UBO Verification in the United States (2026): What the Corporate Transparency Act Reversal Means

The United States is the hardest jurisdiction in the developed world to verify a UBO. And in 2025 it got harder.

For five years, the Corporate Transparency Act looked like it would change that. A federal beneficial ownership register, mandatory filings for 32.6 million entities, real penalties. Then in March 2025, the Treasury Department reversed course. Domestic companies are now exempt. US persons are exempt. Only foreign entities registered to do business in the US still file.

State-level company registers have always been thin on ownership data. Delaware, the most-used corporate jurisdiction in the US, doesn't collect it at all for LLCs and never has. Wyoming and Nevada are the same. The federal database that was supposed to fix this is now nearly empty by design.

This guide cuts through it. What the CTA reversal actually means, who can and can't access FinCEN's database, what state registers will tell you, and how foreign obliged entities verify a US UBO when most US entities have no obligation to disclose one.

The 2025 CTA Reversal: What Actually Changed

The Corporate Transparency Act passed Congress in 2021 and took effect on 1 January 2024. It required approximately 32.6 million existing US entities, plus 5 million new entities each year, to file beneficial ownership information (BOI) with FinCEN. The data was to be stored in a non-public federal database accessible to law enforcement, regulators, and financial institutions for AML purposes.

It lasted barely 14 months as written.

On 2 March 2025, the Treasury Department announced it would suspend enforcement of CTA penalties against US citizens and domestic reporting companies. On 21 March 2025, FinCEN issued an Interim Final Rule. On 26 March 2025, that rule was published in the Federal Register and took immediate effect.

The rule made three structural changes:

1. Redefined "reporting company" to mean only entities formed under the law of a foreign country that have registered to do business in a US state or tribal jurisdiction.
2. Exempted all US-formed entities from BOI reporting requirements. Including entities that had previously filed.
3. Exempted US persons from being reported as beneficial owners — even when they are beneficial owners of foreign reporting companies.

Who Actually Has to File BOI in 2026

Under the Interim Final Rule, the universe of entities required to file BOI with FinCEN shrank from approximately 32.6 million to roughly 12,000.

Specifically, who must still file:

• Foreign reporting companies — entities formed under the law of a foreign country that have registered to do business in any US state or tribal jurisdiction by filing a document with a secretary of state or similar office.

Who does NOT have to file:

• Any entity formed in the US — corporations, LLCs, LPs, statutory trusts, anything created under US state law. Even if previously classified as a "domestic reporting company".
• US persons — even when they are beneficial owners of foreign reporting companies. Foreign entities filing BOI do not list US-citizen UBOs.
• The 23 categories of exempt entities defined under the CTA — banks, credit unions, broker-dealers, public utilities, large operating companies (over 20 employees and $5M revenue), tax-exempt entities, and others.

This means an LLC formed in Delaware by a US citizen has no federal beneficial ownership disclosure obligation. An LLC formed in Delaware by a foreign citizen, who structures the entity domestically, also has no federal disclosure obligation — because the entity itself is US-formed.

Where Foreign Reporting Companies File and What They Report

For the foreign reporting companies still required to file, there is exactly one portal, one form, and a small set of rigid deadlines. Here is exactly how it works.

Where to file at a glance

The summary: most US entities have nowhere to file UBO data, because they don't have to. Only foreign reporting companies file federally, and only foreign LLCs registered in New York face a state-level obligation. For everyone else — the vast majority of the US economy — there is no UBO submission process at all.

The filing portal

FinCEN operates the Beneficial Ownership Secure System (BOSS), a web-based portal at boiefiling.fincen.gov. There is no paper alternative. There is no third-party intermediary required. Filing is done directly by the entity or its authorised agent.

• No filing fee. FinCEN does not charge for BOI report submission. Any third party charging a "FinCEN filing fee" is doing so as a service charge, not a government fee.
• No paper forms. Correspondence referencing a "Form 4022" or "Form 5102" is fraudulent. FinCEN does not have a Form 4022 or Form 5102, and BOI is never sent by mail.
• Login.gov authentication. Filers create a Login.gov account, then access BOSS to submit reports.

What goes into a BOI report

Each foreign reporting company must report three categories of information.

A "beneficial owner" remains any individual who, directly or indirectly, either (a) owns or controls 25% or more of the entity's ownership interests, or (b) exercises substantial control over the entity. The 25% threshold and the substantial control test both apply — an individual meeting either qualifies. Critically, US persons meeting either test are no longer reported.

Filing deadlines

Different deadlines apply depending on when the foreign entity registered to do business in the US.

The 30-day window is strict and applies to every type of change — new beneficial owners, changed addresses, ownership percentage adjustments, changes in identification documents, even renamed entities.

