information Law and released only to government agencies, by court order, for law enforcement or with the beneficial owner’s consent (Department of State FAQ). Non-filers are shown as “past due” in the public entity database and face fines of up to $500 a day from the Attorney General — the one piece of the regime a verifier can see.

The State Registry Reality

Without a federal UBO register that's accessible to foreign obliged entities, the alternative is state-level company registers. Each US state operates its own. The data quality varies wildly. Most are useless for UBO verification.

The hard reality: the most-used corporate jurisdictions in the US are designed to protect ownership privacy.

Even where states do collect officer or manager data, this is rarely the same as beneficial ownership. A Delaware corporation must list its directors and at least one officer in the annual franchise tax report — a plain copy costs $10 for the first page — but directors are not necessarily owners. A California Statement of Information lists managers — but the manager of an LLC is often a registered agent or a different LLC, not the natural-person UBO.

Delaware: The Default Black Box

Delaware deserves specific treatment because it's where most US business actually lives. 2,287,728 entities at the end of 2025, 1,653,329 of them LLCs. Over two-thirds of the Fortune 500. Nearly 70% of US-based IPOs in 2025. And 334,461 new formations in 2025 alone, more than 15% up on 2024 (Division of Corporations statistics). Our Delaware LLC guide covers the state in depth.

Delaware does not collect ownership information for LLCs and never has. The state does not even require a member's or manager's name to be filed at formation. The registered agent is the only person publicly associated with most Delaware LLCs. For corporations, the annual franchise report (filed by 1 March each year) lists directors and one officer — but shareholders are never disclosed at the state level.

Available Delaware records:

• Free — basic entity search (name, file number, formation date, registered agent and its address, residency)
• $10 — plain copy of a filed document or a corporate annual report, plus $2 per additional page
• $50 — short-form good standing certificate; record search per entity; certified copy of a filing (plus $2 per page)
• $175 — long-form good standing certificate (domestic entities only)

Those are the fees in the schedule revised on 1 August 2026. None of them buys ownership data for an LLC. The Delaware Division of Corporations does not offer a public API or bulk data download.

How Foreign Obliged Entities Actually Verify US UBOs

For a non-US bank, asset manager, or compliance team verifying a US counterparty in 2026, the practical path looks nothing like what works in the EU.

1. The federal BOI database is closed to you. Foreign obliged entities have no direct access to FinCEN.
2. State registers won't get you to the UBO. They confirm the entity exists. They might give you directors. They will not give you owners.
3. The CTA reversal means even the foreign reporting company route is narrow. A US-formed LLC owned by foreign nationals does not file. Only entities formed abroad and registered in the US do, and they leave out any US-person owner.
4. You're left with self-disclosure and indirect evidence. Subscription agreements, articles of association from the parent jurisdiction, court filings, news media, leaked datasets like the ICIJ database, and direct attestations from the entity itself.

This is the hard truth: for most US entities, the UBO verification path is not "check the registry" — it's "build the case from indirect sources and require the entity to disclose."

The pattern shown: when the US entity itself has no disclosable owner, the chain often resolves through a foreign parent in a jurisdiction that does require UBO disclosure (UK PSC, EU UBO registers, Cayman BO regime). The natural-person UBO is identified at the parent level, not the US level.

A Practical Workflow for US UBO Verification

Here is the realistic sequence for verifying a UBO on a US-formed entity from outside the US.

Step 1: Confirm the entity's state of formation

Search the state Secretary of State's database (Zavia's US company directory lists US companies by state). Confirm the entity name, file number, formation date, registered agent, and status. Note the entity type — LLC, corporation, LP, statutory trust. The state of formation determines what records exist.

Step 2: Pull whatever ownership-adjacent data the state offers

For corporations, pull the annual franchise report or equivalent — this lists directors and (sometimes) one officer. For LLCs in California, Texas, or Nevada, pull the Statement of Information or annual list — this shows managers. None of this is the UBO, but it's the floor.

Step 3: Determine if the entity is a foreign reporting company

Check whether the entity was formed under foreign law and merely registered to do business in the US. If yes, the entity may have filed BOI with FinCEN — but you cannot access that filing directly. If no, the entity is exempt from federal BOI reporting.

Step 4: Look upstream for a parent in a transparent jurisdiction

Many institutional structures have non-US parents. UK Companies House (PSC Register), EU member-state UBO registers (legitimate-interest access since the CJEU's November 2022 WM and Sovim ruling), the Cayman Islands BO regime (regulated access only) — all may disclose the UBO that the US entity cannot.

Step 5: Request direct disclosure from the entity

The entity itself will know its UBO. Standard onboarding includes a UBO declaration with supporting documents (corporate ownership chart, share register from the parent, certified copies of articles). Treat self-disclosure as the primary source for US-formed entities. Cross-reference with whatever indirect evidence is available.

Step 6: Apply Enhanced Due Diligence by default

The absence of a federal UBO register is itself a risk factor. FATF flagged the US for weak beneficial ownership transparency in its December 2016 mutual evaluation (our explainer on Recommendations 24 and 25 sets out the standard), and the fifth-round assessment takes place in 2026. Where the verification trail relies entirely on self-disclosure, EDD is the prudent default — independent verification of the declared UBO's identity, sanctions screening, PEP screening, adverse media.

Step 7: Screen the identified UBOs

OFAC SDN list, EU sanctions, UN sanctions, and any jurisdiction-specific lists. Adverse media screening in multiple languages. Source-of-wealth review for high-risk relationships.

What Could Still Change in 2027 and Beyond

The federal rulemaking is finished, but the US position is still not fixed. Four forces could shift it:

For obliged entities outside the US, the planning assumption for the next 18 months should be: the US is a UBO data desert and will remain one. Build verification workflows that don't depend on US registries, and treat any future federal disclosure as upside.

Common Failure Points in US UBO Verification

Where teams typically get this wrong:

• Treating Delaware as a normal company register. It isn't. The state doesn't collect ownership data for LLCs. A "company search" in Delaware confirms an entity exists. It does not verify who owns it.
• Assuming FinCEN BOI is accessible. The database exists but is not available to foreign obliged entities, journalists, or commercial users. Even US banks can only query specific reporting-company customers with consent.
• Confusing directors/officers with beneficial owners. A Delaware corporation's annual report lists directors. Directors are not necessarily UBOs. A 10% shareholder controlling the board is the UBO; the directors may not own anything.
• Missing the foreign reporting company carve-out. If the entity was formed abroad and registered in the US, it may have filed BOI — but that filing is not accessible to foreign third parties.
• Relying on outdated guidance. Pre-March 2025 articles and vendor materials describe the original CTA scope, and FinCEN's own BOI page warns that some information on its website may be outdated. The interim rule changed everything for domestic entities; the August 2026 final rule made it permanent.
• Skipping Enhanced Due Diligence. The lack of a federal UBO register is itself a risk factor. EDD should be the default for US-formed entities until the position changes.

The US does not fail because the data is hidden. It fails because, for most entities, the data was never collected. Build the chain from the outside in: confirm the entity at state level, find the first parent in a jurisdiction that records owners, and screen the person at the top. Zavia connects directly to government ownership registries in 173 countries, which is how a Delaware LLC with a UK or Cayman parent can still resolve to a named person — verify a US UBO in one lookup through the API. For the wider method, see how to find out who owns a business.