Fifth Circuit Court of Appeals Vacates Its Own Stay Rendering the Corporate Transparency Act Unenforceable . . . Again

On December 26, 2024, in Texas Top Cop Shop, Inc. v. Garland, No. 24-40792, 2024 WL 5224138 (5th Cir. Dec. 26, 2024), a merits panel of the United States Court of Appeals for the Fifth Circuit issued an order vacating the Court’s own stay of the preliminary injunction enjoining enforcement of the Corporate Transparency Act (“CTA”), that was originally entered by the United States District Court for the Eastern District of Texas on December 3, 2024, No. 4:24-CV-478, 2024 WL 5049220 (E.D. Tex. Dec 5, 2024).

A Timeline of Events:

  • December 3, 2024 – The District Court orders a nationwide preliminary injunction on enforcement of the CTA.
  • December 5, 2024 – The Government appeals the District Court’s ruling to the Fifth Circuit.
  • December 6, 2024 – The U.S. Treasury Department’s Financial Crimes Enforcement Network (“FinCEN”) issues a statement making filing of beneficial ownership information reports (“BOIRs”) voluntary.
  • December 23, 2024 – A motions panel of the Fifth Circuit grants the Government’s emergency motion for a stay pending appeal and FinCEN issues a statement requiring filing of BOIRs again with extended deadlines.
  • December 26, 2024 – A merits panel of the Fifth Circuit vacates its own stay, thereby enjoining enforcement of the CTA.
  • December 27, 2024 – FinCEN issues a statement again making filing of BOIRs voluntary.
  • December 31, 2024 – FinCEN files an application for a stay of the December 3, 2024 injunction with the Supreme Court of the United States.

This most recent order from the Fifth Circuit has effectively paused the requirement to file BOIRs under the CTA once again. In its most recent statement, FinCEN confirmed that “[i]n light of a recent federal court order, reporting companies are not currently required to file beneficial ownership information with FinCEN and are not subject to liability if they fail to do so while the order remains in force. However, reporting companies may continue to voluntarily submit beneficial ownership information reports.”

Although reporting requirements are not currently being enforced, we note that this litigation is ongoing, and if the Supreme Court decides to grant FinCEN’s December 31, 2024 application, reporting companies could once again be required to file. Given the high degree of unpredictability, reporting companies and others affected by the CTA should continue to monitor the situation closely and be prepared to file BOIRs with FinCEN in the event that enforcement is again resumed. If enforcement is resumed, the current reporting deadline for most reporting companies will be January 13, 2025, and while FinCEN may again adjust deadlines, this outcome is not assured.

For more information on the CTA and reporting requirements generally, please reference the linked Client Alert, dated November 24, 2024.

Client Alert Update: Developments in the Corporate Transparency Act Injunction

As we previously reported, a nationwide preliminary injunction against enforcement of the Corporate Transparency Act (CTA) was issued on December 3, 2024. Since our last update, there have been significant developments:

  1. Fifth Circuit Stay and Revival of CTA Enforcement: On December 23, 2024, a three-judge panel of the United States Court of Appeals for the Fifth Circuit stayed the lower court’s preliminary injunction, temporarily reviving the immediate enforceability of the CTA.
  2. Extension of Filing Deadline: Following the Fifth Circuit’s stay, FinCEN announced an extension of the filing deadline for Beneficial Ownership Information Reports (BOIRs) to January 13, 2025, applicable to entities formed before January 1, 2024.
  3. Injunction Reinstated: On December 26, 2024, the Fifth Circuit vacated the three-judge panel’s decision to stay the preliminary injunction. As a result, enforcement of the CTA is once again enjoined, and reporting companies are not currently required to file BOIRs with FinCEN.

Litigation challenging the CTA continues, and further developments are likely as the legal landscape evolves. At this time, we reaffirm our prior guidance:

  • Reporting companies are not currently required to file BOIRs while the injunction remains in effect and will not face penalties for failing to do so.
  • FinCEN continues to accept voluntary submissions for entities that wish to proactively comply with potential future obligations.

Businesses that have already begun preparing beneficial ownership information may wish to complete the process to ensure readiness if the injunction is lifted. We will continue to provide updates on this matter.

Federal Appeals Court Reinstates Injunction Against the CTA, Pending Appeal

At approximately 8:15 p.m. Eastern Time on December 26, 2024, the United States Court of Appeals for the Fifth Circuit (Fifth Circuit) reversed course from its prior ruling in Texas Top Cop Shop, Inc., v. Garland to allow a lower court’s nationwide preliminary injunction stand against the Corporate Transparency Act (CTA), pending the Government’s appeal. This means that, once again, the Government, including the United States Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN), is barred from enforcing any aspect of the CTA’s disclosure requirements against reporting companies, including those formed before January 1, 2024. This decision prevents FinCEN from enforcing its recently announced deadline extension that would have deferred the compliance deadline for such existing entities from January 1, 2025, to January 13, 2025.

This abrupt about-face appears to be the result of a reassignment of Texas Top Cop Shop, Inc., v. Garland from one three-judge panel of the Fifth Circuit to another. The Fifth Circuit’s prior decision was issued by a “motions panel,” which decided only the Government’s motion to stay the lower court’s injunction. The motions panel also ordered that the case be expedited and assigned to the next available “merits panel” of the Fifth Circuit, which would be charged with deciding the merits of the Government’s appeal. Once the case was assigned to the merits panel, however, the judges on that panel (whose identities have not yet been publicized) appear to have disagreed with their colleagues. The new panel vacated the motions panel’s stay “in order to preserve the constitutional status quo while the merits panel considers the parties’ weighty substantive arguments.” The Government must now decide whether to seek relief from the United States Supreme Court, which may ultimately determine the fate of the CTA.

