Nov 32026

State Attorneys General Sue to Challenge FinCEN’s Beneficial Ownership Reporting Rule

David C. Buck, Paul M. Tyrrell, Stanley J. Boris, Michael D. Mann, Alexa Poletto, Brian C. Earl and Asher J. Zlotnik
, , , , , ,

On October 27, 2026, the attorneys general of 20 states and the District of Columbia (the States) filed a lawsuit in the U.S. District Court for the District of Oregon challenging the U.S. Department of the Treasury Financial Crimes Enforcement Network’s (FinCEN) final rule eliminating beneficial ownership information (BOI) reporting requirements for U.S. companies and U.S. persons under the Corporate Transparency Act (CTA). The complaint asks the court to vacate FinCEN’s August 2026 final rule (the Final Rule) and the March 2025 interim final rule that preceded it (the IFR), and to halt FinCEN’s planned deletion of BOI previously reported by U.S. companies. The States argue that FinCEN effectively rewrote the CTA through rulemaking.

The lawsuit does not change existing reporting obligations. Unless a court orders otherwise, U.S. companies and their beneficial owners are not required to file BOI reports, while foreign reporting companies remain subject to the narrower requirements of the Final Rule. It is unclear whether FinCEN has already begun deleting previously reported BOI or whether the court will intervene to prevent its deletion. If the States prevail, BOI reporting requirements for domestic companies could potentially be reinstated.

Background: The CTA, the Reporting Rule, and the Final Rule

Congress enacted the CTA in 2021 to combat the misuse of anonymous shell companies by requiring entities to disclose their beneficial owners to a nonpublic FinCEN database. The statute defines “reporting company” to include two categories: domestic entities created by a filing with a secretary of state or similar office, and foreign entities registered to do business in the United States. It provides for 23 exemptions and permits the Secretary of the Treasury to add others only if reporting neither serve the public interest nor would be useful to law enforcement. FinCEN’s 2022 implementing rule (the Reporting Rule) took effect on January 1, 2024, and estimated that approximately 32.6 million entities would be required to report.

As discussed in our prior Updates, small businesses challenged the CTA on constitutional grounds, and in late 2024 and early 2025, federal courts alternately halted and reinstated enforcement, prompting FinCEN to suspend and then extend reporting deadlines. FinCEN then reversed course after the change in administrations. The IFR, published on March 26, 2025, exempted domestic reporting companies and U.S. person beneficial owners, and the Final Rule, issued on August 11, 2026, extended those exemptions and made them permanent. Under the Final Rule, only foreign entities registered to do business in the United States must report, and only for their non-U.S. person beneficial owners. FinCEN also announced that it would delete previously reported information about U.S. persons from its database.

The States’ Challenge

The complaint argues that the Final Rule and the IFR impermissibly rewrite the CTA by exempting nearly every entity Congress required to report. The Final Rule estimates that only 28,000 existing foreign reporting companies and 1,800 new ones will report in future years. The Reporting Rule, by contrast, estimated 32.6 million existing entities plus about 5 million new entities each year. The States argue that the CTA’s residual exemption authority allows the Secretary to exempt additional classes of entities, not to remove one of the two categories Congress expressly required to report. The States raise a similar objection to the exemption for U.S. persons, which FinCEN based on the Bank Secrecy Act’s general exemption authority rather than the CTA. They also allege that both rules are arbitrary and capricious, in part because FinCEN relied on burdens to small businesses that Congress had already weighed.

If the court vacates both the Final Rule and the IFR, the Reporting Rule’s domestic reporting obligations could return. The complaint does not address when those obligations would apply. As in 2024 and 2025, FinCEN would likely need to announce new filing deadlines. Until a court rules otherwise, however, the Final Rule remains in effect.

FinCEN’s BOI “Data Purge”

The complaint also asks the court to stay FinCEN’s plan to delete previously reported BOI, which the States characterize as the “Data Purge.” The Final Rule states that FinCEN intends to delete the reported information of newly exempt companies, and that FinCEN does not anticipate deleting information reported after February 10, 2027, which the States read to mean that the deletion will occur by that date. The States argue that the CTA requires FinCEN to retain reported information for at least five (5) years after a reporting company ceases to exist, and that a company does not  cease to exist simply because FinCEN has exempted it. They also argue that BOI reports are federal records that may be destroyed only under schedules approved by the Archivist of the United States, and that no such approval exists. Finally, because the deletion plan first appeared in the Final Rule, the States contend that it was adopted without the required opportunity for public comment.

It is unclear whether FinCEN has begun deleting data or when the court will act on the stay request. The outcome will determine whether information that millions of companies have already submitted remains available to authorized agencies, and the States say they intend to use that information in fraud investigations, consumer protection matters, and tax enforcement.

