How to Advise Clients on BOI Reporting Under the Corporate Transparency Act

The Corporate Transparency Act (CTA), enacted as Division F of the National Defense Authorization Act for Fiscal Year 2021 (Pub. L. 116-283), created the most significant new small-business compliance obligation in decades: beneficial ownership information (BOI) reporting to the Financial Crimes Enforcement Network (FinCEN). The rule targets anonymous shell companies used for money laundering, tax evasion, and sanctions evasion — but in practice it sweeps in millions of ordinary operating businesses. For CPAs, the BOI obligation is not a tax matter, but it lands squarely in the client-advisory role: clients ask their CPA first. This guide covers how to evaluate which clients must file, what information to collect, how to scope your firm's role — and how the material enforcement changes of early 2025 affect the analysis.

Prerequisites

• A complete list of each client's legal entities — LLCs, corporations, LPs, and other registered entities formed or qualified to do business in any U.S. state or Indian tribe
• Formation documents and operating agreements to confirm ownership percentages and governance rights
• Identification documents for all potential beneficial owners: full legal name, date of birth, residential address, and a government-issued photo ID
• Your firm's engagement letter scope: determine before advising whether your firm will prepare and file BOI reports, provide advisory-only guidance, or refer clients to legal counsel

Step 1: Determine Whether the CTA Applies and Understand the Current Enforcement Posture

The Corporate Transparency Act applies to "reporting companies" — entities formed or registered to do business in a U.S. state or Indian tribe by filing a document with a secretary of state or similar office (31 U.S.C. § 5336(a)(11)). This covers LLCs, corporations, limited partnerships, limited liability partnerships, and any other entity created through a state filing.

Enforcement status — verify before advising: The BOI rule faced significant legal turbulence beginning in late 2024. Multiple federal courts issued nationwide injunctions blocking enforcement. In March 2025, Treasury announced it would not enforce BOI requirements against U.S. companies and U.S. persons, and FinCEN issued an interim final rule narrowing the active reporting obligation primarily to foreign reporting companies. This policy shift was significant: as of mid-2025, most U.S. domestic reporting companies were not subject to an active FinCEN enforcement obligation, though the underlying statute remained in force.

The practical implication for CPAs: do not assume that the rule as initially published in 2024 reflects current obligations. Before advising any client on whether to file, deadlines, or penalties, confirm the current enforcement posture and any operative FinCEN guidance at fincen.gov/boi. The analysis that follows reflects the full statutory and regulatory framework — which remains law and may become fully operative again through regulatory reversal, new final rules, or Congressional action.

Step 2: Apply the 23 Exemption Categories

FinCEN's implementing regulations (31 CFR Part 1010) identify 23 categories of exempt entities. Most small-business clients who are not exempt fall into one of three structures that commonly do not meet any exemption. The three exemptions most applicable to CPA clients:

1. Large operating company exemption (31 CFR § 1010.380(c)(2)(xxi)): An entity qualifies if it employs more than 20 full-time employees in the U.S., has an operating presence at a physical office within the U.S., and filed a federal income tax or information return in the prior year showing more than $5 million in gross receipts or sales (net of returns and allowances) from U.S. sources. All three prongs must be met simultaneously. A business with $10M in revenue and eight employees is not exempt. A professional services firm with 30 employees but $3M in revenue is not exempt. Confirm all three independently for each entity evaluated.

2. Subsidiary of exempt entity (31 CFR § 1010.380(c)(2)(xxii)): An entity whose ownership interests are controlled or wholly owned, directly or indirectly, by one or more entities in specified exempt categories. Subsidiaries of large operating companies qualify under this provision, but only when the subsidiary is wholly owned or controlled by the exempt parent — partial ownership does not automatically confer exempt status on the subsidiary.

3. Inactive entity (31 CFR § 1010.380(c)(2)(xxiii)): An entity that (a) existed on or before January 1, 2020; (b) is not engaged in active business; (c) is not owned by a foreign person; (d) has not experienced any ownership change or sent or received funds over $1,000 in the prior 12 months; and (e) holds no assets. A dormant LLC holding real property — even if generating no income — fails prong (e) and does not qualify.

Other exemptions cover banks, credit unions, insurance companies registered with a state insurance commissioner, SEC-registered entities, broker-dealers, public utilities, accounting firms registered with the PCAOB, and pooled investment vehicles. Each carries nuanced eligibility conditions; confirm against the full regulatory text at 31 CFR § 1010.380(c) rather than relying on summaries.

Document the analysis in writing. For each entity, note whether it is exempt, which exemption category applies, and the basis for the conclusion. If not exempt, document why and proceed. This documentation protects the firm if a client later asserts they were not advised — and it satisfies your Circular 230 competence obligations for non-tax advisory services you have undertaken. See the full discussion of advisory scope obligations in the IRS Circular 230 practice ethics guide.

