Every week an operating company is handed a short form by its bank, told to name each individual who owns 25 percent or more, sign a certification and return it before the account can be funded. Every week a compliance officer is asked why the CDD Rule demands this again from a customer that has banked there since 2016. Both questions come from the same confusion: the CDD Rule is the most misnamed rule in U.S. anti-money laundering practice. People use the phrase for any customer check, when it is one specific FinCEN rule, with a defined scope, a defined trigger and four defined elements.
We handle these files from both sides of the desk — for institutions building customer records that survive examination, and for the operating companies that meet these demands second-hand. What follows is who the rule binds, what FinCEN relieved in February 2026 and what it deliberately left standing, and why the collapse of the federal beneficial ownership registry in August 2026 keeps the verification burden where it has always been. You will finish knowing what the law requires, what your bank asks on its own authority, and where these files stall.
What the CDD Rule actually requires — and what it does not
The CDD Rule is properly the Customer Due Diligence Requirements for Financial Institutions rule. FinCEN adopted it in 2016 with a compliance date of 11 May 2018, and it sits at 31 CFR 1010.230. That citation matters more than it looks: if an obligation cannot be traced to that section, to the customer identification programme rules, or to an institution’s own risk-based programme, it is not the CDD Rule. It is a contractual demand, which is a different negotiation.
The rule binds covered financial institutions: banks, brokers or dealers in securities, mutual funds, and futures commission merchants and introducing brokers in commodities. That list is exhaustive, and it imposes nothing on ordinary operating businesses. A manufacturer, a developer or a fund’s portfolio company never complies with the CDD Rule; it responds to a covered institution that is complying with it. Correcting that takes a real share of our time, usually after someone has been told they are «required by FinCEN» to produce what the regulation never mentions.
The rule rests on four core elements, and only two of them ever generate paperwork the customer sees:
- Customer identification and verification — the CIP rule, which predates 2016 and is the origin of most of what people loosely call CDD.
- Identification and verification of the beneficial owners of legal entity customers — the 2016 addition, and what people mean by «the beneficial ownership rule».
- Understanding the nature and purpose of the relationship, in order to develop a customer risk profile.
- Ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information.
Elements three and four have no form and no fixed evidence set. They are programme obligations, judged on whether the institution’s conclusions are reasonable and documented, which is why the vocabulary gets muddled. An analyst asking for an organisational chart and expected transaction volumes is doing element three, not «the CDD form». Knowing what U.S. businesses are actually required to verify is the quickest way to sort regulatory requests from institutional preference.
The trigger is narrow: a legal entity customer opening an account. That means a corporation, an LLC, another entity created by a filing with a state office, a general partnership, or a similar foreign entity. Sole proprietorships, unincorporated associations and natural persons are not legal entity customers, which disposes of more arguments than you would expect. Section 1010.230(e)(2) then excludes a further list from the beneficial ownership element: federally regulated financial institutions, SEC-registered issuers and investment companies, CFTC-registered entities, public accounting firms registered under Sarbanes-Oxley, bank and savings-and-loan holding companies, state-regulated insurers, certain pooled investment vehicles, and non-U.S. government bodies engaged only in governmental activity.
Beneficial ownership has two prongs under 1010.230(d), and they behave differently. The ownership prong captures each individual who directly or indirectly owns 25 percent or more of the equity interests — up to four individuals, and sometimes none, because a widely held entity may have nobody above the threshold. The control prong always produces exactly one name: a single individual with significant responsibility to control, manage or direct the entity — a CEO, CFO, COO, managing member, general partner, president, vice president or treasurer, or anyone performing a similar function. Where a trust owns 25 percent or more, 1010.230(d)(3) makes the trustee the beneficial owner. Our companion piece on identifying who really controls a U.S. company covers the layered cases the regulation settles in a sentence.
Collection may use the certification form at appendix A to 1010.230, or capture the equivalent information with an individual certifying its accuracy under 1010.230(b)(1). Records are held under 1010.230(i): identifying information for five years after the account closes, verification records for five years after the record is made. Section 1010.230(h) exempts certain accounts from the beneficial ownership element altogether — among them particular point-of-sale credit accounts up to $50,000, and postage, insurance premium and equipment financing accounts, each subject to conditions.
The 2026 changes to the CDD Rule: what FinCEN relieved and what it did not
On 13 February 2026 FinCEN issued exceptive relief, Order FIN-2026-R001, driven by the deregulatory policy of Executive Order 14192, «Unleashing Prosperity Through Deregulation». It addresses one widely resented friction: covered financial institutions no longer have to identify and verify beneficial owners every time an existing legal entity customer opens another account. Identification and verification may instead be limited to initial account opening; to the point at which the institution has knowledge of facts that would reasonably call into question the reliability of the information it already holds; and to whatever its own risk-based ongoing due diligence procedures warrant.