Tax and Disclosure Considerations Related to Executive Security Benefits

Key Takeaways

  • Executives and companies may deduct the cost of security benefits that meet certain requirements under the Treasury Regulations
  • Public companies are generally required to disclose the cost of security benefits they provide to their executive teams in certain filings with the Securities and Exchange Commission

As individual executives are attracting increased attention for their roles in high-profile consumer-facing companies, their employers are establishing or expanding executive security programs. An executive security program allows key employees to focus on the business and protects shareholder value from stock price fluctuations associated with a security incident. All employers establishing an executive security program should be familiar with the tax consequences of these benefits for both the employer and the executive and public company employers should be aware of the related rules for disclosure of executive perquisites in their proxy statements.

Certain security benefits may be deductible by the employee and employer

Generally, any benefit provided to an employee is includible in taxable income. Certain fringe benefits, including “working condition fringes,” are excludible from income if properly structured. Employer-provided transportation may be excluded from income if it addresses a bona fide business-oriented security concern and the employer establishes an overall security program with respect to the relevant executive. An “overall security program” is a comprehensive program that provides 24-hour security to the executive subject to the following rules:

  • The executive must be protected while traveling for business or personal purposes; and
  • The program must include the provision of:
    • A bodyguard or chauffeur trained in evasive driving techniques;
    • An automobile with security equipment installed;
    • Guards, metal detectors, alarms or similar methods of controlling access to the executive’s workplace and residence; and
    • Flights on the employer’s aircraft for business and personal reasons, where appropriate.

Employers may find that such an exhaustive security program is unnecessary for their needs. In this situation, the Treasury Regulations also provide that the employer may engage an independent security consultant to perform a security study. If the study demonstrates that the default 24-hour security program is not required to address the employer’s security concerns, the cost of a less comprehensive transportation security program may still be deductible from the employee’s income.

These tax benefits may also extend to the executive’s spouse and dependents. If there is a bona fide business-oriented security concern with respect to an executive, that concern also extends to the executive’s spouse and dependents. The cost of transporting the executive’s spouse and dependents in the same vehicle or aircraft at the same time as the executive remains deductible as a working condition fringe. Deductions for personal travel are limited, however, to the excess of the transportation cost with additional security measures over the transportation cost absent the security concern. For example, if an executive purchases an automobile with bulletproof glass, the executive may only deduct the difference between the cost of the vehicle with and without bulletproof glass.

Despite the elimination of the general commuter expense deduction for employers under the Tax Cuts and Jobs Act, employers may still deduct the cost of providing transportation between the executive’s residence and place of employment if the cost is necessary to ensure the safety of the executive. The standard for a transportation security expense to be deductible by the employer is much lower than the standard that the expense must meet to be excludible from the employee’s income. Transportation expenses are deductible by the company if a reasonable person would consider it unsafe for the employee to commute during the applicable time of day.

Executive security benefits are considered perquisites that must be disclosed with other executive compensation

Under Item 402 of Regulation S-K, companies must disclose executive perquisites with an aggregate value over $10,000 in their proxy statements. The SEC has stated that an item is not a perquisite if it is integrally and directly related to the performance of an executive’s duties. A benefit that is not integrally and directly related to the performance of an executive’s duties is then considered a perquisite if it confers a personal benefit regardless of whether it may be provided for some business reason or for the convenience of the company, unless it is generally available on a non-discriminatory basis to all employees. The SEC has specifically listed “personal travel using vehicles owned or leased by the company” and “security provided at a personal residence or during personal travel” as benefits that constitute perquisites and has brought enforcement actions against companies and executives for failure to disclose or properly value these benefits in recent years. Companies that provide security benefits often take the position that these benefits are integrally and directly related to the performance of the executive’s duties but disclose the value of the benefits in an abundance of caution.

Institutional Shareholder Services (ISS) also scrutinizes executive perquisite disclosures. Listed among ISS’ examples of problematic pay practices that could cause ISS to recommend a vote against an executive pay package are “excessive or extraordinary perquisites,” which include personal use of corporate aircraft and any associated tax gross-ups. Filers must carefully draft their disclosures to explain that these security programs are necessary for the business.

CFPB Takes Aim at Data Brokers in Proposed Rule Amending FCRA

On December 3, the CFPB announced a proposed rule to enhance oversight of data brokers that handle consumers’ sensitive personal and financial information. The proposed rule would amend Regulation V, which implements the Fair Credit Reporting Act (FCRA), to require data brokers to comply with credit bureau-style regulations under FCRA if they sell income data or certain other financial information on consumers, regardless of its end use.

Should this rule be finalized, the CFPB would be empowered to enforce the FCRA’s privacy protections and consumer safeguards in connection with data brokers who leverage emerging technologies that became prevalent after FCRA’s enactment.

What are some of the implications of the new rule?

  • Data Brokers are Now Considered CRAs. The proposed rule defines the circumstances under which companies handling consumer data would be considered CRAs by clarifying the definition of “consumer reports.” The rule specifies that data brokers selling any of four types of consumer information—credit history, credit score, debt payments, or income/financial tier data—would generally be considered to be selling a consumer report.
  • Assembling Information About Consumers Means You are a CRA. Under the rule, an entity is a CRA if it assembles or evaluates information about consumers, including by collecting, gathering, or retaining; assessing, verifying, validating; or contributing to or altering the content of such information. This view is in step with the Bureau’s recent Circular on AI-based background dossiers of employees. (See our prior discussion here.)
  • Header Information is Now a Consumer Report. Under the proposed rule, communications from consumer reporting agencies of certain personal identifiers that they collect—such as name, addresses, date of birth, Social Security numbers, and phone numbers—would be consumer reports. This would mean that consumer reporting agencies could only sell such information (typically referred to as “credit header” data) if the user had a permissible purpose under the FCRA.
  • Marketing is Not a Legitimate Business Need. The proposed rule emphasizes that marketing is not a “legitimate business need” under the FCRA. Accordingly, CRAs could not use consumer reports to decide for an advertiser which consumers should receive ads and would not be able to send ads to consumers on an advertiser’s behalf.
  • Enhanced Disclosure and Consent Requirements. Under the FCRA, consumers can give their consent to share data. Under the proposed rule, the Bureau clarified that consumers must be provided a clear and conspicuous disclosure stating how their consumer report will be used. It would also require data brokers to acknowledge a consumer’s right to revoke their consent. Finally, the proposed rule requires a new and separate consumer authorization for each product or service authorized by the consumer. The Bureau is focused on instances where a customer signs up for a specific product or service, such as credit monitoring, but then receives targeted marketing for a completely different product.