Step 3: Identify Beneficial Owners

Under 31 U.S.C. § 5336(a)(3), a "beneficial owner" is any individual who, directly or indirectly, either:

• Exercises substantial control over the reporting company, or
• Owns or controls at least 25% of ownership interests

Substantial control is the harder prong to apply and the one most likely to produce unexpected results. The regulations (31 CFR § 1010.380(d)(1)) define substantial control as: serving as a senior officer (president, CEO, COO, CFO, general counsel, or equivalent); having authority over the appointment or removal of senior officers or a majority of the board; having authority over major decisions (sale of assets, incurring significant debt, amendment of governing documents); or any other form of substantial control. A minority investor who holds board veto rights on major decisions is a beneficial owner even without 25% equity.

Ownership calculation traps:

• Ownership includes equity, profits interests, convertible instruments, options, and any other mechanism that could result in future ownership
• Attribution applies through trusts, estates, and intermediary entities — do not count only direct legal ownership
• For multi-tier structures, trace ownership through all layers; see below for holding company analysis

Holding company structures: For clients with holding company structures, the beneficial owner analysis multiplies. Each entity in the stack must be independently evaluated for exempt status, and the beneficial owner analysis at each level surfaces the same ultimate individuals repeatedly across different entities. The individual who owns the holding company also indirectly owns and controls each non-exempt subsidiary — making them a beneficial owner of each reporting company in the structure.

Step 4: Collect Required Beneficial Owner Information

For each beneficial owner, and for company applicants in entities formed on or after January 1, 2024, the following information is required under 31 CFR § 1010.380(b)(1):

• Full legal name
• Date of birth
• Current residential address (business address for company applicants)
• Unique identifying number from a non-expired U.S. passport, state driver's license, state ID, or foreign passport
• Image of the identifying document

FinCEN Identifier: Beneficial owners may obtain a personal FinCEN identifier by submitting their information once to FinCEN directly. Thereafter, the identifier can be reported in place of the full information set on any BOI report for any entity. For clients with interests in multiple reporting companies, a FinCEN identifier simplifies every subsequent filing and update — encourage clients with complex ownership structures to obtain one early.

Recordkeeping: Retain copies of identifying documents and the data submitted in the client file. This is a regulatory compliance record, not a tax return work paper, but the same principles apply: retain supporting documentation that would allow reconstruction of the filing if later questioned. For baseline retention periods across different record categories, see Document Retention Requirements for Business Clients; BOI-related records should generally be kept for at least five years following any update or the entity's termination.

Step 5: Understand Reporting Deadlines and Update Obligations

The original FinCEN rule established these filing windows (subject to change — confirm current deadlines at fincen.gov/boi before advising):

• Entities formed before January 1, 2024: Initial report deadline of January 1, 2025
• Entities formed in calendar year 2024: Initial report due 90 days after formation
• Entities formed on or after January 1, 2025: Initial report due 30 days after formation

Update obligations are continuous: When reported information changes — a beneficial owner departs, a new owner is added, an address changes — an updated report must be filed within 30 days of the change. This is not a one-time compliance exercise. For active businesses, it requires a monitoring process: ownership changes, officer appointments or removals, and address changes each independently trigger the update window.

Correction obligation: If a filed report was inaccurate when submitted, a corrected report must be filed within 30 days of discovering the inaccuracy. Inaccuracies discovered during a subsequent review — including by a new CPA onboarding an existing client — trigger this window.

Ownership change note: When adding a new partner or member to an LLC constitutes an ownership change, a BOI update must be filed within 30 days. For the tax analysis that accompanies a new member admission — IRC §721 nonrecognition, capital account setup, and §754 election considerations — see Adding a Partner to an LLC.

Step 6: Scope Your Firm's Role and Engagement Terms

Engagement letter coverage: The CPA's BOI role is not settled. BOI reporting is a federal disclosure filing with a regulatory agency, not a tax return. Most CPA engagement letters drafted before the CTA took effect do not cover BOI. Unless your engagement specifically includes BOI reporting, you have no obligation to prepare or file — but you may have a duty to flag the issue. If you know a client has a reporting company, Circular 230 competence and candor standards support alerting them even if you are not handling the filing.

Unauthorized practice of law considerations: Several state bars have taken the position that advising clients on which individuals qualify as beneficial owners under the substantial control prong — or evaluating complex trust, nominee, or multi-tier ownership arrangements — constitutes legal advice. CPAs should review applicable state bar guidance before offering this analysis as a standalone service, and should consider referral to legal counsel for complex ownership structures.

Practical three-tier model most firms use:

1. Screen all clients with registered entities and flag those with potential reporting obligations in writing
2. Offer BOI report preparation as an add-on service for straightforward structures — single or small number of identified beneficial owners, no complex trust or nominee arrangements, no ambiguous substantial control questions
3. Refer complex structures, legal opinion questions, and multi-tier ownership analysis to outside counsel

Document each client's outcome, including clients who decline services or are referred out.

