Opening Business Accounts: Documentation and Beneficial Ownership Rules

6/12/2026

Business account opening is where compliance, risk, and customer experience collide most directly. The documentation requirements are real, the customer is usually in a hurry, and the account being opened wrong is not discovered until a dispute, an examination, or a fraud loss.

This is the procedure in the order it should be performed.

Step 1: Identify the Entity Type

Everything downstream depends on this, and the customer is not always a reliable source — business owners routinely describe an LLC as a corporation or a partnership as a sole proprietorship.

Sole proprietorship. Not a separate legal entity; the individual and the business are the same person. Requires the owner's identification, the taxpayer identification number — which may be the owner's own — and documentation of any fictitious name or DBA registration so the bank can accept items payable to the trade name.

General partnership. Requires the partnership agreement where one exists, identification of the partners, and the entity's own taxpayer identification number.

Limited partnership or limited liability partnership. Requires the filed certificate and the agreement, with attention to which partners have authority to bind the entity.

Limited liability company. Requires the articles of organization, the operating agreement where one exists, and evidence of who may act — which for a manager-managed LLC is not necessarily the members.

Corporation. Requires the articles of incorporation, evidence of good standing, and a corporate resolution or equivalent authorizing the account and identifying authorized signers.

Nonprofit. Requires formation documents, evidence of tax-exempt status where claimed, and a resolution. Governance is frequently informal, and confirming who actually has authority takes more effort than with a for-profit entity.

Trust or estate. Requires documentation of the trustee's or personal representative's appointment — a certification of trust or letters of appointment rather than the full instrument in most cases.

Step 2: Verify Existence and Standing

For registered entities, confirm existence with the secretary of state or equivalent registry rather than relying on documents the customer supplies. Documents can be fabricated; a registry lookup is independent.

Check good standing, since an administratively dissolved entity may lack capacity to contract, and check that the name on the formation document matches the name on the account exactly — which is also what makes a later UCC filing effective if the relationship becomes a lending one.

Step 3: Establish Authority

Authority comes from the entity, not from the person presenting themselves.

Obtain the resolution, consent, or authorization identifying who may open the account, who may transact, and what limits apply. Record those individuals on the signature card, and configure the system to enforce any limits the resolution imposes — a two-signature requirement that exists only on paper is not a control.

Two habits worth building: ask who else in the business will need access, because the answer at opening prevents three subsequent visits; and ask whether anything should require two approvals, because the customer who says yes at opening is far easier to serve than the customer who wanted it after a fraud loss.

Step 4: CIP for the Entity and the Individuals

The Customer Identification Program applies to the entity as the customer — name, address, taxpayer identification number, and verification — and separately to the individuals opening the account, who are identified as a matter of prudent practice and, for beneficial owners, as a matter of requirement.

Step 5: Beneficial Ownership

For legal entity customers, the institution must identify and verify:

• The ownership prong — each individual owning, directly or indirectly, 25 percent or more of the equity interests
• The control prong — one individual with significant responsibility to control, manage, or direct the entity

Points that consistently cause difficulty:

There may be nobody under the ownership prong. A widely held entity may have no 25 percent owner. There is always exactly one individual under the control prong.

Indirect ownership requires working the chain. An individual holding 60 percent of a holding company that owns 50 percent of the customer holds 30 percent indirectly.

Verification is to the same standard as for individual customers, though the institution may generally rely on information provided by the person opening the account absent knowledge of facts calling it into question.

Certain entity types are excluded, including many regulated entities. Know which exclusions your procedures apply, and apply them consistently.

This is separate from the Corporate Transparency Act. The CDD rule obligates the bank to collect from the customer; the CTA created a separate regime obligating companies to report to FinCEN. Staff conflate them routinely, and changes to one do not change the other.

NOTE TO EDITOR: Corporate Transparency Act scope changed materially during 2025. Confirm the current position before this page says anything about CTA obligations.

Step 6: Tax Documentation

Obtain the taxpayer identification number and the certification — generally a Form W-9 — establishing the correct name and TIN combination and the entity's status for information reporting and backup withholding purposes.

TIN and name mismatches generate notices and potential backup withholding obligations, and they are almost always created at account opening by entering a trade name where the legal name belongs.

Step 7: Understand the Business

This is the step that gets skipped when the customer is in a hurry, and it is the one that everything later depends on.

Capture, in structured fields rather than free text: what the business actually does, its expected monthly deposit volume and composition, expected currency activity specifically, expected wire and ACH activity with counterparties and geographies, the source of funds, the number of locations and states of operation, and whether it serves businesses or consumers.

This becomes the customer risk profile that monitoring compares activity against. A profile recording "retail" makes every subsequent alert an investigation from zero.

Higher-Risk Business Types

Certain businesses are legitimate, bankable, and require enhanced treatment. Common categories include money services businesses, cash-intensive retail, professional service providers holding client funds, nonprofits with international disbursement, marijuana-related businesses where applicable, third-party payment processors, and businesses with complex or opaque ownership.