What was not touched matters more. The 25 percent threshold stands. The control prong stands. Every other Bank Secrecy Act obligation stands. This is relief from a trigger frequency, not from an obligation, and it is conditional:
- Written procedures to identify and verify beneficial owners must remain in place.
- The AML/CFT programme must include risk-based procedures for maintaining and updating customer information.
- When relying on information already held, the customer must certify or confirm that it remains current and accurate.
- Those certifications or confirmations, verbal or written, must be documented.
- If the customer cannot confirm, or reliability is in question, full identification and verification must be performed.
FinCEN has said it anticipates further changes to the 2016 rule through formal rulemaking, informed by this order. The direction of travel shows elsewhere: in April 2026 the federal banking agencies proposed amendments to AML/CFT programme requirements, described for national banks in OCC Bulletin 2026-11 of 7 April 2026 — a formal risk assessment process incorporating FinCEN’s national AML/CFT priorities, a two-pronged test of whether a programme is both «established» and «maintained», and a notice-and-consultation framework with FinCEN before significant enforcement or supervisory action. That package is proposed, not final: a supervisory signal, not a current requirement.
Now the part that changes the calculus. A central justification for revising the CDD Rule was that it duplicated the beneficial ownership registry built under the Corporate Transparency Act, on the theory that institutions would eventually lean on a federal database. That theory is dead. A March 2025 interim final rule had already limited BOI reporting to foreign reporting companies, and on 11 August 2026 FinCEN issued the final rule making the rollback permanent, effective on its publication in the Federal Register on 14 August 2026: U.S. companies and U.S. persons are permanently exempt from BOI reporting; U.S. persons holding FinCEN identifiers need not update or correct earlier filings; foreign reporting companies no longer report U.S.-person company applicants; foreign pooled investment vehicles no longer report U.S.-person beneficial ownership; and FinCEN is directed to delete information it reasonably believes relates to U.S. persons. Foreign reporting companies must still report their foreign individual beneficial owners. Our earlier analysis of how compliance officers approach the BOI report tracks how far that obligation narrowed.
The consequence is blunt. There is no usable federal registry of who owns a U.S. company, and there will not be one: the database was never public, and it will not even contain U.S. persons. Establishing who controls a U.S. counterparty means building the answer from state filings, corporate documents, contracts and direct verification. Two obligations that people routinely conflate now point in opposite directions.
| Dimension | CDD Rule (31 CFR 1010.230) | CTA beneficial ownership reporting |
|---|---|---|
| Who it binds | Covered financial institutions: banks, brokers or dealers, mutual funds, futures commission merchants and introducing brokers | Reporting companies; after 11 August 2026, in substance only foreign entities |
| What triggers it | A legal entity customer opening an account, as modified by the February 2026 relief | Formation or registration to do business in the U.S., plus updates and corrections |
| What is collected | Identifying details for owners at 25 percent or more and for one control person, plus identity verification | Beneficial ownership information filed by the company itself; no U.S.-person data |
| Where it goes | The institution's own customer file, kept five years after the account closes | A non-public FinCEN database, with U.S.-person data to be deleted |
| Current status | In force, modified by exceptive relief, further rulemaking anticipated | Permanently narrowed to foreign entities and their foreign beneficial owners |
What the official guidance does not tell you
The regulation, the FAQs and the examination manual describe the destination. They do not describe the terrain, and the terrain is where files fail.
Examiners test the control prong and the risk profile narrative, not the form. A completed appendix A proves that someone signed a page. The findings we see arise when the named control person is a corporate secretary, outside counsel or a nominee director with no operational authority, while the person actually directing the entity appears nowhere in the file. The same applies to the profile: «commercial client, moderate risk» is not a narrative and will not survive a question about the account’s activity.
The February 2026 relief is only usable if the confirmation is documented, and undocumented confirmation is worse than re-verifying. An institution that relies on information already held but cannot show the customer certified or confirmed it has neither the original verification event nor the conditions of the exception. It has an unsupported gap. Relief that is available in principle and unprovable in practice is a liability, not a saving.
Exclusion from the beneficial ownership element is not exclusion from anything else. A customer listed in 1010.230(e)(2) still has to be identified and verified under CIP, still needs a risk profile, and remains subject to ongoing monitoring. It is also fully exposed to sanctions screening, which OFAC administers on a strict-liability basis against all U.S. persons and businesses. No exclusion protects an institution that has onboarded a blocked party.
