The letter looks official. It mentions the Corporate Transparency Act, warns of penalties, and points to a form you have never seen. There is a deadline, a QR code, and a fee to make the problem disappear.
That paper trail has all the props of compliance. It is also exactly where a fraud investigation should begin.
On August 11, 2026, the Financial Crimes Enforcement Network finalized a rule that makes the federal Beneficial Ownership Information reporting exemption permanent for U.S. companies. Domestic corporations, LLCs, and other entities created in the United States no longer have to file BOI reports with FinCEN. U.S. persons also do not have to give their ownership information to a reporting company, and people who previously obtained a FinCEN identifier do not have to update or correct the information attached to it.
For millions of small business owners, the federal filing question is now much simpler. The fraud risk around the answer is not.The clue hidden in the effective rule
The August final rule locks in relief that began under an interim rule in March 2025. In practical terms, a company formed under the laws of Texas, Ohio, California, or another U.S. jurisdiction is exempt from the federal BOI filing requirement.
The remaining federal reporting population is much narrower: certain entities formed under foreign law and registered to do business in a U.S. state or Tribal jurisdiction. Even those reporting companies do not report U.S. persons as beneficial owners or company applicants under the new rule.
That distinction matters because a persuasive scam rarely invents its entire cover story. It borrows a real agency name, a real law, and language left over from an earlier deadline. Then it inserts one false instruction: pay this fee, use this form, scan this code, or send ownership documents to this address.
FinCEN has already identified several tells. The agency says correspondence referencing “Form 4022” or “Form 5102” is fraudulent; neither form exists. A notice from a supposed “US Business Regulations Dept.” is also false because there is no agency by that name. FinCEN does not charge a fee to file BOI directly, does not send payment demands for BOI filing, and does not begin a CTA penalty matter by email or phone.
Those are not fine-print technicalities. They are pieces of evidence.Why the mailbox may get noisier after the rule gets easier
Rule changes create a useful pressure point for impersonators. Owners remember hearing about BOI, but many are unsure whether they filed, whether an old filing must be updated, or whether the latest court ruling changed the answer again. A notice that promises to settle the issue for $199 can sound cheaper than spending an afternoon researching it.
The request may also be designed to steal more than a fee. A fake compliance portal can collect names, birth dates, home addresses, identification numbers, and copies of driver’s licenses or passports. That is an unusually rich identity file, especially when it is tied to a real company and its owners.
Treat any unexpected BOI message as an unverified lead. Do not use its phone number, link, QR code, return envelope, or reply address to check whether it is real. Open a new browser window and go directly to FinCEN.gov. If the message claims to come from an accountant, attorney, registered agent, or formation service, contact that firm through a number already in your records.Exempt does not mean every ownership request is fake
Here is where a good investigation avoids the easy mistake. The final BOI rule concerns reports filed with FinCEN under the Corporate Transparency Act. It does not erase every other reason a business may be asked to identify its owners.
Banks and other covered financial institutions still have customer-due-diligence duties. A bank opening or maintaining a business account may make a legitimate request for ownership or control information under rules that are separate from the company’s BOI filing status. States may also have formation, annual-report, licensing, tax, or ownership-disclosure requirements of their own.
So the useful question is not simply, “Why are they asking for ownership information if BOI ended?” It is, “Who is asking, under which authority, through what verified channel, and for what specific purpose?”
A real bank request should survive a callback to the bank’s published number or your known relationship contact. A real state filing obligation should appear on the appropriate secretary of state or revenue-agency website. A demand that collapses when moved outside its own email, QR code, or phone number has just exposed its cover story.Close the file without throwing away the evidence
Small businesses can turn the rule change into a short, controlled cleanup:
- Update the company’s compliance calendar to show that domestic entities are exempt from federal BOI reporting under FinCEN’s August 2026 final rule.
- Keep prior BOI confirmations and the ownership records behind them according to the business’s normal record-retention practices. Do not email identification documents around simply because the federal update duty ended.
- Tell the people who open mail, pay invoices, and manage the registered-agent inbox that BOI filing fees, invented forms, QR codes, and penalty calls are warning signs.
- Route any ownership-information request to one designated reviewer. That person should identify the requesting organization, the legal or contractual reason, and a trusted method of verification.
- If the company was formed outside the United States and registered here, do not assume the domestic-company exemption applies. Check the final rule and obtain qualified guidance for the entity’s facts.
- If a suspicious notice arrives, preserve the envelope, headers, attachment, URL, phone number, and payment instructions. Report suspected fraud through the appropriate agency channel rather than arguing with the sender.
The new rule removes a federal filing burden for U.S. companies. It does not remove the value of the information scammers want.
The decisive clue is now straightforward: a domestic small business should not be pressured to pay a federal BOI filing fee or send ownership documents through an unverified notice. When the paperwork creates urgency, step away from its instructions and verify the claim from a clean source. That pause is often where the fraud falls apart.
Sources: FinCEN BOI reporting page and August 11, 2026 final-rule alert; FinCEN customer due diligence rule overview
