Anyone who wins a federal contract, grant or Medicare payment can still hide who actually owns and controls the company, and fraudsters are using that gap. A new Government Accountability Office report, summarized by Legis1, finds that hundreds of billions of dollars in federal awards are exposed to schemes built on stolen identities, shell companies, professional enablers and pass-through billing. The report also finds that the government's best hope for a fix is still stuck in rulemaking, years after Congress ordered one.
The core finding is structural, not a lapse at one agency. As Orange Slices AI reported, GAO found that federal award reporting requirements do not explicitly require entities to provide beneficial ownership information. It also found no central repository holding that information for businesses that receive federal awards.
How Shell Companies Pulled $16 Million From Medicare and Diverted $23.5 Million in Contract Payments
Legis1 describes two schemes from the GAO report, and they show two different ways hidden ownership turns into lost federal money.
In the first, three purported hospice owners stole identities to register shell companies. They then defrauded Medicare of nearly $16 million between July 2019 and January 2023, according to the Legis1 account of the report. Because the shell companies were registered with stolen identities, a vetting process that relies on the owners named in registration records has little to catch.
The second scheme did not need a fake contractor at all. A foreign-based scam ring and U.S.-based conspirators directed legitimate federal contractors to a fake government website. That caused the government to misdirect $23.5 million to the fraudsters between June 2018 and September 2018. This is the pass-through pattern: legitimate vendors on one end, and a payment stream that ends up with people the government never vetted.
Legis1 names the common thread: the federal award process generally does not require disclosure of who a contracting entity's beneficial owners actually are, and that gives fraudsters "a structural opening to exploit."
Why SAM and State Registries Miss the Real Owners
Beneficial ownership means the individuals who ultimately benefit from or control a company. That is not always the person named in state incorporation records. Agencies may collect the names of corporate officers and directors during the award process, but Legis1 notes those people "may not be the beneficial owners or exercise substantial control over the entity."
The report points to three places where some beneficial ownership data exists: the Treasury Department's Financial Crimes Enforcement Network (FinCEN) company registry, the General Services Administration's System for Award Management (SAM), and state incorporation registries. Legis1 says the data is available only to a limited extent across them. Orange Slices reports that SAM includes information on corporate relationships, but GAO notes it generally does not identify the individuals who ultimately own or control a company.
GAO also noted that awards such as contracts to foreign businesses are among the categories vulnerable to beneficial ownership fraud risks.
The FinCEN Exemption That Removed 99 Percent of Reporting Entities
A big blow to federal vetting came from outside procurement. Changes in the scope of FinCEN's reporting requirements now exempt domestic entities from reporting beneficial ownership information to the registry. According to the Legis1 summary of GAO's findings, that change removed about 99 percent of the entities previously required to report, which leaves the registry of limited use.
That matters because GSA had considered using FinCEN's registry to build its contractor ownership database. With that source now of limited use, the data GSA considered relying on no longer covers nearly all of the entities that used to report.
Section 885 and FAR Case 2021-005: Years Without a Rule
Congress addressed the gap in the Fiscal Year 2021 National Defense Authorization Act. Section 885 of that law directed GSA to include beneficial ownership information for certain federal contractors and grant recipients in a federal database, Orange Slices reports.
The requirement has not been fully implemented. GAO reports that GSA is waiting on rulemaking under FAR Case 2021-005, which was opened in 2021 to carry out the provision and related ones. According to Legis1, the FAR Council's deadline to draft a proposed rule has been extended until at least September 2026. That month has now passed, and neither source reports a proposed rule.
GAO stated it will continue to monitor progress on GSA's efforts to implement the statutory provision. Legis1's assessment of where that leaves things is blunt: "Until a centralized, reliable source of beneficial ownership data exists for federal award vetting, the structural gap the report describes will remain." The outlet adds that the FAR rulemaking is the most immediate mechanism for change, but its repeated deadline extensions suggest the timeline is not fixed.
What It Means for Contractors
Nothing changes on a compliance checklist this week. "For GovCon executives, there is no new reporting requirement coming out of this report," Orange Slices AI wrote.
The direction of travel is clear, though. Congress has already directed GSA to maintain a beneficial ownership database for contractors. A FAR case to implement it is open. GAO has now tied the missing data to specific losses of federal money and said it will keep watching. Orange Slices notes that this combination makes the issue worth understanding, particularly for firms in the small business and set-aside markets.
Practical steps for contractors follow from that:
- Map your own ownership chain now. Firms with holding companies, private equity investors, or trusts in their structure should be able to name the individuals who ultimately own or control the entity. If the FAR case produces a proposed rule, that is likely the information it will ask for.
- Watch FAR Case 2021-005. A proposed rule would normally open a public comment period. That is the point where contractors can shape how much detail is collected, how it is verified, and who can see it.
- Tighten payment-change controls. The $23.5 million scheme involved legitimate contractors steered to a fake government website, not shell firms. Verify any request to change remittance details or log in to a government portal through a known, independent channel before acting on it.
- Expect more scrutiny of set-aside eligibility. Ownership and control already decide eligibility in many small business programs. Better beneficial ownership data could give agencies and competitors a new way to test those claims.
Until the FAR Council moves, agencies will keep vetting awardees with data sources that, per the GAO report as Legis1 summarizes it, provide beneficial ownership information only to a limited extent.
