Shall Be Maintained
The Death of FinCEN's Rule That Isn't in the Rule
On August 11 FinCEN announced that it was permanently ending beneficial ownership reporting for U.S. companies and U.S. persons. Every outlet covered it, most of them within about six hours, and if you read a client alert this week you have already read the story. I am not going to write that post. There is a second thing in the same document, it got about one sentence of coverage, and I think it is the more interesting half.
As part of this announcement, FinCEN issued a final rule (RIN 1506-AB67) making the March 2025 interim rule final. The interim rule had, on an emergency basis, declared that domestic reporting companies are exempted out of 31 CFR 1010.380 entirely, and foreign reporting companies do not need to report U.S.-person beneficial owners. The final rule extends that to U.S.-person company applicants and revises the foreign pooled investment vehicle rule. So, now every entity Congress covered when calling for this rule is out of its scope (the FACT Coalition puts it at 99.98%). At the end of the day, reasonable people disagree about whether this kind of UBO reporting is good policy that undermines money laundering and increases transparency or is a gross imposition on privacy rights and creates unreasonable compliance burdens on small business. That fight has been going on since 2024 and I have nothing new to add to it today.
What piqued my interest was the other thing FinCEN announced: it is going to delete the data it already has.
What the statute says
31 U.S.C. § 5336(c) is titled “Retention and Disclosure of Beneficial Ownership Information by FinCEN.” Paragraph (c)(1) reads, in its entirety:
Beneficial ownership information required under subsection (b) relating to each reporting company shall be maintained by FinCEN for not fewer than 5 years after the date on which the reporting company terminates.
This is a complicated way of saying: once you have it, keep it, and the countdown to deletion does not begin to toll until the company is dead and gone. Critically, this subsection (c) is a duty running against FinCEN. In short, Congress told the agency what to do with the information after it arrived, and it used “shall.”
Why the exemption authority does not get there
FinCEN exempted domestic reporting companies under 31 U.S.C. § 5336(a)(11)(B)(xxiv), the catch-all that lets the Secretary, with the written concurrence of the Attorney General and the Secretary of Homeland Security, exempt: any entity or class of entities . . . from the requirements of subsection (b) on findings that collection “would not serve the public interest” and “would not be highly useful in national security, intelligence, and law enforcement agency efforts.”
Looking sat that specific preposition, the exemption power Congress wrote reaches the reporting duty under subsection (b); it does not, on its face, reach subsection (c), which is where FinCEN’s retention obligation lives. Meaning that an exemption from filing is not a license to destroy what was already filed, and the data sitting in the database today plainly was “required under subsection (b).” It was required when it was filed, by a rule then in force, on pain of penalty. The exemption operates prospectively. Nothing in it reaches back and retroactively unmakes the fact that a founder who filed in February 2024 was legally obligated to do so. The statutory retention command attached to that information when it arrived, and for any entity still in existence the five-year clock has not started running, because the clock runs from termination.
The counterargument is that § 5318(a)(7) lets the Secretary “prescribe an appropriate exemption from a requirement under this subchapter,” and § 5336 sits in that subchapter, but an “exemption from a requirement” is ordinarily something you grant to a regulated party, relieving them of a duty imposed on them. Reading it to let the Secretary exempt Treasury from Treasury’s own statutory obligations seems like a bit much because, on that reading, the Secretary could self-exempt from any command Congress addressed to the agency anywhere in the subchapter, which kind of defeats the point.
Moreover, FinCEN did not make that argument. In fact, the final rule and the press release announcing it mentions none of this.
Looking back through the pre-publication text for “5336(c),” “retention,” “retain,” “maintain,” “5 years,” and “five years” leaves you coming up empty, and the rule that announces the deletion of the database never cites, quotes, discusses, or acknowledges the provision of the statute commanding that the database be maintained.
FinCEN does carefully identify statutory authority for each of the four operative changes: § 5336(a)(11)(B)(xxiv) for the domestic-entity exemption, § 5318(a)(7) for the U.S.-person exemptions and the pooled-vehicle rule, § 5336(b)(4)(A) for the FinCEN ID changes, but for the deletion program it cites nothing at all, relying instead on the jutification that “the values of privacy, information security, and the trust of the public all argue for the removal” of information that would not have been reportable under the new rule. Whether or not you agree with that sentiment is a question of policy; it is not a source of authority, nor is the deletion program a rule. It appears only in the preamble, in Section III.A (“Disposition of BOI in the Database”), written in “anticipates” and “intends.” Nothing about it is codified in 31 CFR 1010.380. There is no regulatory text to comment on, and no authority citation to test.
The operational detail verbatim:
FinCEN anticipates working with the National Archives and Records Administration (NARA) and implementing a process to delete information about any individuals [. . .] in the BO IT System who reported an identifying document that FinCEN reasonably believes was provided by a U.S. person (e.g., U.S. passport, U.S. driver’s license). [. . .] FinCEN does not intend to provide any acknowledgement or confirmation of the deletion of a U.S. company or U.S. person’s BOI. [. . .] To accomplish this deletion efficiently, FinCEN anticipates undertaking the project in one sweep of the database, not as a regular, periodic sweep.
