Beneficial Ownership Under the CDD Rule: What Banks Must Collect

8/29/2026

Few BSA topics have generated as much confusion over the last few years as "beneficial ownership." Part of the reason is that the phrase now describes two different obligations owned by two different parties. One is a bank obligation: the customer due diligence (CDD) rule requires banks to identify and verify the people who own and control their legal entity customers. The other was a company obligation: the Corporate Transparency Act (CTA) required many businesses to file beneficial ownership information (BOI) reports directly with FinCEN.

The second regime has been cut back dramatically. The first has not gone away, although it was loosened in 2026. Account-opening staff and compliance analysts who lump the two together end up making one of two mistakes: telling customers they need to file something with FinCEN that they no longer do, or assuming the bank no longer has to collect ownership information because "FinCEN dropped beneficial ownership." Both are wrong.

This post explains what the bank-side rule actually requires, what changed in 2026, and how to keep it separate from CTA reporting.

Where the bank requirement comes from

The beneficial ownership requirement for banks sits in FinCEN's regulations at 31 CFR 1010.230, titled "Beneficial ownership requirements for legal entity customers." It was adopted as part of the 2016 CDD final rule and became applicable on May 11, 2018. The same rulemaking added the so-called fifth pillar to the bank AML program rule at 31 CFR 1020.210: risk-based procedures for ongoing customer due diligence, including understanding the nature and purpose of customer relationships to build a customer risk profile, and ongoing monitoring that maintains and updates customer information on a risk basis. The program rule states that "customer information" for these purposes includes information about the beneficial owners of legal entity customers.

So beneficial ownership is not a standalone form. It is one component of the bank's CDD procedures, and those procedures sit inside the board-approved BSA/AML program. That structure matters at examination: the FFIEC BSA/AML Examination Manual's program procedures ask whether the bank's CIP, risk-based CDD, and beneficial ownership procedures are all included as part of the program. If you need the wider picture first, our Bank Secrecy Act explainer walks through how these pieces stack.

Who counts as a "legal entity customer"

The rule only applies to legal entity customers, and the definition is narrower and more specific than "any business."

Under 1010.230(e)(1), a legal entity customer is a corporation, limited liability company, or other entity created by filing a public document with a Secretary of State or similar office, a general partnership, and any similar entity formed under foreign law that opens an account.

That definition leaves out several common account types:

• Sole proprietorships are not legal entities separate from the owner, so the owner is your customer under CIP.
• Unincorporated associations that are not created by a state filing fall outside the definition.
• Trusts, other than statutory trusts created by a filing with a Secretary of State, are generally outside it. (Trust ownership of a legal entity customer is handled separately, below.)

The rule then lists exclusions in 1010.230(e)(2). Among them: financial institutions regulated by a federal functional regulator and state-regulated banks; issuers of securities registered under section 12 of the Securities Exchange Act or required to file reports under section 15(d); SEC-registered investment companies and investment advisers; CFTC-registered entities; state-regulated insurance companies; bank holding companies and savings and loan holding companies; PCAOB-registered public accounting firms; certain foreign financial institutions where the home regulator maintains ownership information; non-U.S. governmental bodies engaged only in governmental activities; and, to the extent it opens a private banking account subject to 1010.620, any legal entity (because private banking accounts have their own ownership rules).

Two categories are subject to the control prong only: pooled investment vehicles operated or advised by a non-excluded financial institution, and nonprofit corporations or similar entities that have filed organizational documents with the appropriate state authority.

There are also narrow account-level exemptions in 1010.230(h): point-of-sale retail credit accounts up to $50,000, and certain accounts that finance postage, insurance premiums, or equipment purchases or leases where the bank pays the vendor directly. Those exemptions do not apply to transaction accounts that let the customer pay or receive funds from third parties, and if a cash refund is possible, beneficial ownership has to be collected at remittance or refund.

Your procedures should name which exclusions and exemptions the bank applies and how staff evidence them. "Customer is publicly traded" with no record of how that was confirmed is a common testing exception.

The two prongs

Section 1010.230(d) defines a beneficial owner as each of the following.