Penalties for non-compliance

Failure to comply by foreign reporting companies attracts both civil and criminal penalties. The Treasury Department has stated it will not enforce penalties against US citizens or domestic entities, but the penalty framework remains fully in force for foreign reporting companies.

Penalties apply to:

• Wilful failure to report complete or updated BOI
• Wilful provision of false or fraudulent BOI
• Unauthorized disclosure or use of BOI by recipients (separate penalty regime)

Officers, directors, and beneficial owners can be held personally liable for the entity's failures to comply. There is a safe harbour: a person who reports inaccurate information and corrects it within 90 days of the original deadline may avoid penalty if the original report was made in good faith.

Who Can Access the BOI Database — and How

FinCEN stores BOI in a non-public database with strict access controls. Disclosure is limited to six categories of authorised recipients under the Beneficial Ownership Information Access and Safeguards Final Rule, in effect since 20 February 2024.

The full six-category access list

1. US federal agencies engaged in national security, intelligence, or law enforcement activity
2. State, local, and tribal law enforcement agencies with court authorization
3. Foreign law enforcement, judges, prosecutors, central authorities via a US federal intermediary, under treaty or formal request
4. Financial institutions with customer due diligence requirements under applicable law, with the reporting company's written consent
5. Federal functional regulators supervising those financial institutions for CDD compliance
6. US Department of the Treasury officers and employees for tax administration or BOI inspection

What's deliberately missing

This is the critical contrast with EU regimes, and the structural reason the US is uniquely opaque for commercial KYC:

• No public access at all. Unlike the post-2022 EU UBO regime, the US BOI database has never had any public-facing search interface. There never has been one and the CTA does not authorise one.
• No journalist or NGO access. No "legitimate interest" tier exists. The US framework explicitly omits this category.
• No general commercial use. Financial institutions cannot query BOI for credit decisions, pricing, or general business purposes. Use is limited to AML/CFT compliance.
• No bulk queries. Even authorised financial institutions get one transcript per request, per reporting company customer, with that customer's consent. There is no bulk download, no API for general use, no aggregator licensing.
• Geographic restrictions. FinCEN cannot share BOI with persons in China, Russia, or any country designated as a state sponsor of terrorism.
• Foreign obliged entities have no direct route. A non-US bank, asset manager, or compliance team has no direct access to FinCEN BOI. Indirect access exists only via foreign government request through MLAT or treaty-based mechanisms.

How financial institutions actually access BOI in practice

Even for authorised US financial institutions, the access workflow is highly constrained:

1. The financial institution obtains the reporting company customer's written consent to query FinCEN. Consent is documented and retained for five years.
2. The institution submits a query to BOSS identifying the specific reporting company (typically by legal name and TIN).
3. FinCEN returns a single electronic transcript containing that reporting company's current BOI — no historical data, no related entities.
4. The institution uses the transcript solely for the customer due diligence purpose authorised under applicable law. Re-disclosure is prohibited except to specific regulators.
5. Each query is logged and may be audited by FinCEN. Misuse triggers separate civil and criminal penalties under the Access Rule.

State-level beneficial ownership filings

With the federal CTA narrowed, several US states have moved to fill the gap with their own BOI regimes. The most significant is New York.

The NYLTA is the first US state-level UBO register and is currently limited to foreign LLCs. Information filed is not yet available through a public-facing portal — New York has not established the database as of early 2026. Watch this space: state-level UBO regimes are expected to expand through 2026 and 2027 as a response to the federal CTA narrowing.

The State Registry Reality

Without a federal UBO register that's accessible to foreign obliged entities, the alternative is state-level company registers. Each US state operates its own. The data quality varies wildly. Most are useless for UBO verification.

The hard reality: the most-used corporate jurisdictions in the US are designed to protect ownership privacy.

Even where states do collect officer or manager data, this is rarely the same as beneficial ownership. A Delaware corporation must list directors and one officer in the annual franchise report — that's available for $20 — but directors are not necessarily owners. A California Statement of Information lists managers — but the manager of an LLC is often a registered agent or a different LLC, not the natural-person UBO.

Delaware: The Default Black Box

Delaware deserves specific treatment because it's where most US business actually lives. 2.1 million active entities. 66.7% of Fortune 500 companies. 81.4% of US-based IPOs in 2024.

Delaware does not collect ownership information for LLCs and never has. The state does not even require a member's or manager's name to be filed at formation. The registered agent is the only person publicly associated with most Delaware LLCs. For corporations, the annual franchise report (filed by 1 March each year) lists directors and one officer — but shareholders are never disclosed at the state level.

Available Delaware records:

• Free — basic entity search (name, file number, formation date, registered agent county)
• $10 — entity status confirmation
• $20 — current franchise tax assessment, certificate of formation, or annual franchise report (corporations only)
• $50 — certified copies of any filing, short-form good standing certificate
• $175 — long-form good standing certificate (domestic entities only)

None of this includes ownership data for LLCs. The Delaware Division of Corporations does not offer a public API or bulk data download.

