Customer due diligence requirements depend on who is performing the review and why. A covered financial institution has regulatory duties. An operating company may need to supply information to its bank, meet a contract requirement or assess a counterparty’s risk. Those situations can involve similar documents without imposing identical obligations.
The first question is therefore the source of the request. Is the information required by law, the institution’s procedures or the terms of a commercial relationship? Clarifying that point helps a business respond accurately and avoid treating every document request as a universal legal rule.
This guide explains the U.S. CDD framework and the main distinctions for operating businesses. Compliance Officers can help define the review and organize the supporting evidence. Specific legal obligations require assessment against the business, activity and facts involved.
Who has customer due diligence requirements under the CDD Rule?
FinCEN’s CDD Rule applies to covered financial institutions. These include the specified banks and credit unions, securities brokers and dealers, mutual funds, futures commission merchants and introducing brokers in commodities. The rule does not automatically apply to an ordinary trading company because it has customers.
However, that distinction does not establish that a business has no other compliance duties. Its activities may fall under other laws, industry rules or contractual obligations. Sanctions restrictions also require separate consideration.
The FinCEN CDD FAQs explain the covered institutions and relevant exclusions. The framework includes customer identification, beneficial-owner identification and identity verification, understanding the relationship, and ongoing monitoring.
Our guide to the FinCEN CDD Rule provides further context. A business responding to its bank should distinguish the bank’s regulatory responsibility from the information the business must provide to maintain that relationship.
Customer due diligence requirements and commercial requests
A document request can have more than one basis. For example, a bank may need beneficial-owner information under its regulatory procedures. It may also ask for additional evidence because of the account’s risk or an inconsistency in the file.
| Source | What it may require | What to clarify |
|---|---|---|
| CDD Rule | Checks by covered institutions, subject to exclusions and exemptions | Whether the institution, customer and account are covered |
| Institution policy | Additional information under risk-based procedures | The purpose and acceptable supporting evidence |
| Contract | Representations, disclosures or updates agreed by the parties | The actual terms and applicable law |
| Sanctions rules | Compliance with applicable prohibitions and restrictions | The program, parties, ownership and transaction |
| Commercial review | Evidence needed for a business decision | The scope, limits and risk being assessed |
This distinction helps when onboarding pauses over a missing record. The business can seek clarification about the required evidence and whether an alternative addresses the same question. A provider cannot guarantee that a bank will accept a particular document.
Our corporate KYC guide discusses organizing a company file. The labels KYC and CDD should not replace a clear explanation of the actual checks and obligations.
Ownership and control are separate questions
Under 31 CFR 1010.230, the ownership prong generally identifies individuals with at least 25 percent of the legal entity customer’s equity, directly or indirectly. The control prong identifies one individual with significant responsibility to manage, direct or control the entity.
The same person may satisfy both prongs. However, an ownership position does not automatically explain operational control. The person identified under the control prong should fit the regulatory definition, rather than merely hold a convenient title.
Exclusions, account exemptions and special entity rules can affect the analysis. For example, some customers are subject only to the control prong. The rule should not be reduced to a statement that every entity always needs the same list of people.
Trust ownership requires separate attention. FinCEN provides rules concerning trustees, including multiple trustees and entity trustees. A trust arrangement should be assessed under the relevant provisions instead of assuming that every beneficiary must appear on the same form.
The beneficial-owner guide explains how ownership and control can differ. State formation records, internal documents and the applicable definition each have a role in understanding the file.
What identity verification does and does not require
The rule distinguishes obtaining beneficial-owner information from verifying the identified person’s identity. FinCEN permits reliance on customer-supplied information about beneficial-owner status when the institution has no facts reasonably calling its reliability into question.
Consequently, the rule does not always require an independent investigation of the entire ownership structure. That is different from saying a signed form resolves every concern. Known inconsistencies and the institution’s risk procedures can call for additional work.
For example, a record may identify a person in a role that conflicts with the customer’s explanation. The institution should address the discrepancy under its procedures. The existence of a discrepancy is a reason to examine the evidence, rather than proof that the customer acted dishonestly.
Collecting documents without understanding their purpose can leave the real question unanswered. A certificate of formation addresses formation. It does not necessarily establish the current owners, control person or authority to sign a particular contract.
What changed in February 2026?
FinCEN’s February 13, 2026 exceptive-relief order changed the trigger for repeating certain beneficial-owner checks. A covered institution may use the relief instead of identifying and verifying owners every time an existing legal entity customer opens another account.
The order retains checks when the customer first opens an account, when facts reasonably question prior information, and as needed under risk-based ongoing procedures. An institution may also choose to continue broader checks.
For the ongoing-review scenario specified in the order, an institution may rely on previously obtained information if the customer confirms its accuracy and currency. The confirmation may be verbal or written, and the institution must keep a record. If the information cannot be confirmed, or its reliability is reasonably questioned, the required identification and verification must occur.
This relief did not remove the ownership threshold or control prong. It also did not end ongoing monitoring. The institution’s procedures should explain how the applicable triggers will be recognized and addressed.