Key Takeaways

  • BOI obligations are unchanged pending a court order. The Final Rule remains in effect. U.S. companies and their beneficial owners do not need to file, update, or correct BOI reports, and foreign reporting companies should continue to comply with the Final Rule’s requirements for their non-U.S. person beneficial owners.
  • The status of previously reported data is uncertain. Companies that filed BOI reports in 2024 or early 2025 should not assume that their information has been or will be removed from FinCEN’s database, particularly if the court stays the deletion.
  • CTA reporting requirements could potentially return. Vacatur of the Final Rule and IFR could again subject U.S. companies to BOI reporting. Companies should be aware of the litigation and any resulting FinCEN guidance.

The complaint is available here.

This post is as of the posting date stated above. Sidley Austin LLP assumes no duty to update this post or post about any subsequent developments having a bearing on this post.

Contacts
David C. Buck

Houston

dbuck@sidley.com

Paul M. Tyrrell

Boston

ptyrrell@sidley.com

Stanley J. Boris

Washington, D.C.

sboris@sidley.com

Michael D. Mann

New York

mdmann@sidley.com

Alexa Poletto

New York

apoletto@sidley.com

Brian C. Earl

New York

bearl@sidley.com

Asher J. Zlotnik

New York

asher.zlotnik@sidley.com

You might also like
DOJ’s Fraud Division Launches Fast-Track Whistleblower Awards, With a Focus on Health Care Fraud

On October 20, 2026, the U.S. Department of Justice (DOJ or the Department) and its National Fraud Enforcement Division (the Fraud Division) announced the Fraud Whistleblower Incentive Program (WHIP or the Program). DOJ describes WHIP as the first whistleblower rewards program to pay an “up-front” award of between $10,000 and $30,000 for tips leading to criminal charges. Most existing government whistleblower programs pay only after final resolution of a criminal matter, including forfeiture and appeals. WHIP will instead pay awards once criminal charges are filed. The Program covers federal health care offenses and related crimes, as well as fraud on government programs and benefits administered by eight federal agencies.

WHIP’s focus on health care is particularly notable given the Fraud Division’s recent issuance of its first corporate enforcement directive naming health care as the Division’s top priority and a joint self-disclosure policy with the Department of Health and Human Services (HHS) Office of Inspector General (HHS-OIG) aimed at health care companies. Taken together, these developments indicate that health care is central to the Fraud Division’s broader mandate to address fraud on federal programs. As a result, health care companies may face increased pressure to self-disclose potential misconduct before a whistleblower reports it to the government.

Background: Directive 26-12 and DOJ’s Expanding Whistleblower Toolkit

WHIP implements Directive 26-12, which Assistant Attorney General Colin M. McDonald issued on October 1, 2026. The Directive instructed Fraud Division leadership to develop programs that encourage whistleblowers to come forward with credible information about fraud, and it named health care first among four corporate enforcement priorities, as discussed by Sidley here.

WHIP also builds on the Criminal Division’s Corporate Whistleblower Awards Pilot Program (the Pilot Program), launched in August 2024. DOJ revised the Pilot Program in May 2025 to cover certain health care offenses, and again in July 2026 to eliminate the rule automatically disqualifying whistleblowers who could have been eligible for an award under another government program. A whistleblower is now disqualified only if he or she actually receives another award for reporting the same or substantially the same misconduct, as discussed by Sidley here.

Health care fraud enforcement has also become a top priority within the Department’s reorganized fraud enforcement structure. In June 2026, DOJ’s National Health Care Fraud Takedown charged 455 defendants in alleged schemes involving more than $6.5 billion in false claims. In August 2026, the Fraud Division charged 19 defendants for their involvement in alleged home care schemes in Philadelphia involving more than $4 million in claims to Medicare and Medicaid.

The Fraud Whistleblower Incentive Program

WHIP creates a new Fraud Division award channel for members of the public, built around five components: (i) the misconduct and programs covered; (ii) the timing of awards; (iii) the Program’s priority on health care submissions; (iv) exposure for conduct outside the False Claims Act; and (v) the Program’s interaction with the Fraud Division’s joint self-disclosure policy with HHS-OIG. We discuss each below.

1.      Programs Covered

WHIP applies to reports of federal health care offenses and related crimes. It also applies to reports of fraud on programs and benefits administered by the Department of Agriculture, the Department of Labor, HHS, the Department of Housing and Urban Development, the Department of Education, the Department of Veterans Affairs, the Department of War, and the Small Business Administration. The Program therefore reaches a broad range of federally funded activity, from health care reimbursement to housing, education, veterans, and small business programs. Alongside its announcement of the Program, DOJ also announced WHIP’s first award: a $10,000 payment for allegations about federally subsidized childcare centers in Minnesota.

2.      Early Awards Tied to Criminal Charges

Awards become available once criminal charges are filed, rather than after the matter is finally resolved. DOJ explains that this approach gives whistleblowers greater certainty about the amount and timing of payment, while leaving them eligible for larger rewards if their information leads to significant financial penalties or forfeiture. Participants may also seek awards under other programs, including the Pilot Program. A single tip could therefore produce an initial WHIP payment at charging and a larger award later under another program. DOJ will make awards in its sole discretion, and the Department of the Treasury has committed $25 million to the Program.