There is no Federal Records Act analysis, no records disposal schedule, no citation to 44 U.S.C. When commenters asked FinCEN to publish its retention schedule and purge methodology, the answer was that doing so would be “inadvisable as well as unnecessary.”
On top of all of this, there is this particular detail: FinCEN says it “expects to rely upon information provided in previously filed BOIRs to identify all domestic reporting companies, company applicants, and beneficial owners associated with domestic reporting companies.” So, the database is the index for erasing the database.
Why “cited no authority” is a legal conclusion and not just a gripe
SEC v. Chenery Corp., 318 U.S. 80, 87 (1943), holds that an agency action can be sustained only on the grounds the agency itself invoked. Accordingly, a reviewing court does not go hunting for a better rationale than the one in the record. If FinCEN’s answer to a § 5336(c)(1) challenge turns out to be § 5318(a)(7), that answer has to appear in the rule, and it does not.
This all adds up to a peculiar posture. Congress wrote a command in the affirmative - S H A L L - and now the agency is acting in a way that appears to run against it, with no cited authority, no acknowledgment of the provision, no regulatory text, and no notice-and-comment on the operative question.
Congress is currently being asked to authorize exactly this
Two bills are pending. H.R. 425, the Repealing Big Brother Overreach Act (Davidson), reported out of House Financial Services in late April 2026 on a 26–25 vote with 193 cosponsors, and a Senate companion from Senators Lee and Kennedy with eight Republican cosponsors. Both of these bills would strike domestic entities from the definition of reporting company, exclude U.S. persons from the definition of beneficial owner, and direct FinCEN to delete previously collected U.S.-person information within 90 days.
If the Secretary already had power to erase the database, the deletion mandates in those bills would be surplusage, and legislators asking for authority is not conclusive evidence that the authority is absent, but it feels like at least pretty good evidence.
Sequencing and the joys of assymetry
On December 16, 2025, a unanimous Eleventh Circuit panel in National Small Business United v. U.S. Department of the Treasury, No. 24-10736 (Jordan, Newsom, and Brasher, JJ., Brasher writing), reversed the Northern District of Alabama and held the CTA constitutional under the Commerce Clause, rejecting the Fourth Amendment challenge as well. It was the first federal appellate merits ruling on the statute. A cert petition is pending, and the government’s response is due August 21 of this year. A second petition out of the Fifth Circuit litigation is also pending, one the government did not even oppose.
So, as it stands, the statute has been held valid, and the Supreme Court is deciding whether to look at it. In the meantime the agency is deleting the statute’s output, in one sweep, with no confirmation to anyone, on no stated authority.
Aside from the deletion itself, everything else in this rule is reversible. A future Treasury can restore domestic reporting by notice-and-comment. FinCEN had roughly 6.5 million reports in hand by November 2024 and considerably more by the time the IFR suspended reporting.
tldr
Keep your BOI file. Whatever you assembled in 2023 and 2024, keep it. It costs nothing to hold, and after the sweep it is the only copy that will exist. Diligence requests are not going to stop asking who owns the company just because FinCEN stopped asking.
Do not treat this as repeal. The CTA is still on the books, held constitutional in the Eleventh Circuit, and narrowed by regulation. Regulations change back. Statutes are harder.
Foreign reporting companies still report. The exemption is for domestic entities and U.S. persons. If you have a foreign-organized entity registered to do business here with non-U.S. beneficial owners, nothing about your obligation went away.
Watch the 180-day line. By the rule’s own terms, U.S.-person information included in a filing made more than 180 days after publication is not getting swept. If you are filing for a foreign entity and inadvertently include U.S.-person data after that date, assume it stays.
I do not know that anyone will litigate this. The people with the clearest injury from deletion are diffuse, and the people with standing to complain about the exemption have mostly gotten what they wanted, but “no one is likely to sue” is a different proposition from “the agency had the power.”
What kind of lawyer would I be without a disclaimer?
Everything I post here constitutes my own thoughts, should only be used for informational purposes, and does not constitute legal advice or establish a client-attorney relationship (though I am happy to discuss if there is something I can help you with). I can be reached via email at dlopezkurtz@crokefairchild.com on telegram @davidlopezkurtz on twitter @lopezkurtz and on LinkedIn).
© 2026 David Lopez-Kurtz. All rights reserved. Permission is granted to quote brief excerpts of this post and to use it for academic, educational, and scholarly purposes, provided the use is properly attributed by crediting David Lopez-Kurtz as author, identifying this publication and the post title, and, where the medium allows, linking to the original. All other rights are reserved, including reproduction of the post in whole or in substantial part, commercial use or republication, and the preparation of derivative works. For any use beyond what is permitted here, or if you are unsure whether your intended use qualifies, please ask; I am generally glad to say yes. No part of this post may be used to train, fine-tune, or ground artificial intelligence or machine learning systems, or for text or data mining, without my express written permission.