The ownership prong

Each individual, if any, who directly or indirectly, through any contract, arrangement, understanding, relationship or otherwise, owns 25 percent or more of the equity interests of the legal entity customer.

The words "if any" are doing real work. A company with five equal owners at 20 percent each has no one who meets the ownership prong. The regulation's note confirms that up to four individuals may need to be identified under this prong, depending on the facts.

"Directly or indirectly" means staff must work through layers. If an individual owns 50 percent of a holding company that owns 60 percent of the customer, that individual indirectly holds 30 percent of the customer and is a beneficial owner. Front-line staff do not need to be corporate lawyers, but they do need a procedure for when the person opening the account lists another entity as an owner.

If a trust owns 25 percent or more, the beneficial owner for ownership-prong purposes is the trustee. If an excluded entity from the (e)(2) list owns 25 percent or more, no individual has to be identified for that entity's interest.

The control prong

A single individual with significant responsibility to control, manage, or direct the legal entity customer. The rule gives examples: an executive officer or senior manager such as a CEO, CFO, COO, managing member, general partner, president, vice president or treasurer, or any other individual who regularly performs similar functions.

There is always exactly one control-prong individual. That person may also be an ownership-prong owner, and the regulation notes the same person can appear under both. A bank may also choose, on the basis of risk, to identify more people than the minimum.

Prong	Threshold	How many	Common mistakes
Ownership	25% or more of equity, direct or indirect	Zero to four individuals	Stopping at the first layer of ownership; recording an entity instead of the individual behind it
Control	Significant responsibility to control, manage, or direct	Exactly one individual	Leaving it blank when no one meets the ownership prong; naming an outside attorney or registered agent

 

Identification versus verification

The rule splits the obligation in two, and they carry different standards.

Identification (1010.230(b)(1)). The bank obtains the beneficial owner information either by using the certification form in Appendix A of the section, signed by the individual opening the account on behalf of the entity, or by obtaining the same information by another means, provided the individual certifies to the best of their knowledge that it is accurate. Many banks now capture this in their account-opening platform rather than on the paper form; that is permitted as long as the certification element is there.

Verification (1010.230(b)(2)). The bank verifies the identity of each beneficial owner identified, using risk-based procedures to the extent reasonable and practicable. At a minimum, those procedures must contain the elements required for verifying individual customers under the bank CIP rule at 31 CFR 1020.220(a)(2). One difference from CIP: for documentary verification, the bank may use photocopies or other reproductions of identity documents.

Note what the bank is verifying. It is verifying the identity of the individuals named, not independently verifying that they are, in fact, the owners. The rule says the bank may rely on the information supplied by the legal entity customer about who its beneficial owners are, provided it has no knowledge of facts that would reasonably call that information into question. If the operating agreement in the file shows a different ownership split from the certification, the bank has knowledge, and it needs to resolve the discrepancy.

For the CIP standards that verification borrows from, see our post on KYC and customer due diligence.

Recordkeeping

Under 1010.230(i), the bank must keep a record of:

• For identification: the identifying information obtained, including the certification if one was obtained. Retain for five years after the account is closed.
• For verification: a description of any document relied on (type, identification number, place of issuance, and issue and expiration dates if any), any non-documentary methods and their results, and the resolution of each substantive discrepancy. Retain for five years after the record is made.

The two different retention clocks trip people up in record-destruction schedules. The identification record lives as long as the account plus five years; the verification record runs from creation.

What changed in 2026: the account-opening relief order

As originally written, the regulation required identification and verification "at the time a new account is opened," and FinCEN treated each new account as a new account. An existing business customer opening a second deposit account or a new loan had to recertify each time, subject to some 2018 relief for specific rollovers and renewals.

On February 13, 2026, FinCEN issued an exceptive relief order (FIN-2026-R001) covering banks and certain other covered financial institutions. Under the order, a bank may identify and verify the beneficial owners of a legal entity customer:

1. When the customer first opens an account with the institution;
2. When the bank has knowledge of facts that would reasonably call into question the reliability of beneficial ownership information it previously obtained; and
3. As otherwise required under the bank's risk-based procedures for ongoing customer due diligence.

