Federal agencies still cannot reliably tell who ultimately owns or controls the companies they pay, and the regulation Congress ordered to fix that has slipped again. In GAO-26-108174, listed in GAO's reports feed on Sept. 30, 2026, the Government Accountability Office reports that the federal award process generally does not require beneficial-owner disclosure, and that the main government data source for it has just shrunk dramatically. The finding affects every contractor that bids on federal work, and every contracting officer who relies on self-reported ownership data.
The report, titled "Fraud in Federal Programs: Limited Beneficial Ownership Information Available on Awardees," lists Rebecca Shea as the GAO contact. GAO's conclusion is blunt about the current system: the federal award process collects ownership information in pieces, but not the piece that matters most for fraud detection.
What Does Federal Award Data Actually Capture About Owners?
GAO describes a patchwork. In its words, "The federal award process requires recipients to disclose some information on company owners and relationships, but it generally does not require disclosure of beneficial owner information."
The distinction matters. Awardees may report the names of officers and directors. Those people, GAO notes, may not be the beneficial owners or exercise substantial control over the entity. GAO defines beneficial ownership information as identifying the individuals who ultimately benefit from or control a company. A company can list a compliant slate of officers while the real decision-maker, or the real beneficiary of the payments, never appears in any award record.
Beneficial ownership data does exist elsewhere, but only to a limited extent. GAO identifies three places it can be found: the Treasury Department's Financial Crimes Enforcement Network (FinCEN) company registry, the General Services Administration's System for Award Management (SAM), and state incorporation registries. None of them gives an acquisition team a complete, verified picture of who stands behind an offeror.
How the FinCEN Registry Lost 99 Percent of Its Reporters
The most consequential finding for anyone hoping the gap would close on its own concerns the FinCEN registry. GAO reports that changes in the scope of reporting requirements now exempt domestic entities from reporting beneficial ownership information in that registry. In GAO's words, "This exemption removed about 99 percent of entities previously required to report."
That change undercuts the plan GSA had been weighing. GSA had considered using FinCEN's registry to develop a federal contractor ownership database. GAO now says that source is of limited use. GAO says it will continue to monitor progress on GSA's efforts, and its summary does not describe an alternative data source.
Why the 2021 FAR Case Keeps Missing Its Deadline
Congress addressed the contractor side directly in the FY2021 National Defense Authorization Act, which includes a provision for GSA to maintain a database of beneficial ownership information for federal contractors. A Federal Acquisition Regulation case followed. GAO writes: "A Federal Acquisition Regulation (FAR) case was opened in 2021 to implement this and other related provisions, but the FAR Council deadline to draft a proposed rule has been extended until at least September 2026."
The public regulatory record shows the same slippage. The Spring 2023 Unified Agenda entry on Reginfo.gov covers FAR Case 2021-005, RIN 9000-AO23, "Disclosure of Beneficial Owner in Federal Contracting." It states that DoD, GSA, and NASA are proposing to amend the FAR to implement sections 885 and 6403 of the FY2021 NDAA (Pub. L. 116-283). That entry projected a notice of proposed rulemaking in February 2024, with the comment period ending in April 2024. Paragraph (c) of section 6403 directs the FAR to be changed to require certain offerors to disclose beneficial ownership information in their offers for contracts over the simplified acquisition threshold.
Put plainly, a rule that Congress ordered in a law enacted for fiscal 2021 was targeted for a proposal in early 2024, and GAO reports the drafting deadline now sits at September 2026 at the earliest. The sources reviewed for this article do not show a proposed rule having been issued.
What Fraud Looks Like When Nobody Knows the Owner
GAO ties the disclosure gap to concrete schemes. Its review of federal cases highlights tactics such as stolen identities, shell companies, professional enablers, and pass-through billing schemes. Two examples illustrate the pattern:
- From July 2019 through January 2023, three purported hospice owners stole identities to register shell companies and defrauded Medicare for nearly $16 million.
- From June 2018 through September 2018, a foreign-based scam ring directed legitimate federal contractors to a fake government website, a pass-through billing scam that caused the government to misdirect $23.5 million to the fraudsters.
Those cases come from federal programs broadly rather than from procurement alone, but they show the mechanism GAO is worried about: a front that looks legitimate on paper, with the real beneficiary invisible to the paying agency.
GAO also analyzed federal award data to size the exposure. Its analysis points to hundreds of billions of dollars in awards that are vulnerable to beneficial-ownership-related fraud risk. Contracts awarded to foreign businesses are among the vulnerable categories GAO identifies.
One limit on the summary we reviewed: it does not list formal recommendations. GAO's stated next step is monitoring GSA's efforts, not directing a specific fix.
What It Means for Contractors
Nothing in GAO's summary of GAO-26-108174 creates a new obligation today. Based on the sources reviewed, the FAR change has not been finalized, and GAO describes the proposed-rule deadline as extended. But the direction of travel is clear, and contractors should plan for it rather than wait for a proposed rule to land.
Expect disclosure eventually. Paragraph (c) of section 6403 of the FY2021 NDAA, as described in the Unified Agenda entry, directs the FAR to require certain offerors to disclose beneficial ownership information on contracts above the simplified acquisition threshold. Firms with layered ownership, foreign investors, or private-equity structures should map who their beneficial owners are now, since the concept GAO uses centers on who ultimately benefits from or controls a company rather than on officer titles.
Do not assume FinCEN filings will cover you. With domestic entities exempt from registry reporting and about 99 percent of previously covered entities removed, a FinCEN filing is no longer a dependable source for proving ownership to a contracting officer. Any GSA database would need another data pipeline, which likely means information collected directly from contractors through SAM or the FAR.
Watch subcontracting and pass-through arrangements. GAO names pass-through billing and professional enablers as fraud tactics. Primes that rely on subcontractors, teaming partners, or intermediaries should expect closer questions about who sits behind those entities as oversight attention grows.
Track the regulatory clock. FAR Case 2021-005 has a history of slipped dates. GAO says it will continue to monitor progress on GSA's efforts, so further reporting on the status of the database and the rule is likely. Contractors that engage through trade associations or comment on any eventual proposed rule will have the best chance to shape definitions and compliance burdens.