Comments on the rule must be received on or before March 3, 2025.

Putting It Into Practice: With the release of the rule so close to the end of Director Chopra’s term, it will be interesting to see what a new administration does with it. We expect a new CFPB director to scale back and rescind much of the informal regulatory guidance that was issued by the Biden administration. However, some aspects of the data broker rule have bipartisan support so we may see parts of it finalized in 2025.

Proposed Disregarded Payment Loss Rules Create Traps for the Unwary

Be wary: The US Department of the Treasury’s proposed disregarded payment loss (DPL) regulations lay surprising new traps for multinational taxpayers – and those ensnared are unlikely to see what’s coming.

Under the proposed regulations, disregarded payments from a foreign disregarded entity to its domestic corporate parent can give rise to a US income inclusion without any offsetting deduction.[1] This phantom income can be substantial and because the inclusion results from payments that are disregarded as a matter of US tax law, it is sure to be an unwelcome surprise for some taxpayers.

Multinational taxpayers with US corporate entities that hold or acquire interests in foreign disregarded entities should understand the proposed regulations, determine their potential exposure, and consider steps to mitigate potential tax liabilities. This article provides a high-level overview of the proposed regulations and reviews the questions that multinational companies should ask themselves before the traps are sprung.

In Depth


The DPL rules are included in proposed regulations that were published on August 7, 2024.[2] The proposed regulations address, among other topics, how the Section 1503(d) dual consolidated loss (DCL) rules apply in the context of Pillar Two taxes. Though the proposed regulations include both DCL and DPL rules and the DPL rules use similar timing and concepts as the DCL rules, the DPL rules operate separately and apply to a different set of circumstances.[3]

While the DCL rules prevent taxpayers from deducting the same loss twice (once in the United States and once in a foreign jurisdiction), the DPL rules target “deduction/no inclusion” (D/NI) outcomes. In a D/NI scenario, a domestic corporation owns a foreign disregarded entity that makes payments to its domestic corporate parent. The payments are regarded for foreign tax purposes and may give rise to a foreign deduction or loss but are disregarded for US tax purposes, so there is no corresponding US income inclusion. Under foreign tax law, the foreign deduction or loss can be used to offset other foreign income and reduce foreign tax.[4]

To prevent D/NI outcomes, the proposed DPL rules identify certain foreign tax losses attributable to disregarded payments and then require the domestic corporate parent to include a corresponding amount of income for US tax purposes. However, the rules are extremely broad and may require US income inclusions where there is no D/NI outcome or potentially when the foreign disregarded entity is not actually in a loss position from a foreign tax perspective.[5]

As explained below, the rules (1) apply only to domestic corporations that are deemed to consent to their application, (2) may require domestic corporations to include a substantial “DPL inclusion amount” as ordinary income with no offsetting deduction, and (3) will require such inclusion whenever one of two triggering events occur, namely, a “foreign use” of the DPL or a failure to satisfy the rules’ certification requirements.

DEEMED CONSENT

The DPL rules apply only to consenting domestic corporations but set a low bar for what this “consent” requires. Essentially, a domestic corporation consents to the rules if it owns a foreign disregarded entity, with the applicability date depending on when the domestic corporation acquired or checked the box on the foreign disregarded entity.

First, a domestic corporation consents to the DPL rules if it directly or indirectly owns interests in a “specified eligible entity”[6] that makes a check-the-box election on or after August 6, 2024, to be a disregarded entity.[7]

Second, a domestic corporate owner is deemed to consent to the DPL rules if, as of August 6, 2025, the entity directly or indirectly owns interests in a disregarded entity and has not otherwise consented to the rules. To avoid such deemed consent with respect to a disregarded entity, the disregarded entity may instead elect to be treated as a corporation prior to August 6, 2025. Of course, the related consequences of such an election can be significant.[8]

THE DPL INCLUSION AMOUNT

Domestic corporations that consent to the rules may be required to include a DPL inclusion amount as income. For a specified eligible entity or foreign branch of a consenting domestic corporation (such specified eligible entity or foreign branch is referred to as a “disregarded payment entity”), the DPL for a given tax year is the disregarded payment entity’s net loss for foreign tax purposes that is composed of certain items of income and deduction that are disregarded for US tax purposes.[9] The notice of proposed rulemaking (NPRM) provides the following example:

[I]f for a foreign taxable year a disregarded payment entity’s only items are a $100x interest deduction and $70x of royalty income, and if each item were disregarded for U.S. tax purposes as a payment between a disregarded entity and its tax owner (but taken into account under foreign law), then the entity would have a $30x disregarded payment loss for the taxable year.

The DPL inclusion amount is the DPL amount reduced by the positive balance of the “DPL cumulative register.” The DPL cumulative register reflects the cumulative amount of disregarded payment income attributable to the disregarded payment entity across multiple years. The NPRM also provides the following example:

[I]f a disregarded payment entity incurs a $100x disregarded payment loss in year 1 and has $80x of disregarded payment income in year 2, only $20x of the disregarded payment loss is likely available under the foreign tax law to be put to a foreign use. As such, if a triggering event occurs at the end of year 2, then the specified domestic owner must include in gross income $20x (rather than the entire $100x of the disregarded payment loss).

Taxpayers who expect to benefit from the DPL cumulative register should keep in mind that the register only reflects disregarded payments that would be interest, royalties, or structured payments if regarded for US tax purposes. It reflects no other disregarded payments, and it reflects no regarded payments of any sort.