Enhanced treatment means more information at onboarding, senior approval, more frequent review, and monitoring calibrated to the category — not refusal. An institution that declines whole categories by policy should record that decision and apply it consistently, because inconsistent application creates its own problems.

Structured coverage is available through Deposit Accounts and Services, the Certificate in Deposit Compliance, and our BSA and AML training for the due diligence framework.

Making It Fast Without Making It Wrong

Business owners experience account opening as an obstacle, and the institutions that handle it best reduce friction without reducing documentation.

Tell the customer what to bring before they arrive. A one-page list by entity type, sent when the appointment is made, converts a two-visit process into one. This single practice does more for the customer experience than any procedural shortcut.

Do the registry lookup before the meeting. Confirming existence, good standing, and exact legal name takes two minutes and surfaces problems — an administratively dissolved entity, a name that does not match — while there is still time to resolve them.

Separate what blocks opening from what can follow. Identification, authority, beneficial ownership, and TIN certification generally must be complete. A copy of an operating agreement the customer left at the office frequently does not have to be, provided the institution's procedures permit a documented follow-up with a deadline and a tickler.

Do not let speed erode the profile. The expected-activity questions are the ones most likely to be skipped under time pressure, and they are the ones with the longest tail — every monitoring alert for the life of the relationship is measured against them. Asking them as a conversation about the business, rather than as a form, produces better answers in less time.

The framing worth giving staff: the documentation is not the bank protecting itself from the customer. Correct ownership and authority are what let the bank pay the right person and refuse the wrong one, and business owners understand that argument when it is made to them directly.

Refreshing the File After Opening

A business account opened correctly becomes a business account documented incorrectly, because businesses change and nothing in the workflow notices.

Four things drift, and each has a trigger worth building:

Authority. Officers leave, managers change, and partners exit. The resolution on file names people who no longer work there, and the bank continues honoring their instructions or refusing a legitimate one. Trigger: any signer change request should prompt a refreshed authorization rather than a card amendment, and annual review for larger relationships should confirm the resolution still reflects reality.

Beneficial ownership. Ownership shifts through sales, buyouts, new investors, and estate transfers. The obligation to identify beneficial owners attaches at opening and when the institution becomes aware of changes — and awareness depends on asking. Trigger: ownership confirmation at credit renewal, at any account maintenance touching ownership, and on a risk-based cycle.

The activity profile. A business that opened expecting $40,000 monthly deposits and now runs $400,000 has a monitoring baseline describing a company that no longer exists. Every alert is measured against a stale expectation, which produces both false positives and missed anomalies. Trigger: a profile refresh when actual activity diverges materially from expected, generated as an exception report rather than waiting for periodic review.

Entity standing. Businesses get administratively dissolved for failing to file, frequently without the owner realizing. A dissolved entity operating an account raises capacity questions that surface at the worst moment. Trigger: periodic registry re-check for entity customers, which is cheap to automate.

The pattern across all four is that the information decays silently and the institution only discovers it when the file is needed — at a dispute, an examination, or a fraud loss. Institutions that build the triggers spend a little continuously; those that do not spend a great deal at once.

Frequently Asked Questions

What documentation is needed to open a business account?

It depends on entity type. Sole proprietorships need owner identification, a TIN, and any DBA registration. LLCs need articles of organization and evidence of who may act. Corporations need articles of incorporation, good standing, and an authorizing resolution. Partnerships need the agreement and partner identification. All legal entities additionally require beneficial ownership information and tax certification.

Who counts as a beneficial owner of a business account?

Under the ownership prong, any individual owning 25 percent or more of the equity interests directly or indirectly. Under the control prong, one individual with significant responsibility to control, manage, or direct the entity. There may be no one meeting the ownership prong, but there is always exactly one individual under the control prong.

Is beneficial ownership the same as the Corporate Transparency Act?

No. The customer due diligence rule requires banks to collect beneficial ownership from legal entity customers at account opening. The Corporate Transparency Act established a separate regime requiring companies themselves to report to FinCEN. They are distinct obligations, and changes to the CTA's scope do not change what banks must collect.

Should the bank verify the entity with the state registry?

Yes. Documents the customer supplies can be fabricated, while a registry lookup is independent and takes two minutes. It confirms existence, good standing — an administratively dissolved entity may lack capacity to contract — and the exact legal name, which also matters later if the relationship becomes a lending one requiring a UCC filing.

Can a bank refuse to open accounts for certain business types?

It can decline categories as a matter of documented, consistently applied policy. What creates problems is inconsistent application — serving some money services businesses and not others without a recorded basis. The alternative to refusal is enhanced due diligence, senior approval, and monitoring calibrated to the category, which is how most legitimate higher-risk businesses are banked.

What is the most commonly skipped step?

Understanding the business — capturing expected deposit volume, currency activity, wire and ACH patterns, geographies, and source of funds in structured fields. It gets skipped under time pressure and it has the longest tail, because every monitoring alert for the life of the relationship is measured against that profile. A profile recording only "retail" makes every future alert an investigation from zero.