Fraud in Federal Programs: Limited Beneficial Ownership Information Available on Awardees

TL;DR

GAO found that illicit actors use stolen identities, shell companies, professional enablers, and pass‑through billing schemes to hide beneficial ownership and fraudulently access federal awards, including contracts, grants, and Medicare payments. Beneficial ownership information is available only in limited sources (FinCEN’s company registry, GSA (General Services Administration)’s System for Award Management, and state incorporation registries), and recent changes exempt domestic entities from FinCEN reporting, removing about 99 percent of entities previously required to report. The National Defense Authorization Act for Fiscal Year 2021 requires GSA to maintain a beneficial ownership database for federal contractors; a FAR (Federal Acquisition Regulation) case was opened in 2021, and the FAR Council deadline to draft a proposed rule has been extended until at least September 2026. GAO highlights hundreds of billions of dollars in awards vulnerable to beneficial ownership–related fraud and cites concrete fraud examples totaling millions of dollars. Immediate implications: contract award and compliance teams must tighten due diligence on ownership, monitor GSA rulemaking and SAM data quality, and update capture and subcontracting controls to mitigate exposure.

Key Points

• What happened: GAO’s review found illicit actors hide beneficial ownership through stolen identities, shell companies, professional enablers, and pass‑through billing schemes, enabling fraud against federal awards and programs.
• Who is affected: Healthcare Services, Professional Services, IT Services, Grants Management, Federal Contracting, Shell Companies, Foreign Entities; NAICS codes 621610, 541990, 541611, 541219, 561110, 523999; agencies: GSA, DOD, HHS, Treasury, DOJ; contract vehicle: SAM.
• Timeline: GAO cites fraud examples from July 2019–January 2023 and June–September 2018; a FAR case was opened in 2021 and the FAR Council deadline to draft a proposed rule is extended until at least September 2026. Other timing for FinCEN scope changes is described in GAO’s report.
• What contractors should do NOW: review and harden beneficial‑ownership due diligence for prime and subcontractors, validate and update SAM registrations, flag high‑risk award categories for enhanced review, document ownership verification in capture files, and monitor GSA/FAR rulemaking and GAO follow‑up.

Who Is Affected

Specific NAICS codes, agencies, and contract vehicles pending source review.

• Market segments explicitly identified: Healthcare Services; Professional Services; IT Services; Grants Management; Federal Contracting; Shell Companies; Foreign Entities.
• Explicitly named NAICS codes: 621610, 541990, 541611, 541219, 561110, 523999.
• Explicitly named agencies: GSA, DOD, HHS, Treasury, DOJ.
• Explicitly named contract vehicle/data source: SAM.
• Compliance surfaces called out: FAR; System for Award Management (SAM); FinCEN Beneficial Ownership Reporting; Corporate Transparency Act.

Frequently Asked Questions

Q: Does federal award reporting currently require beneficial ownership disclosure?

A: Generally, no. The federal award process collects some ownership and relationship information (for example, officers and directors) but generally does not require disclosure of beneficial owners. GAO notes beneficial ownership information is available only to a limited extent in FinCEN’s company registry, GSA’s SAM, and state incorporation registries—and changes in FinCEN’s reporting scope exempt domestic entities, removing about 99 percent of entities previously required to report.

Q: What is the government doing to improve access to beneficial ownership data?

A: The National Defense Authorization Act for Fiscal Year 2021 includes a provision for GSA to maintain a beneficial ownership database for federal contractors. A FAR case was opened in 2021 to implement this and related provisions; the FAR Council deadline to draft a proposed rule has been extended until at least September 2026. GAO will continue to monitor GSA’s progress.

Q: How large is the fraud exposure GAO identified?

A: GAO’s analysis highlights hundreds of billions of dollars in awards vulnerable to beneficial ownership–related fraud risks. The report cites concrete fraud examples—one Medicare fraud scheme (July 2019–January 2023) resulting in nearly $16 million, and a pass‑through billing scam (June–September 2018) that misdirected $23.5 million.

Definitions

• Beneficial ownership information: Information that identifies the individuals who ultimately benefit from or control a company.
• Pass‑through billing: A fraud tactic described by GAO in which illegitimate actors route payments through intermediaries or fake channels to misdirect funds from legitimate federal awards.

Intelligence Response

• Cabrillo Signals War Room — Already detected this event and delivered this briefing. Continuously monitors regulatory changes, contract vehicles, and policy shifts, and has flagged the GAO finding for immediate dissemination.
• Cabrillo Signals Match Engine — Automatically rescored opportunity pipelines and risk profiles where beneficial ownership disclosure gaps change competitive posture or create compliance risk.
• Cabrillo Signals Intelligence Hub — Tracking the named agencies, NAICS codes, and SAM‑related notices. Saved searches set to alert when GSA or FAR rulemaking, SAM updates, or related solicitations appear.
• Proposal Studio (Proposal OS) and Proposal Studio Workflow Tracker — Use Proposal OS to insert updated compliance matrices and ownership verification requirements into capture artifacts; use Workflow Tracker to route capture and compliance approvals through a 9‑gate process and maintain audit‑ready documentation.

Who to notify:

• Capture Manager / Capture Lead — align bid/no‑bid decisions and subcontractor screening.
• Proposal Manager — update RFP checklists and compliance matrices.
• Contracts/Compliance Officer — verify SAM registrations and ownership disclosures.
• Security/Legal Counsel — assess exposure and documentation for audits and investigations.
• Finance/CFO — review payment controls and billing oversight for high‑risk awards.

First 48‑hour playbook

• Hour 0–4: Activate Incident & Capture Notification. Notify Capture Lead, Contracts/Compliance Officer, Proposal Manager, and Security/Legal Counsel. Push briefing via Cabrillo Signals War Room.
• Hour 4–12: Run rescore in Cabrillo Signals Match Engine on active opportunity pipeline; flag high‑risk awards and primes/subs. Verify SAM registrations for active pursuits via Cabrillo Signals Intelligence Hub saved searches.
• Hour 12–24: Update capture files with ownership verification requirements in Proposal Studio (Proposal OS). Route required approvals and audit trails through Proposal Studio Workflow Tracker.
• Hour 24–48: Begin targeted outreach to flagged primes/subcontractors to request documented beneficial‑ownership verification; update risk registers and prepare notice for executive leadership. Monitor GAO follow‑ups and GSA/FAR rulemaking via Signals Intelligence Hub.

Resources and internal guidance:

• Primary hub: Secure Operations Guide (/insights/secure-operations-guide)
• Related guides:
• CMMC (Cybersecurity Maturity Model Certification) Compliance Guide (/insights/cmmc-compliance-guide)
• CUI (Controlled Unclassified Information)-Safe CRM Guide (/insights/cui-safe-crm-guide)