On March 26, 2025, the Financial Crimes Enforcement Network (FinCEN) issued an interim final rule that has reshaped the corporate compliance landscape. In a major reversal, FinCEN, following Treasury Department guidance and a series of federal court actions, removed the beneficial ownership information (BOI) reporting requirement under the Corporate Transparency Act (CTA) for all U.S. companies and persons. For the regulated cannabis and hemp sector—where ownership transparency has been a bedrock of compliance with banks, MSBs, and payment processors—this decision marks a profound shift. This blog explores what the reversal means for cannabis businesses, financial institutions, and compliance professionals, and provides practical steps for maintaining strong KYC (know your customer) and EDD (enhanced due diligence) protocols in the new regulatory reality.
What Did the FinCEN 2025 BOI Interim Final Rule Change?
Prior to March 2025, all domestic U.S. entities, including those in the cannabis and hemp space, were gearing up to comply with detailed BOI submission mandates established by the Corporate Transparency Act—a response to global anti-money laundering (AML) initiatives.
But following the Treasury's March 2 announcement and subsequent Federal Register publication, the interim rule wiped BOI filing obligations for domestic businesses off the books. The only ongoing obligation is now on foreign-owned/reporting companies.
Key Point: U.S.-organized cannabis and hemp entities—including growers, processors, dispensaries, and ancillary services—are no longer required to submit BOI filings to FinCEN as of March 26, 2025.
1. Banks and Financial Institutions: Rewriting the KYC Playbook
For years, banks, credit unions, and MSBs serving the cannabis industry relied heavily on government-collected BOI for compliance. With filings rescinded, these institutions must now return to a more decentralized, risk-based approach:
- Direct Collection of Ownership Information: Banks and MSBs will now request beneficial ownership info and documentation (e.g., organizational charts, shareholder registers) directly from cannabis businesses during account opening and ongoing reviews.
- Increased Reliance on Attestations: Owner attestation forms—sworn statements disclosing direct and indirect owners—become even more critical. Institutions may require more frequent updates and certifications.
- Enhanced Document Review: Expect greater scrutiny of entity formation documents, operating agreements, and other records not previously required when BOI was filed with FinCEN.
- Depth of Diligence: Financial institutions are likely to increase the depth of their ongoing due diligence for higher-risk cannabis and hemp businesses, given the lack of federal registry corroboration.
2. Payment Networks and Lenders: Heightened Skepticism and Controls
- Tighter Owner Disclosure Requirements: Lenders and payment rails may adopt stricter owner verification and periodic re-attestation programs, particularly for privately-held cannabis companies or those with complex ownership trees.
- Third-Party Audits: Some financial services providers may require independent verification or audits of owner lists, especially for multi-tiered or partially foreign-owned businesses.
3. Increased Burden on Cannabis Businesses
With no federal BOI registry to validate ownership, businesses themselves must prepare to provide robust, current, and accurate information to all counterparties, sometimes on short notice:
- Prepare organizational charts and chain-of-ownership diagrams
- Maintain resolutions, meeting minutes, and updated operating/partner agreements
- Develop internal procedures for rapid owner changes/disclosure events
Essential Components of a Risk-Based KYC/EDD Program in 2025
In this transformed compliance environment, regulatory expectations haven’t diminished. Rather, the obligation to establish the legitimacy and transparency of owners has shifted even more squarely onto businesses and their financial partners. Here are the critical elements of a resilient KYC/EDD program for the post-BOI era:
A. Direct Ownership Attestations
- Written, signed, and periodically updated attestations from all beneficial owners (as defined by FinCEN: >25% ownership/control or significant authority)
- Notarized signatures or digital identity verification systems
B. Detailed Organizational Charts
- Up-to-date diagrams showing all entity layers, subsidiaries, trusts, or holding companies
- Names and percentages of each owner, with supporting documentation
C. Source-of-Funds Verification
- Bank and MSB partners may require more granular evidence on the origin of capital and ongoing revenue
- Documentation can include capital contribution ledgers, bank statements, investor agreements, and tax returns
D. Change Monitoring and Event Reporting
- Internal controls to promptly report any change in ownership, management, or control
- Routine reminders and certifications for beneficial owners
E. Third-Party Verification Measures
- Greater use of private background screening vendors or audit firms to supplement direct business attestations
- Enhanced review of legal entity identifiers (LEIs), state business licenses, and compliance history
F. Recordkeeping and Retention
- Secure and redundant maintenance of all KYC and ownership records for 5+ years, in line with BSA/AML standards
Template: Risk-Based KYC/EDD Owner Disclosure Packet
Every cannabis/hemp business should consider compiling a proactive compliance packet:
- Certified owner attestation(s) for all beneficial owners
- Full org chart with owner percentages
- Current Articles of Organization/Incorporation
- Operating/partnership agreement and amendments
- Copies of all state and local licenses
- Board resolutions or minutes evidencing owner appointments/removals
- Explanation for any nominee owners, trusts, or foreign stakes
This packet can be quickly provided to new banking partners, MSBs, vendors, or regulators as requested.
Red Flag Triggers for Heightened Due Diligence
Banks and MSBs will be increasingly vigilant for red flags now that state-validated BOI data is unavailable. Expect extra scrutiny when:
- There are sudden or unexplained changes in the ownership structure
- Ownership involves out-of-state or offshore entities
- Owners refuse or delay providing personal identification or source-of-funds
- Discrepancies between state license filings and business-supplied ownership documentation
Financial institutions must remain diligent in updating suspicious activity report (SAR) protocols, escalating when evasiveness, document gaps, or ownership complexity exceed risk appetite.
Enforcement: What Risks Remain Without BOI?
While the requirement to file with FinCEN is gone, cannabis and hemp businesses remain subject to all existing:
- State licensing rules (most require ownership disclosures for licensees and renewal)
- Anti-Money Laundering (AML) obligations under the Bank Secrecy Act for financial sector entities
- Federal and state law enforcement scrutiny around false statements, wire fraud, and intentional concealment of corporate control
Cannabis businesses should not treat the FinCEN BOI reversal as permission to obscure true owners or beneficial interests. Noncompliance with KYC requests can still result in account denial, license revocation, or criminal investigation.
Timeline: Key Milestones in the 2025 BOI Rule Reversal
- Early 2025: Federal courts grant temporary injunctions/stays for BOI enforcement
- March 2, 2025: Treasury announces intent to retract U.S. company/person BOI reporting
- March 21, 2025: FinCEN publishes interim final rule ending BOI for U.S. entities
- March 26, 2025: Rule effective; BOI obligation for U.S. cannabis businesses officially withdrawn
Takeaways for Cannabis and Hemp Operators
- Regulators, banks, and service providers will expect even more proactive owner transparency from cannabis and hemp companies as institutional safety nets fall away.
- Every operator should invest in compliance and legal expertise to maintain robust, up-to-date owner documentation—even without a federal reporting mandate.
- Prepare to see banking relationships, lending, and payment processing dependent on the quality and credibility of self-supplied KYC/ownership data.
Questions about how to update your KYC or owner disclosure processes in the wake of the FinCEN 2025 BOI interim final rule? Connect with the compliance professionals at CannabisRegulations.ai for tailored checklists, documentation templates, and up-to-date regulatory guidance.