Common Mistakes

Applying the large operating company exemption on a single prong. The exemption requires all three prongs simultaneously: >20 employees, >$5M gross receipts, and physical U.S. office. A high-revenue business with few employees is not exempt.

Missing the continuous update obligation. Filing an initial report satisfies the one-time obligation; it does not satisfy the ongoing obligation. Ownership changes, officer changes, and address changes each independently restart the 30-day update clock.

Failing to trace through multi-tier structures. A beneficial owner of a holding company is also a beneficial owner of any non-exempt subsidiary in which the holding company provides control or indirect ownership ≥25%. Each entity requires its own filing.

Treating the FinCEN rule as static. The BOI rule has been amended, enjoined, and subject to executive enforcement guidance multiple times. Summaries published in 2023 or early 2024 may describe a regulatory posture that no longer applies. Always confirm at fincen.gov/boi before advising.

Not documenting the exemption analysis for exempt entities. Exempt entities do not file — but the written analysis supporting that conclusion still matters. If enforcement is later activated or a client is acquired and the acquirer's counsel asks for compliance documentation, having a written exemption analysis on file is essential.

FAQ

Who is required to file a BOI report?

Any "reporting company" — an LLC, corporation, LP, LLP, or other entity formed by filing with a state secretary of state or equivalent — unless it qualifies for one of 23 regulatory exemptions under 31 CFR § 1010.380(c). Sole proprietors, general partnerships, and other unregistered entities are not reporting companies. Foreign entities registered to do business in a U.S. state may be reporting companies as well.

Do S-Corps and LLCs file BOI reports?

Entity type alone does not determine filing status — the exemption analysis does. An S-Corp or LLC that does not qualify for an exemption (most commonly the large operating company exemption) is a reporting company. For how BOI obligations interact with entity selection decisions between S-Corp, C-Corp, and LLC structures, see C-Corp vs S-Corp vs LLC: The Complete Entity Selection Guide for CPAs.

Can a CPA file a BOI report on behalf of a client?

Yes — FinCEN's BOI E-Filing System allows third-party filers. A CPA may file on a client's behalf with written client authorization. Whether doing so constitutes the practice of law depends on state bar guidance in the CPA's jurisdiction; confirm before offering this service commercially.

What are the penalties for failure to file?

Under 31 U.S.C. § 5336(h), civil penalties reach $591 per day (2024 indexed figure) for willful violations. Criminal penalties include fines up to $10,000 and imprisonment up to two years. These penalties apply to both the reporting company and any individual who willfully causes the failure — including beneficial owners who refuse to provide required information. Under the interim final rule issued in early 2025, Treasury announced it would not enforce civil or criminal penalties against U.S. persons and domestic reporting companies; confirm the current enforcement position before relying on this non-enforcement posture for compliance planning.

Does the CPA firm itself need to file a BOI report?

CPA firms organized as LLCs or professional corporations are generally not exempt unless they qualify as a large operating company or are registered with the PCAOB (the PCAOB-registered firm exemption covers only firms registered with the Public Company Accounting Oversight Board). Most small and mid-size CPA firm entities should independently evaluate their own reporting obligations — the firm's CPA credential does not confer an exemption.

What's the difference between a beneficial owner and a company applicant?

A beneficial owner is an individual who ultimately owns or controls the company as described in Step 3. A company applicant is the individual who filed or directed the filing of the formation document — relevant only for entities formed on or after January 1, 2024. CPAs who prepare and file formation documents for clients after that date may themselves be company applicants and must provide their own identifying information in the client's BOI report.

How does BOI reporting interact with IRS audit risk?

BOI reports go to FinCEN — a Treasury bureau — not the IRS. FinCEN maintains a nonpublic database accessible to authorized federal agencies, financial institutions with customer due diligence requirements, and foreign governments in limited circumstances. BOI reporting does not directly affect IRS audit selection. However, ownership information disclosed in a BOI report that conflicts with ownership structures shown on tax returns could surface during a coordinated interagency examination. For the broader IRS audit risk landscape — DIF scoring, S-Corp red flags, and Schedule C scrutiny — see IRS Audit Triggers and Defense.

Should CPAs proactively identify BOI obligations for all clients?

Yes — even when not handling the filing. Failing to alert a client to a known compliance obligation exposes both the client (to penalties) and the firm (to malpractice risk). At minimum, include a BOI entity identification step in your onboarding and annual review workflow, document that you raised the issue in writing, and confirm in the engagement record that the client understands their obligations regardless of who handles the filing.

How Arvori Can Help

Arvori helps CPAs manage compliance obligations across their client roster — including entity-level tracking for BOI updates, ownership changes, and deadline management. If you're coordinating BOI compliance for clients with multiple registered entities, learn how Arvori's tools can help.