Provisions in the annual defense-policy legislation would require many U.S. companies to register their true owners—an attempt to discourage the use of anonymous shell companies for illicit means. The law also would pave the way for a new whistleblower program aimed at encouraging people to report potential violations of anti-money-laundering laws.

The Senate voted 81-13 on Friday to override President Trump’s veto of the bill, which sets spending for defense operations and national-security programs for the 2021 fiscal year. The president’s objections were unrelated to the anti-money-laundering measures. The House had previously voted 322 to 87 to override the veto.

“Anonymous shell companies where the true beneficial owners are unknown is the biggest weakness in our anti-money-laundering safeguards,” said Clark Gascoigne, a senior policy adviser at the Financial Accountability and Corporate Transparency Coalition, a Washington-based group that has pushed for ownership disclosures.

Many companies aren’t currently under any federal obligation to identify the true beneficiaries of their operations. And many states’ rules have enabled owners to obscure their identities through shell companies or through agents who register companies on the owners’ behalf.

Required ownership disclosures will help prevent terror groups, drug cartels or other bad actors from using shell companies to move money to support their operations, experts say. “It’s the single most important step we could have taken to better protect our financial system from abuse,” Mr. Gascoigne said, referring to the passage of the legislation.

The Treasury Department has a year to issue regulations detailing how companies would comply. Once the regulations are in place, many companies created in the U.S. would have to disclose the name, birth date, address and a government-issued identification number—such a driver-license number or passport number—of the company’s beneficial owners. Existing companies are expected to have up to two years to comply after the regulations are in place.

The information, to be kept in a registry by the Treasury’s Financial Crimes Enforcement Network, wouldn’t be available to the public. But federal law enforcement would have access to the data. Financial institutions would too, but with customer consent.

Publicly listed companies and many firms regulated by the federal government wouldn’t have to report. Nor would companies with more than 20 full-time employees, $5 million in annual sales and a physical place of business.

The National Federation of Independent Business, which opposed the legislation, says the rules unfairly burden small, legitimate companies with added paperwork and the risk of penalties for noncompliance.

The Washington-based group estimates that complying would take most companies about 30 minutes. “But it is one more piece of paperwork on a pile that’s already pretty high from a small-business owner’s perspective,” said Kevin Kuhlman, the NFIB’s vice president of federal government relations.

Disclosing more information to more agencies could increase privacy risks for businesses, Mr. Kuhlman said. The Treasury suffered a recent leak of suspicious activity reports, he noted, and its email accounts were said to be breached as part of a recent hacking effort targeting several federal agencies.