3.      A Focus on Health Care Fraud

The Program continues the Fraud Division’s emphasis on health care. For health care offenses, DOJ has stated that WHIP will prioritize submissions involving hospice, home health care, day care, and special services fraud. These categories may reach adult day care and other Medicaid-funded community services, as illustrated by the Fraud Division’s recent Philadelphia charges, where the defendants allegedly billed Medicaid for home health aide services that were not provided.

4.      Exposure Beyond the FCA

WHIP may bring to DOJ’s attention conduct that would not previously have surfaced through qui tam actions under the False Claims Act (FCA). Administration officials stated at the Program’s launch that most of the fraud the administration is identifying falls outside the FCA, and WHIP reaches criminal offenses that may not support an FCA claim. Reporting under WHIP is also simpler than filing a qui tam complaint in court, and any member of the public may submit a tip. These features may draw reports from patients, family members, lower-level employees, and competitors who would not have pursued an FCA action. For providers and suppliers whose services and items are reimbursed by federal programs, the Program could therefore increase the volume and variety of allegations reaching the Fraud Division.

5.      Interaction With the Joint Self-Disclosure Policy

WHIP should be read together with the self-disclosure policy the Fraud Division and HHS-OIG announced on October 15, 2026, as discussed by Sidley here. That policy directs companies self-disclosing potential criminal health care matters to the Fraud Division’s Health Care Fraud Section. Qualifying disclosures receive credit under both DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP) and HHS-OIG’s Self-Disclosure Protocol. A qualifying disclosure must involve conduct DOJ did not already know about and must be made before disclosure or a government investigation is imminent. A disclosure made only to HHS-OIG does not qualify.

WHIP makes the timing of disclosure more important, because a fast-paying tip program for outsiders increases the risk that a whistleblower reaches the Department first. Under the CEP’s safe harbor, a company may still qualify for a declination if it self-reports within 120 days of receiving an internal whistleblower report, even if the whistleblower has already reported to DOJ. DOJ has not indicated how that safe harbor would apply where a patient, competitor, or other outsider reports through WHIP without using a company’s internal channels.

As discussed by Sidley here, DOJ’s July 2026 declination for Campus Eye Management was the first health care declination under the Department-wide CEP and only the second under any DOJ self-disclosure policy. WHIP may increase the number of matters in which DOJ learns of potential misconduct before a company has completed its own review.

Key Takeaways

  • Health care companies should anticipate more tips. Hospice, home health, day care, and special services providers are expressly prioritized. These companies should assess whether their billing, eligibility, and service documentation would withstand scrutiny prompted by outside complaints.
  • Strengthen internal reporting channels and response times. The CEP’s 120-day safe harbor depends on the company having received the report internally. An internal report starts that clock and gives the company the first opportunity to investigate and disclose. Companies should confirm that credible allegations are escalated and investigated promptly.
  • Make disclosure decisions early. Credit for voluntary self-disclosure generally depends on the company reporting before DOJ learns of the conduct. A company that identifies potentially criminal conduct affecting a federal health care program should promptly evaluate a disclosure to the Fraud Division rather than rely on a submission to HHS-OIG alone.
  • Prepare for parallel exposure. In health care, a single set of facts often gives rise to overlapping criminal, civil, and administrative matters, and the joint self-disclosure policy does not address FCA liability. Companies should coordinate their criminal, civil, and regulatory strategies from the outset.

DOJ’s press release announcing WHIP is available here, and the Program’s terms and conditions are available here. Directive 26-12 is available here.

DOJ and HHS Launch Healthcare FCA Self-Disclosure Pilot Program with Fixed Repayment Multiplier

On October 22, 2026, the Department of Justice (“DOJ”) Civil Division and the Department of Health and Human Services (“HHS”) announced a six-month Healthcare False Claims Act Self-Disclosure Pilot Program (“FCA SDPP”). The program offers healthcare companies a defined path to resolve potential FCA violations the government does not yet know about, in exchange for a “coordinated civil release” and a repayment within a set multiplier range. DOJ says the goal is to free up government resources to focus on “recalcitrant actors.”

DOJ Fraud Division and HHS-OIG Announce Joint Self-Disclosure Policy, Directing Healthcare Companies to Bring Potential Criminal Matters to DOJ First

On October 15, 2026, the Department of Justice’s National Fraud Enforcement Division (“NFED”) and the Department of Health and Human Services Office of Inspector General (“HHS-OIG”) announced a joint policy (the “Policy”) directing companies seeking to self-disclose potential criminal healthcare matters to NFED’s Health Care Fraud Section. The Policy promises companies deemed to have made good faith, voluntary self-disclosures credit under both DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP) and HHS-OIG’s Self-Disclosure Protocol. It arrives two weeks after the Fraud Division issued Directive 26-12, Corporate Enforcement in the Fight Against Fraud (the “Directive”), in which NFED identified healthcare fraud as its top priority.  You can read more about the Directive here.