A New Standard of Care for Private Companies

The Corporate Transparency Act requires nearly all private companies to file a beneficial ownership report with FinCEN that discloses the identity of each person who has a 25% beneficial ownership in the company or otherwise exercises "substantial control" over the company.  Although implementing regulations have not yet been issued, attorneys need to begin the process of readying their clients for this substantial change in the standard of care exercised by private companies. 

It is fairly standard for private companies, when they are raising capital and recruiting investors, to require investors to sign non-disclosure agreements with respect to company information. Founders and owners want to know that new investors won't take company secrets for competitive and other purposes.  Non-disclosure obligations might be set forth in separate agreements or buried in an LLC operating agreement or corporate shareholders agreement.  

It is rare, however, for those same private companies to undertake duties of non-disclosure to their investors, promising to keep investors' information confidential.

That will change when the Corporate Transparency Act is implemented and private companies become obligated to collect from their beneficial owners and others in "substantial control" identifying information that may include a drivers license number or passport number.

The Corporate Transparency Act will require non-exempt companies to file with FinCEN a report that provides the following information for each beneficial owner and person in "substantial control":

1. Full legal name,

2. Date of birth,

3. Current residential or business street address, and

4. A unique identifying number from an acceptable identity document or a unique identity number generated by FinCEN.

These types of data, of course, are "personally identifying information" or "PII" and have been the subject of regulation in recent years, obligating parties who collect PII to maintain it securely.  Many private companies, however, maintain their corporate and investor documents with their law firms and accountants, or in informal filing systems, that lack the kind of robust security required to satisfy new regulations governing PII.

Private companies, and the lawyers and accountants who handle investor documents for private companies, are going to have to adopt a new standard of care for dealing with investor PII.  Private companies will need to require their investors to provide this information to the company so that the company can file its beneficial ownership report with FinCEN.  At the same time, investors will justifiably require that their companies maintain investor PII securely, to guard against identity theft and other mis-use.  

Intended to modify U.S. information collection practices to assist in enforcing anti-money laundering laws, the Corporate Transparency Act is going to impose a new standard of care on private companies and the attorneys, accountants and other professionals who handle the PII of investors in those companies.

Law firms and accounting firms routinely store client documents in document-management systems that are accessible by all the professionals in the firm.  Firms often lack the systems required to maintain PII in a segregated manner, to ensure that PII can only be accessed by those who have a client-centric need to access that information.   At the same time, firms' document management systems are usually not encrypted, so a person with access can read any document in the system.  The need to keep client PII secure may require firms to find new tools for handling and storing client PII.