How Foreign Obliged Entities Actually Verify US UBOs

For a non-US bank, asset manager, or compliance team verifying a US counterparty in 2026, the practical path looks nothing like what works in the EU.

1. The federal BOI database is closed to you. Foreign obliged entities have no direct access to FinCEN.
2. State registers won't get you to the UBO. They confirm the entity exists. They might give you directors. They will not give you owners.
3. The CTA reversal means even the foreign reporting company route is narrow. A US-formed LLC owned by foreign nationals does not file. Only entities formed abroad and registered in the US do.
4. You're left with self-disclosure and indirect evidence. Subscription agreements, articles of association from the parent jurisdiction, court filings, news media, leaked datasets like the ICIJ database, and direct attestations from the entity itself.

This is the hard truth: for most US entities, the UBO verification path is not "check the registry" — it's "build the case from indirect sources and require the entity to disclose."

The pattern shown: when the US entity itself has no disclosable owner, the chain often resolves through a foreign parent in a jurisdiction that does require UBO disclosure (UK PSC, EU UBO registers, Cayman BO regime). The natural-person UBO is identified at the parent level, not the US level.

A Practical Workflow for US UBO Verification

Here is the realistic sequence for verifying a UBO on a US-formed entity from outside the US.

Step 1: Confirm the entity's state of formation

Search the state Secretary of State's database. Confirm the entity name, file number, formation date, registered agent, and status. Note the entity type — LLC, corporation, LP, statutory trust. The state of formation determines what records exist.

Step 2: Pull whatever ownership-adjacent data the state offers

For corporations, pull the annual franchise report or equivalent — this lists directors and (sometimes) one officer. For LLCs in California, Texas, or Nevada, pull the Statement of Information or annual list — this shows managers. None of this is the UBO, but it's the floor.

Step 3: Determine if the entity is a foreign reporting company

Check whether the entity was formed under foreign law and merely registered to do business in the US. If yes, the entity may have filed BOI with FinCEN — but you cannot access that filing directly. If no, the entity is exempt from federal BOI reporting.

Step 4: Look upstream for a parent in a transparent jurisdiction

Most institutional structures have non-US parents. UK Companies House (PSC Register), EU UBO registers (post-AMLD6), Cayman BO Regime (regulated access only) — all may disclose the UBO that the US entity cannot.

Step 5: Request direct disclosure from the entity

The entity itself will know its UBO. Standard onboarding includes a UBO declaration with supporting documents (corporate ownership chart, share register from the parent, certified copies of articles). Treat self-disclosure as the primary source for US-formed entities. Cross-reference with whatever indirect evidence is available.

Step 6: Apply Enhanced Due Diligence by default

The absence of a federal UBO register is itself a risk factor. FATF flagged the US for weak beneficial ownership transparency in its 2016 mutual evaluation. Where the verification trail relies entirely on self-disclosure, EDD is the prudent default — independent verification of the declared UBO's identity, sanctions screening, PEP screening, adverse media.

Step 7: Screen the identified UBOs

OFAC SDN list, EU sanctions, UN sanctions, and any jurisdiction-specific lists. Adverse media screening in multiple languages. Source-of-wealth review for high-risk relationships.

What Could Change in 2026 and Beyond

The US position on beneficial ownership is unstable. Three forces could shift it in 2026 or 2027:

For obliged entities outside the US, the planning assumption for the next 18 months should be: the US is a UBO data desert and will remain one. Build verification workflows that don't depend on US registries, and treat any future federal disclosure as upside.

Common Failure Points in US UBO Verification

Where teams typically get this wrong:

• Treating Delaware as a normal company register. It isn't. The state doesn't collect ownership data for LLCs. A "company search" in Delaware confirms an entity exists. It does not verify who owns it.
• Assuming FinCEN BOI is accessible. The database exists but is not available to foreign obliged entities, journalists, or commercial users. Even US banks can only query specific reporting-company customers with consent.
• Confusing directors/officers with beneficial owners. A Delaware corporation's annual report lists directors. Directors are not necessarily UBOs. A 10% shareholder controlling the board is the UBO; the directors may not own anything.
• Missing the foreign reporting company carve-out. If the entity was formed abroad and registered in the US, it may have filed BOI — but that filing is not accessible to foreign third parties.
• Relying on outdated guidance. Pre-March 2025 articles, vendor materials, and even FinCEN's own FAQs (still being updated) describe the original CTA scope. The Interim Final Rule changed everything for domestic entities.
• Skipping Enhanced Due Diligence. The lack of a federal UBO register is itself a risk factor. EDD should be the default for US-formed entities until the position changes.