Notably, disregarded payment entities “for which the relevant foreign tax law is the same” are generally combined and treated as a single disregarded payment entity for purposes of the DPL rules. As a result, disregarded payments between entities formed in the same foreign jurisdiction generally should not give rise to DPL inclusions. However, this rule applies only where the entities have the same foreign tax year and are owned by the same consenting domestic corporation or by consenting domestic corporations that are members of the same consolidated group. Further, to ensure the items of foreign income and deduction net against one another within the combined disregarded payment entity, taxpayers should analyze the applicable foreign tax rules to confirm that these items accrue in the same foreign taxable year.

THE TRIGGERING EVENTS

Consenting domestic corporations will be forced to include the DPL inclusion amount as ordinary income if one of two triggering events occurs within a certification period. A certification period includes the foreign tax year in which the DPL is incurred, any prior foreign tax year, and the subsequent 60-month period. These certification periods and triggering events are somewhat similar to the ones used in the DCL rules. In the case of the DPL rules, however, there is no ability to make a domestic use election, as for US tax purposes there is no regarded loss that can be used to offset US tax.

The first triggering event is a “foreign use” of the DPL. A foreign use is determined under the principles of the DCL rules. Thus, a foreign use generally occurs when any portion of a deduction taken into account in computing the DPL is made available to offset or reduce income under foreign tax law that is considered under US tax law to be income of a related foreign corporation (and certain other entities in limited circumstances).

The second triggering event occurs if the domestic corporation fails to comply with certification requirements. Specifically, where a consenting domestic corporation’s disregarded entity has incurred a DPL, the domestic corporation must certify annually throughout the certification period that no foreign use of the DPL has occurred.

HYBRID MISMATCH RULES AND PILLAR TWO

The DPL rules provide that if a relevant foreign tax law denies a deduction for an item to prevent a D/NI outcome, the item is not taken into account for purposes of computing DPL or disregarded payment income. These so-called “hybrid mismatch rules” go some way toward softening the headache the DPL rules are likely to cause taxpayers.

However, foreign countries’ adoption of Pillar Two rules will exacerbate their impact. The rules make clear that for purposes of a qualified domestic minimum top-up tax (QDMTT) or income inclusion rule (IIR) top-up tax, foreign use is considered to occur where a portion of the deductions or losses that comprise a DPL is taken into account in determining net Global Anti-Base Erosion Rules income for a QDMTT or IIR or in determining qualification for the Transitional Country-by-Country Safe Harbor.[10] There is also a transition rule providing that, for this purpose, QDMTTs and IIRs are not taken into account for taxable years beginning before August 6, 2024.[11] This means that calendar year taxpayers who have not consented early to the DPL rules generally should not have a DPL inclusion amount in 2024 solely as a result of Pillar Two taxes, but, depending on their facts, could have an inclusion next year if proactive measures are not taken.

NEXT STEPS

Now is the time for multinational taxpayers to evaluate their risk under the DPL rules. Taxpayers with a domestic corporation in their structure should think carefully before making check-the-box elections to treat foreign entities as disregarded entities.[12] Moreover, taxpayers should determine whether their domestic corporations own any foreign disregarded entities or other specified entities that will cause them to be deemed to consent to the rules as of August 6, 2025.

Multinational taxpayers also should determine whether they have disregarded interest payments, structured payments, or royalties that fall under the purview of the rules. If so, they should consider whether they will be able to avoid future triggering events or if “foreign uses” of DPLs will be unavoidable. One should pay particular attention to Pillar Two, including the Transitional Country-by-Country Safe Harbor, when considering whether there could be a foreign use.

Taxpayers who cannot avoid triggering events should consider whether, and when, to take some defensive measures. Such actions might include winding up foreign disregarded entities that could be subject to the rules, eliminating disregarded payments that would result in DPL income inclusions,[13] or taking other restructuring steps (e.g., electing to treat certain foreign disregarded entities as associations, as the Treasury suggests). When determining whether to take defensive actions, taxpayers should consider the impact that DPL inclusions could have on their overall tax profile, including sourcing issues, foreign tax credits, and the Section 163(j) limitation on business interest deductions. In terms of timing, taxpayers also should consider whether they have until August 5, 2025, to unwind any arrangements subject to the DPL rules or whether it may be prudent to unwind any such arrangements before the end of the year.

Finally, taxpayers concerned about these rules should watch for news about whether they will be issued in final form. The results of the 2024 US presidential election call into question whether the proposed rules will be finalized or, conceivably, shelved.[14] These considerations further complicate the question of whether and when multinational taxpayers should act in response to the rules, particularly as the clock continues to tick toward the deemed consent date of August 6, 2025.

Endnotes


[1] The proposed regulations also can apply to payments made by a foreign disregarded entity to other foreign disregarded entities owned by the same domestic corporate parent.

[2] REG-105128-23.

[3] Although not analyzed in detail here, the proposed changes to the DCL rules are also significant and taxpayers should consider their impact.

[4] For example, the foreign deduction or loss can be used through a loss surrender or consolidation regime.

[5] For example, this may occur when a foreign disregarded entity makes a payment that is included in another foreign disregarded entity payee’s income for foreign tax purposes.

[6] A specified eligible entity is an eligible entity that is a foreign tax resident or owned by a domestic corporation that has a foreign branch.

[7] The rules also can apply to an entity that is formed or acquired after August 6, 2024, and classified without an election as a disregarded entity.

[8] For example, Section 367 may apply to a deemed contribution to the newly regarded foreign corporation.

[9] Generally, these are items of income and deduction from certain disregarded interest, royalties, and “structured payments” within the meaning of the Section 267A regulations.

[10] A limited exception is available in certain cases where the Pillar Two duplicate loss arrangement rule applies.

[11] This favorable transition rule is subject to an anti-abuse provision that can prevent it from applying.

[12] Taxpayers also should give careful thought to any internal restructurings involving foreign disregarded entities.