In other words, recertifying at every additional account opening is no longer mandatory. FinCEN then consolidated and reissued its CDD rule FAQs in May 2026 to reflect the order. The FAQs make clear that using the relief is at the institution's discretion, and they confirm that a bank can rely on beneficial ownership information it already holds, for example where the customer confirms the information on file is still current and accurate.

Three points to keep straight about the order:

• It is relief, not a rule change. The text of 1010.230 has not been amended. The order grants an exception from part of it. Your procedures should cite the order if you rely on it.
• It is optional. A bank can keep collecting at every account opening if that fits its risk profile or systems. What matters is that the procedure says which approach applies and staff follow it.
• It shifts the burden to your ongoing CDD. If the bank no longer refreshes ownership at each new account, its event triggers and risk-based refresh cycle are now the main way ownership information stays current. A bank that adopts the relief without strengthening its triggers will have stale ownership data and no account-opening backstop.

FinCEN has also said it still expects to revise the CDD rule itself, as the CTA directs. As of this writing no revised CDD rule has been finalized, so watch the Federal Register and FinCEN's site rather than relying on summaries.

How the CDD rule differs from Corporate Transparency Act reporting

This is the distinction staff most need to get right.

	CDD rule (bank obligation)	CTA BOI reporting (company obligation)
Who must act	The bank	The reporting company itself
Legal basis	31 CFR 1010.230, BSA program rule	Corporate Transparency Act, FinCEN reporting rule at 31 CFR 1010.380
What is collected	Owners at 25%+ and one control person, certified at account opening	Beneficial owners and company applicants reported to FinCEN
Current status	In force; February 2026 relief narrows when it must be repeated	U.S. companies and U.S. persons permanently exempt under a final rule effective August 14, 2026
Who sees it	The bank, examiners, law enforcement via BSA process	FinCEN database

 

The CTA regime was narrowed in stages during 2025 and then, on August 11, 2026, Treasury announced a final rule, effective August 14, 2026, that permanently removes BOI reporting requirements for U.S. companies and U.S. persons. Under that rule, only entities formed under foreign law and registered to do business in a U.S. state or tribal jurisdiction remain reporting companies, and they do not have to report U.S. persons as beneficial owners. FinCEN also said it will delete information reasonably identified as belonging to U.S. persons from the database.

None of that changes the bank's own obligation. A domestic LLC that never has to file a BOI report with FinCEN still has to provide beneficial ownership information to your bank when it first opens an account. Practical consequences:

• Do not ask domestic customers for a FinCEN BOI filing as a substitute for your own certification. Most will not have one, and you are not permitted to outsource your CDD obligation to a FinCEN database anyway.
• Train staff on a short script. Customers who read headlines that "beneficial ownership reporting is gone" will push back. The answer is that the government filing changed; the bank's account-opening requirement did not.
• Check your forms and website copy. Account-opening materials written in 2024, when banks were fielding CTA questions, may now contain outdated statements about FinCEN filing deadlines.

Building the procedure

A workable beneficial ownership procedure usually covers the following:

4. Which customer types are legal entity customers, which exclusions and account exemptions the bank applies, and what evidence supports each exclusion (exchange listing, regulator lookup, charter).
5. Collection method. Appendix A form or electronic equivalent, with the certification statement intact, and who may certify (someone with authority to open the account).
6. Ownership analysis. How staff handle layered ownership, trusts, and entities listed as owners. When to escalate to BSA staff.
7. Documentary and non-documentary methods, by reference to the CIP procedures, with a time frame consistent with CIP.
8. What counts as a substantive discrepancy, who resolves it, and how the resolution is recorded.
9. Relief order election. Whether the bank uses the February 2026 order, and if so, what triggers re-collection (ownership change notices, signer changes, adverse media, unusual activity, risk-rating changes, periodic review).
10. Failure to obtain. What happens when the customer will not or cannot provide the information: do not open, restrict, close, and consider a SAR.
11. Records and retention. Both retention clocks, and where records live.
12. Quality control. Sampling of new legal entity files, with results reported to the BSA officer.