CDD and BOI reporting after the August 2026 rule
Beneficial Ownership Information reporting under the Corporate Transparency Act is a separate regime. FinCEN’s August 2026 final rule, effective August 14, exempted U.S.-created entities and U.S. persons from the applicable BOI reporting requirements. Certain foreign-formed entities registered in the United States may still be covered, subject to exemptions.
That change does not cancel a bank’s separate CDD obligations. A U.S. company can be exempt from filing a BOI report and still receive ownership questions from a financial institution. The two requirements have different purposes and rules.
FinCEN’s BOI database is not an ordinary public company-search tool. A commercial review should describe the sources it actually uses, rather than promise a public FinCEN lookup. Access is restricted under the governing framework.
Likewise, an exemption from reporting does not mean that ownership evidence cannot exist in other records. Internal corporate documents and other authorized sources may help answer the question, subject to their contents and limitations.
Sanctions compliance is a separate obligation
Sanctions restrictions can apply even when the CDD Rule does not. The relevant program, parties and transaction determine the analysis. A business should not infer that it can disregard sanctions because it is not a covered financial institution.
Under OFAC’s 50 Percent Rule, entities owned at least 50 percent, directly or indirectly and in aggregate, by blocked persons can be blocked even if not named on a list. Ownership can therefore matter beyond a name-screening result.
OFAC may impose civil penalties under a strict-liability standard for applicable violations. However, that does not mean every business faces an identical prescribed screening process. A compliance approach should reflect the applicable requirements and risk.
A possible name match also needs assessment. Similar names alone do not establish identity. If the evidence cannot resolve a material match or ownership concern, the issue should be escalated through the appropriate process before the business relies on a favorable result.
Keeping the customer file useful over time
The customer risk profile should reflect the nature and purpose of the relationship. Expected activity gives the institution context for monitoring. A collection of identification documents alone does not explain what activity is expected or why it makes sense.
Changes can affect that assessment. New ownership information, a different business activity or other relevant facts may call for review under the institution’s procedures. The February relief should not be treated as permission to ignore such changes.
Record retention also involves distinct categories. Section 1010.230 generally requires identification records for five years after account closure. It requires specified verification records for five years after the record is made. Other applicable duties may affect the institution’s retention policy.
For an operating business, the review schedule should reflect its own obligations and the relationship’s risk. A contract renewal or material change may justify an update. There is no single interval that fits every commercial counterparty.
When the evidence needs a closer review
Layered ownership, contradictory documents or unexplained changes may call for additional evidence. The response should address the specific concern. More documents are useful only if they help answer a relevant question.
For example, a state record naming a registered agent may not resolve an ownership question. Similarly, a chart supplied by the customer may need clarification if percentages do not reconcile. The file should record the discrepancy and how it was addressed.
Enhanced due diligence may be appropriate where ordinary checks leave a material concern unresolved. Its scope should explain the additional work, available sources and remaining limitations.
Incomplete information should not become a promise of certainty in the final report. A defensible account of the work distinguishes established facts, customer statements and unresolved issues. The decision-maker then has a clearer basis for deciding what happens next.
Frequently asked questions about customer due diligence requirements
Does the CDD Rule apply to every U.S. business?
No. It applies to covered financial institutions, with customer and account exclusions or exemptions where applicable. Other laws, sanctions restrictions, contracts and bank policies may still affect an operating company. Identify the source of each request before assuming that one rule covers everything.
Do banks still verify beneficial owners after the 2026 changes?
Yes, where required. The February relief changed certain repeat-check triggers; it did not remove the underlying CDD framework. The August BOI reporting exemptions concern a separate regime. Institutions must assess the applicable requirements and their risk-based procedures.
Does a signed ownership form settle every question?
No. The rule permits specified reliance on customer information, but identity verification and risk-based procedures still apply. Known facts that reasonably question reliability require attention. Independent ownership investigation may be appropriate in some circumstances, rather than automatically required in every case.
Can the review be handled remotely?
Much of the document collection and review may occur remotely. However, the institution, record source or recipient may require particular verification methods or certified documents. The team should confirm those conditions instead of promising that every case can be completed entirely online.
What affects the timeline and service scope?
The entity structure, jurisdictions, available documents and depth of review affect the work. Third-party responses can also affect timing. The engagement should identify the deliverable, dependencies and limits without guaranteeing approval, a fixed completion time or an error-free outcome.
Discuss your review with Compliance Officers
Compliance Officers can help organize evidence relevant to your customer due diligence requirements. The review can distinguish the requesting party’s needs, the corporate records available and questions requiring further analysis. The responsible institution or business retains its own obligations and decisions.
Contact Compliance Officers by calling +1 305 647 3000, using WhatsApp or writing to info@complianceofficers.org. Describe the entity and the request so the team can assess the scope and arrange an appropriate channel for sensitive documents.
This article provides general information about U.S. requirements. It is not legal advice or a guarantee of compliance. The applicable duties depend on the institution, activity, customer, account and current rules.