[13] Eliminating these payments may, of course, result in a corresponding increase in foreign tax liability.

[14] Commentators to the proposed regulations also have raised substantive invalidity arguments under the Loper Bright framework.

How to Prepare for the Upcoming Filing Deadline Under the Corporate Transparency Act (CTA)

The January 1, 2025 filing deadline under the CTA for filing beneficial ownership information reports (BOI reports) for reporting companies formed prior to January 1, 2024 is rapidly approaching.

January 1, 2025 Filing Deadline

The CTA became effective on January 1, 2024. If you have filed a BOI report in the last 11 months, it may have been in connection with BOI reporting requirements for entities formed in 2024, because any reporting company formed on or after January 1, 2024 is required to submit its initial BOI report within 90 days of the filing of formation documents. However, the CTA’s BOI report requirements also apply to entities formed before 2024 (as well as to entities formed in 2025 and beyond), and the deadline for filing BOI reports for these entities is fast approaching. BOI reports for entities formed before 2024 must be filed by January 1, 2025, and as further discussed below, BOI reports for entities formed on or after January 1, 2025 must be filed within 30 days of the filing of formation documents.

Compliance with the Corporate Transparency Act

Below are several initial steps to take to prepare for this upcoming deadline:

1. Exemptions. Assuming your entity was formed by the filing of a document with a secretary of state or any similar office under the law of a State or Indian Tribe, your entity may be a reporting company subject to the CTA. If so, review the 23 exemptions to being a reporting company and confirm if any of these exemptions apply to any of your entities.

  • An entity formed as noted above that qualifies for any of these 23 exemptions is not required to submit a BOI report to the Financial Crimes Enforcement Network (FinCEN).
  • An entity formed as noted above that does not qualify for any exemption is referred to as a “reporting company” and will be required to submit a BOI report to FinCEN.

2. Entity Records. Review the entity records for each reporting company and confirm that these records reflect accurate, up to date information with respect to the ownership percentages, management, etc. of each entity within the structure.

3. Determine Beneficial Owners. There are two types of reporting company beneficial owners: (i) any individual (natural person) who directly or indirectly owns 25% or more of a reporting company, and (ii) any individual (including any individual who owns 25% or more of the reporting company) who directly or indirectly exercises substantial control over the reporting company. FinCEN expects that every reporting company will be substantially controlled by at least one individual, and therefore will have at least one beneficial owner. There is no maximum number of beneficial owners who must be reported.

4. FinCEN Identifiers. Once the individual(s) who qualify as beneficial owners of any of your reporting companies have been identified, you may obtain FinCEN identifiers for these individuals. Although this step is not required, obtaining a FinCEN identifier will allow you to report an individual’s FinCEN identifier number in lieu of his or her personal beneficial ownership information in the BOI report filed for the reporting company in which he or she has been determined to be a beneficial owner. If/when any beneficial ownership information changes for that individual, the individual will be required to update the beneficial ownership information associated with his or her FinCEN identifier, but each reporting company which this individual is a beneficial owner of will not be required to file a corresponding update (unless an update is required for a separate reason).

5. Prepare to File BOI Reports Sooner Rather than Later. With the January 1, 2025 filing deadline fast approaching and over 32 million entities expected to be impacted by the CTA, we recommend taking the steps to prepare and file BOI reports for your reporting companies as soon as possible. While awareness of the CTA and its requirements continues to grow, people still have questions and concerns regarding how their personal information will be handled, and it can take time to collect the necessary information. Accordingly, identifying any beneficial owners and requesting their beneficial ownership information as soon as possible will help to avoid any last-minute scrambles to prepare and file your reporting companies’ BOI reports. Some have questioned whether BOI reports are subject to disclosure under the Freedom of Information Act (FOIA). FinCEN has pointed out that these reports are exempt from disclosure under FOIA.

6. Reach Out With Questions. We have a team of attorneys, paralegals and support staff that would be happy to help guide you through this process.

The Corporate Transparency Act in 2025 and Beyond

In addition to reporting requirements for reporting companies formed before 2024 and during 2024 as outlined above, all entities formed in 2025 and beyond that qualify as reporting companies will be required to submit BOI reports within 30 days of the filing of formation documents. This is a significantly shorter filing window than what was imposed on entities formed before and during 2024. Accordingly, moving forward, for entities formed in 2025 and beyond, the CTA should be viewed as an additional step in the entity formation process.

The CTA also imposes requirements for updating BOI reports following any changes to the beneficial ownership information reported on a BOI report. Any changes to the beneficial ownership information must be reflected in an updated BOI reports filed with FinCEN no later than 30 days after the date on which the change occurred (note, the same 30-day timeline applies to changes in information submitted by an individual in order to obtain a FinCEN identifier).

CFPB Imposes $95 Million Fine on Large Credit Union for Overdraft Fee Practices

On November 7, 2024, the CFPB ordered one of the largest credit unions in the nation to pay over $95 million for its practices related to the imposition of overdraft fees. The enforcement action addresses practices from 2017 to 2022 where the credit union charged overdraft fees on transactions that appeared to have sufficient funds, affecting consumers including those in the military community, in violation of the CFPA’s prohibition on unfair, deceptive, and abusive acts or practices.

The Bureau alleges that the credit union’s practices, particularly in connection with its overdraft service, resulted in nearly $1 billion in revenue from overdraft fees over the course of five years. According to the Bureau, the credit union unfairly charged overdraft fees in two ways. First, it charged overdraft fees on transactions where the consumer had a sufficient balance at the time the credit union authorized the transaction, but then later settled with an insufficient balance. The Bureau noted that these authorize-positive/settle-negative violations have been a focus of federal regulators since 2015, and were the subject of a CFPB circular in October 2022. Second, when customers received money though peer-to-peer payment networks, the credit union’s systems showed the money as immediately available to spend. However, the credit union failed to disclose that payments received after a certain time of the day would not post until the next business day. Customers who tried to use this apparently available money were then charged overdraft fees

In addition to monetary fines, the CFPB’s order prohibits the credit union from imposing overdraft fees for authorize-positive, settle negative transactions, and also in cases where there was a delayed crediting of funds from peer-to-peer payment platforms.