The trigger list in step 6 deserves the most attention in 2026. It is now the main control keeping ownership data current for banks that adopt the relief.

Where beneficial ownership fails at examination

The issues that come up most often in independent testing and exams are predictable:

• Control prong left blank because no one met the 25 percent ownership threshold.
• Entity named as owner with no look-through to the individuals behind it.
• Certification missing or signed by someone without authority to open the account.
• Verification undocumented for one of several owners, typically the one who was not present at account opening.
• Exclusions applied without evidence, especially "public company" and "regulated financial institution."
• No trigger process, so ownership changes the bank learns about through loan documents or wire activity never make it back to the customer record.
• Conflation with the CTA, visible in procedures or customer letters that refer to FinCEN filings as if they were the bank's requirement.

Most of these are training problems as much as procedure problems. Account-opening staff need to understand why the control prong is always required and why a holding company is never the answer to "who owns this business." Our Certificate in BSA and AML Compliance covers the CDD framework within the wider BSA/AML program, and you can browse the full range of Bank Secrecy Act training. For the account-opening workflow itself, see our guide to opening business accounts.

Bringing it together

The bank's beneficial ownership obligation is narrower than it was a year ago, but it is still there and still examined. Collect it when a legal entity customer first opens an account, verify the identity of each person named, refresh it when your triggers fire, and keep it distinct from the CTA reporting regime that no longer applies to domestic companies. If your staff need a structured grounding in how CDD fits the five-pillar program, the Certificate in BSA and AML Compliance is the place to start.

Frequently Asked Questions

Does the CDD rule still require banks to collect beneficial ownership information?

Yes. The requirement at 31 CFR 1010.230 remains in force. What changed in February 2026 is when it must be repeated: under FinCEN's exceptive relief order, a bank may identify and verify beneficial owners when a legal entity customer first opens an account, when it has facts that call prior information into question, and as its risk-based ongoing CDD procedures require, rather than at every new account. Using that relief is optional, and a bank that adopts it should strengthen the event triggers that prompt a refresh.

What is the difference between FinCEN beneficial ownership reporting and the CDD rule?

The CDD rule is a bank obligation: the bank collects ownership and control information from legal entity customers at account opening. Beneficial ownership information reporting under the Corporate Transparency Act was a company obligation to file with FinCEN. A final rule effective August 14, 2026 permanently exempts U.S. companies and U.S. persons from that reporting, leaving only certain foreign-formed entities. The bank's own CDD collection obligation was not affected.

Who is a beneficial owner under the CDD rule?

Two groups. Under the ownership prong, each individual who directly or indirectly owns 25 percent or more of the equity interests, which may be anyone from zero to four people. Under the control prong, exactly one individual with significant responsibility to control, manage, or direct the entity, such as a CEO, CFO, managing member, general partner, president, or treasurer. The same person can satisfy both prongs.

Are sole proprietorships and trusts legal entity customers?

Generally no. The rule covers corporations, LLCs, and other entities created by filing a public document with a Secretary of State or similar office, general partnerships, and similar foreign entities. A sole proprietorship is not a separate legal entity, so the owner is handled under CIP. Most trusts are not created by such a filing. However, if a trust owns 25 percent or more of a legal entity customer, the trustee is treated as the beneficial owner for ownership-prong purposes.

Do banks have to verify that the named people really own the company?

The rule requires the bank to verify the identity of each beneficial owner identified, using procedures that contain at least the CIP elements for individuals. It does not require independent proof of the ownership percentages. The bank may rely on the customer's certification unless it has knowledge of facts that would reasonably call that information into question, such as organizational documents showing a different ownership split. In that case the discrepancy must be resolved and documented.

How long must beneficial ownership records be kept?

Identification records, including the certification, must be retained for five years after the account is closed. Verification records, describing the documents or non-documentary methods used and how any substantive discrepancy was resolved, must be retained for five years after the record is made. Record-destruction schedules should reflect both clocks separately.