The monetary penalties the consent order imposes consist of $80 million in consumer refunds for wrongfully charged overdraft fees and a $15 million civil penalty to be paid to the CFPB’s victims relief fund.

Putting It Into Practice: This order aligns with federal and state regulators’ recent focus on overdraft fees in a broader initiative to eliminate allegedly illegal “junk fees” (a trend we previously discussed herehere, and here). For companies operating in the financial sector or providing peer-to-peer payment services, this enforcement action serves as a critical reminder of the need for transparency and adherence to consumer financial protection laws. Regular audits of fee practices and disclosures can help identify and rectify potential compliance issues before they escalate. Companies aiming to impose overdraft or other types of fees should review agency guidance enforcements to ensure their internal policies and business practices do not land them in hot water.

Listen to this post

Lawsuit Challenges CFPB’s ‘Buy Now, Pay Later’ Rule

On Oct. 18, 2024, fintech trade group Financial Technology Association (FTA) filed a lawsuit challenging the Consumer Financial Protection Bureau’s (CFPB) final interpretative rule on “Buy Now, Pay Later” (BNPL) products. Released in May 2024, the CFPB’s interpretative rule classifies BNPL products as “credit cards” and their providers as “card issuers” and “creditors” for purposes of the Truth in Lending Act (TILA) and Regulation Z.

The FTA filed its lawsuit challenging the CFPB’s interpretative rule in the U.S. District Court for the District of Columbia. The FTA alleges that the CFPB violated the Administrative Procedure Act’s (APA) notice-and-comment requirements by imposing new obligations on BNPL providers under the label of an “interpretive rule.” The FTA also alleges that the CFPB violated the APA’s requirement that agencies act within their statutory authority by ignoring TILA’s effective-date requirement for new disclosure requirements and imposing obligations beyond those permitted by TILA. The FTA also contends that the CFPB’s interpretive rule is arbitrary and capricious because it is “a poor fit for BNPL products,” grants “insufficient time for BNPL providers to come into compliance with the new obligations” imposed by the rule, and neglects “the serious reliance interests that [the CFPB’s] prior policy on BNPL products engendered.”

In a press release announcing its lawsuit, the FTA said the BNPL industry would welcome regulations that fit the unique characteristics of BNPL products, but that the CFPB’s interpretive rule is a poor fit that risks creating confusion for consumers. “Unfortunately, the CFPB’s rushed interpretive rule falls short on multiple counts, oversteps legal bounds, and risks creating confusion for consumers,” FTA President and CEO Penny Lee said. “The CFPB is seeking to fundamentally change the regulatory treatment of pay-in-four BNPL products without adhering to required rulemaking procedures, in excess of its statutory authority, and in an unreasonable manner.”

The FTA’s pending lawsuit notwithstanding, BNPL providers may wish to consult with legal counsel regarding compliance with the CFPB’s interpretive rule. Retailers marketing BNPL products should also consider working with legal counsel to implement third-party vendor oversight policies to enhance BNPL-partner compliance with the rule.

Rytr or Wrong: Is the FTC’s Operation AI Comply a Prudent Defense Against Deception or an Assault on Innovation and Constitutional Free Speech?

In today’s rapidly evolving digital economy, new artificial intelligence tools promise to transform every industry. Sometimes, those promises are overblown or outright deceptive. So, as the AI hype cycle continues, regulators are left with the unenviable role of determining their duties to shape the impact of these developing tools on businesses and the public. Although the EEOC, SEC, DOJ and several State Attorneys General are issuing warnings and increasingly investigating the risks of AI, this tension is on full display with the Federal Trade Commission’s recent enforcement actions announced as part of its “Operation AI Comply,” which marks the beginning of its “new law enforcement sweep” against companies that are relying on AI “as a way to supercharge deceptive or unfair conduct that harms consumers.”1

Although many of the initial targets of Operation AI Comply were accused of conduct that plausibly violated Section 5, the FTC’s charges against an AI writing assistant, Rytr, drew strong dissents from two of the FTC Commissioners who accused their fellow commissioners of effectively strangling AI innovation in the crib. There are several important takeaways from Operation AI Comply, particularly if the dissenting commissioners have correctly identified that the FTC is pushing the boundaries of its authority in pursuit of AI.

The FTC and its Role in AI Regulation.

The FTC plays a critical role in protecting consumers from unfair or deceptive practices, and it has long been warning developers about how their algorithms and AI tools might violate one of its broadest sources of statutory authority: Section 5 of the FTC Act.2

In many respects, the FTC’s September 25, 2024, announcement of its “Crackdown on Deceptive AI Claims and Schemes” should not have come as a surprise, as most of the enforcement actions related to overhyping AI.For example, the FTC’s Complaint and proposed settlement with DoNotPay – which made bold claims about being “the world’s first robot lawyer” and that it could “generate perfectly valid legal documents in no time,” replacing “the $200-billion-dollar legal industry with artificial intelligence”4– turned on relatively straightforward false or unsubstantiated performance claims in violation of Section 5 of the FTC Act.Similarly, the FTC’s charges against Ascend Ecom,Ecommerce Empire Builders,and FBA Machineall relate to allegations of e-commerce business opportunity schemes that generally engaged in AI-washing – i.e., a tactic of exaggerating or falsely representing that a product uses AI in an effort to make the product or company appear more cutting edge than it actually is.Each of these four cases was unanimously supported by the Commission, receiving 5-0 votes, and is consistent with other actions brought by the FTC to combat unfair, deceptive, or discriminatory impacts of AI.10

However, with a 3-2 split among its commissioners, the FTC’s complaint against Rytr is a different story.11 Historically, unanimous decisions were more typical; however, split decisions are becoming more common as the FTC pursues more aggressive enforcement actions and reflect a broader ideological conflict about the role of regulation and market intervention.

Rytr: Creative Assistant or Assistant to Fraud?

Rytr is a generative AI writing assistant that produces unlimited written content for subscribers for over 43 use cases.12 At the core of the FTC’s complaint against Rytr is the risk that one of its use cases – a “Testimonial & Review” feature – can be used to create customer reviews that may be false or misleading.13

Based on limited user input, users can generate “genuine-sounding, detailed reviews quickly and with little user effort,” which the FTC believes “would almost certainly be false for users who copy the generated content and publish it online.”14 The FTC gives one example where a user provided minimal inputs of “this product” and “dog shampoo” to generate a detailed paragraph boasting how the dog shampoo smelled great, reduced shedding, improved the shine of their dog’s coat, and recommended the product.15 Based on example inputs and outputs like this, the FTC concluded that Rytr’s services “causes or is likely to cause substantial harm to consumers” and “its likely only use is to facilitate subscribers posting fake reviews with which to deceive consumers.”16 As such, the FTC’s complaint argues that Rytr – by offering a tool that could be readily used to generate false reviews — provided the “means and instrumentalities for deception” and engaged in unfair acts or practices in violation of Section 5 of the FTC Act.17

In other words, the majority of the FTC Commissioners were concerned about an infinite potential for inaccurate or deceptive product reviews by Rytr’s subscribers and did not recognize countervailing reasons to allow this use of technology. Without admitting or denying the allegations in the Complaint, Rytr agreed to a proposed settlement with the FTC by which Rytr would stop offering the Testimonial & Review use case at issue in this case18 – a pragmatic solution to avoid litigation with the government.

Dissents from the FTC’s Direction.

Commissioners Melissa Holyoak and Andrew Ferguson submitted two dissenting statements, criticizing the complaint against Rytr as an aggressive expansion of the FTC’s authority under Section 5 and cautioned against its chilling effect on a nascent industry.19

Commissioner Ferguson framed the internal conflict well: “Treating as categorically illegal a generative AI tool merely because of the possibility that someone might use it for fraud is inconsistent with our precedents and common sense. And it threatens to turn honest innovators into lawbreakers and risks strangling a potentially revolutionary technology in its cradle.”20 The dissenting statements identified three broad objections to the Rytr complaint.

First, as a threshold matter, the complaint failed to identify any evidence of actual harmful or deceptive acts stemming from Rytr’s product – a clear requirement under Section 5 of the FTC Act.21 Both dissents criticized the complaint for effectively treating draft outputs from Rytr as the final reviews published by users; however, “the Commission does not allege a single example of a Rytr-generated review being used to deceive consumers in violation of Section 5 [.]22 Both dissents criticized the complaint for ignoring the obvious benefits of generative AI in this context. Namely, that “much of the promise of AI stems from its remarkable ability to provide such benefits to consumers using AI tools. . . . If Rytr’s tool helped users draft reviews about their experiences that they would not have posted without the benefit of a drafting aid, consumers seeing their reviews benefitted, too.”23

Second, the dissenters rejected the complaint as “a dramatic extension of means-and-instrumentalities liability,”24 particularly in a case “where there is no allegation that Rytr itself made misrepresentations.”25 The complaint focused on the fact that Rytr “has furnished its users and subscribers with the means to generate written content for consumer reviews that is false and deceptive[,]” thus providing “the means and instrumentalities for the commissions of deceptive acts and practices.”26 However, the dissenters note that the “critical element for primary liability is the existence of a representation, either by statement or omission, made by the defendant.”27 The theory advanced against Rytr could be “true of an almost unlimited number of products and services: pencils, paper, printers, computers, smartphones, word processors, . . . etc.”28 Accordingly, both dissenting commissioners rejected this expansion of means-and-instrumentalities liability because a “knowledge requirement avoids treating innocent and productive conduct as illegal merely because of the subsequent acts of independent third parties.”29

Finally, the dissenters offered several reasons why the FTC’s complaint was not in the public’s interest. Both dissenters expressed concerns that this case was too aggressive and would undermine innovation in the AI industry.30 Commissioner Ferguson went further to note that the complaint could violate important First Amendment interests, noting that the complaint “holds a company liable under Section 5 for a product that helps people speak, quite literally.”31 He criticized the theory behind the complaint; “[y]et because the technology in question is new and unfamiliar, I fear we are giving short shrift to common sense and to fundamental constitutional values.”32

Conclusion

It bears repeating that the FTC Commissioners unanimously approved almost every case listed in Operation AI Comply; “[w]hen people use generative AI technology to lie, cheat, and steal, the law should punish them no differently than if they use quill and parchment.”33 So, the FTC’s warnings about marketing AI systems for professional services, using AI to engage in misleading marketing, or overstating a product’s AI integration should be heeded, especially with the FTC’s statements that this is only the beginning of its enforcement activity.34 In prepared remarks, Chair Lina Khan has stated that the FTC is “making clear that there is no AI exemption from the laws on the books[,]35 so companies should take care to protect against whether their AI and other automated tools are being used for unfair or deceptive purposes or have biased or discriminatory impacts. Just because a technology is new does not mean that it can ignore existing laws – and we’ve seen similar sentiments and disputes in other areas of emerging technology enforcement, such as the SEC’s view that, with respect to U.S. securities laws, “[t]here’s no reason to treat the crypto market differently just because different technology is used.”36

However, the Rytr case could be an indicator that the majority intends to pursue a broader theory of liability under Section 5 of the FTC Act to include tools that merely could be misused – without proof of actual harm or intent. If that continues to be the case, developers should be vigilant in identifying how their products and platforms could be misused for fraudulent purposes, as well-intentioned developers may become the target of investigations or other inquiries by the FTC. The FTC is accepting public comments on the proposed consent agreement with Rytr through November 4, 2024,37 which could develop the FTC’s position further.


1) FTC Announces Crackdown on Deceptive AI Claims and Schemes, Press Release, Federal Trade Commission (Sept. 25, 2024), available at https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announces-crackdown-deceptive-ai-claims-schemes.

2) See, e.g., Aiming for truth, fairness, and equity in your company’s use of AI, Elisa Johnson, Federal Trade Commission (April 19, 2021), available at https://www.ftc.gov/business-guidance/blog/2021/04/aiming-truth-fairness-equity-your-companys-use-ai.

3) Operation AI Comply: Detecting AI-infused frauds and deceptions, Alvaro Puig, Federal Trade Commission (Sept. 25, 2024), available at https://consumer.ftc.gov/consumer-alerts/2024/09/operation-ai-comply-detecting-ai-infused-frauds-and-deceptions.

4) See, e.g., id.

5) In re DoNotPay, Inc., FTC Matter No. 2323042, Complaint available at https://www.ftc.gov/system/files/ftc_gov/pdf/DoNotPayInc-Complaint.pdf.

6) FTC v. Ascend Capventures, Inc., et al., C.D. Ca. Case No. 2:24-CV-07660-SPG-JPR (Filed Sept. 9, 2024).

7) FTC v. Empire Holdings Group LLC, et al., E.D. Pa. Case No. 2:24-CV-04949 (Filed Sept. 18, 2024).

8) FTC v. TheFBAMachine Inc., et al., D. N.J. Case No. 2:24-CV-06635-JXN-LDW (Filed June 3, 2024).

9) See generally, FTC Announces Crackdown on Deceptive AI Claims and Schemes, supra.

10) The FTC aggregated several summaries for its recent cases related to AI and other automated tools, which can be found here: https://www.ftc.gov/business-guidance/blog/2024/09/operation-ai-comply-continuing-crackdown-overpromises-ai-related-lies#:~:text=These%20cases%20are,CRI%20Genetics.

11) See generally Cases and Proceedings: Rytr, FTC Matter No. 2323052 (last updated Sept. 25, 2024), available at https://www.ftc.gov/legal-library/browse/cases-proceedings/rytr.

12) See, e.g., In re Rytr LLC, FTC Matter No. 2323052, Complaint ¶ 2, available at https://www.ftc.gov/system/files/ftc_gov/pdf/2323052rytrcomplaint.pdf.

13) Id. ¶ 6.

14) Id. ¶¶ 6-8.

15)  Id. ¶ 10.

16) Id. ¶ 14.

17) Id. ¶¶ 15-18.

18)  See In re Rytr LLC, Agreement Containing Consent Order, available at https://www.ftc.gov/system/files/ftc_gov/pdf/2323052rytracco.pdf.

19) See, e.g., Dissenting Statement of Commissioner Melissa Holyoak, Joined by Commissioner Andrew N. Ferguson, In re Rytr LLC, FTC Matter No. 2323052 at p.1 (cautioning against settlements to “advance claims or obtain orders that a court is highly unlikely to credit or grant in litigation,” as it may encourage the use of “questionable or misguided theories or cases.”) [hereinafter, “Holyoak Dissent”].

20) Dissenting Statement of Commissioner Andrew N. Ferguson, Joined by Commissioner Melissa Holyoak, In re Rytr LLC, FTC Matter No. 2323052 at p.1 [hereinafter, “Ferguson Dissent”].

21) See 15 U.S.C. § 45(n) (prohibiting the FTC from declaring an act or practice unfair unless it “causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition.”).

22) Ferguson Dissent at p.6; see also Holyoak Dissent at p.2.

23) Holyoak Dissent at p.3; see also Ferguson Dissent at p.7 (noting the challenges of writing a thoughtful review and that “a tool that produces a well-written first draft of a review based on some keyword inputs can make the task more accessible.”).

24) Ferguson Dissent at p.5.

25) Holyoak Dissent at p.4 (emphasis original).

26) Complaint ¶¶ 15-16.

27) Holyoak Dissent at p.4 (emphasis original) (cleaned up with citations omitted); see also Ferguson Dissent at pp.3-5 (discussing the circumstances in which means-and-instrumentalities liability arises).

28) Ferguson Dissent at p.5.

29) Ferguson Dissent at p.7; see also Holyoak Dissent at p.5 (“Section 5 does not categorically prohibit a product or service merely because someone might use it to deceive someone else.”).

30)  Holyoak Dissent at p.5 (“Today’s misguided complaint and its erroneous application of Section 5 will likely undermine innovation in the AI space.”); Ferguson Dissent at p.10 (“But we should not bend the law to get at AI. And we certainly should not chill innovation by threatening to hold AI companies liable for whatever illegal use some clever fraudster might find for their technology.”).

31) Ferguson Dissent at p.10.

32) Id.

33) Id. at p.9 (citing Concurring and Dissenting Statement of Commissioner Andrew N. Ferguson, A Look Behind the Screens: Examining the Data Practices of Social Media and Video Streaming Services, at pp.10-11 (Sept. 19, 2024)).

34) Operation AI Comply: Detecting AI-infused frauds and deceptions, supra.

35) A few key principles: An excerpt from Chair Khan’s Remarks at the January Tech Summit on AI, FTC (Feb. 8, 2024), available at https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/few-key-principles-excerpt-chair-khans-remarks-january-tech-summit-ai.

36) Prepared Remarks of Gary Gensler on Crypto Markets at Penn Law Capital Markets Association Annual Conference, Chair Gary Gensler, SEC (April 4, 2022), available at https://www.sec.gov/newsroom/speeches-statements/gensler-remarks-crypto-markets-040422.

37) Rytr LLC; Analysis of Proposed Consent Order To Aid Public Comment, Federal Register, available at https://www.federalregister.gov/documents/2024/10/03/2024-22767/rytr-llc-analysis-of-proposed-consent-order-to-aid-public-comment.