The rule is silent on foreign-formed customers whose home registry data cannot be verified. A «similar foreign entity» is squarely a legal entity customer, but nothing tells you what to do when the home jurisdiction publishes nothing, permits nominee shareholders, or issues extracts that cannot be authenticated. This is where files sit for weeks, and where the right answer is often to treat the file as one requiring enhanced due diligence rather than standard checks.
Much of what a bank asks an operating company for is not in the rule at all. Ownership disclosure at 10 percent, source-of-wealth narratives and audited financials come from the institution’s own programme or its correspondent’s expectations. Refusing them can cost the account, but knowing which demands are regulatory tells you where scope and timing remain open.
The most common mistakes and what they cost
The costs here are rarely fines for the operating company. They are delays, lost transactions and remediation that has to be paid for twice.
The first mistake is treating the certification as the verification. A signed form collects information; it does not confirm that the people named own or control the entity. When a structure later reveals an intermediate holding company nobody disclosed, the institution has an inaccurate record and the customer has a credibility problem that follows it to the next bank.
The second is naming the wrong person on the control prong — usually whoever was available to sign rather than whoever directs the business. This is the most common finding we see raised in file reviews, and it is expensive because amending one form does not fix it: the relationship has to be re-papered and the original answer explained.
The third is assuming the federal registry will settle ownership questions. Deals are still signed on the belief that a FinCEN lookup will confirm a counterparty’s owners. After 11 August 2026 that lookup returns nothing about U.S. persons, and it was never open to private parties anyway. A transaction closed on unverified ownership can turn out to involve a sanctioned party, a disqualified director or an undisclosed controller, and the discovery usually arrives from a bank at the worst possible moment.
The fourth is reading the February 2026 relief as a suspension of the beneficial ownership element, then discovering at examination that written procedures were quietly dropped and confirmations were never recorded. The fifth is the foreign entity file opened on an unverifiable registry printout: onboarding freezes, funds sit unavailable, and a closing date passes while somebody waits on a certified extract from a registry that has never answered a foreign email.
How Compliance Officers resolves it for you
You should not be chasing Secretaries of State, registered agents, foreign registries or apostille offices to satisfy an onboarding request. We assemble the evidence file end to end — formation and standing documents, ownership and control traced through intermediate entities, certified and legalised registry output for foreign structures, sanctions and adverse media screening, and the documented confirmations the February 2026 conditions require. Institutions receive a file that answers what their examiners will ask. Operating companies receive a pack that gets the account opened.
Three commitments govern the work: zero paperwork for you, because we obtain, certify and legalise the records ourselves; zero errors, because ownership and control conclusions are traced to source documents rather than to a customer’s recollection; and zero unnecessary delays, because we know which offices are slow and which reject filings on formatting. We run these files continuously across all fifty states and a wide range of foreign jurisdictions, and we stay on a file until the institution or counterparty confirms acceptance, not until the documents are ordered. If cost is your first question, contact us to evaluate your case.
Frequently Asked Questions
Does the CDD Rule apply to my company?
Almost certainly not directly. The rule binds covered financial institutions — banks, brokers or dealers in securities, mutual funds, futures commission merchants and introducing brokers. Ordinary operating companies are not subject to it; they are affected by it, because their bank must satisfy it before opening an account. The real obligation is producing evidence a covered institution will accept, and that is the part we handle.
Is the CDD Rule still required by law after the 2026 relief?
Yes. FinCEN Order FIN-2026-R001 of 13 February 2026 removed the requirement to identify and verify beneficial owners at every new account opened by an existing legal entity customer. It did not change the 25 percent threshold, the control prong or any other Bank Secrecy Act obligation, and it attaches conditions, including documented certification or confirmation from the customer. FinCEN anticipates formal rulemaking. We help institutions apply the relief so it holds up at examination.
Can the FinCEN registry prove who owns a U.S. company?
No, and this is the costliest misconception in the field. The beneficial ownership database was never open to private parties, and after the final rule of 11 August 2026 it will not contain U.S.-person information at all, since FinCEN has been directed to delete it. Ownership of a U.S. entity now has to be established from state filings, corporate documents, contracts and direct verification. That reconstruction is exactly what we do.
Can beneficial ownership verification be completed remotely?
In most cases yes. Formation documents, standing certificates and much state-level evidence can be obtained and delivered electronically, and identity verification is routinely done without anyone attending in person. The exceptions are documents needing certification, apostille or consular legalisation, which move at the pace of the issuing office. We manage the chain remotely and flag at the outset which items are the constraint.
How long does it take to assemble evidence a bank will accept?
It depends on two variables: how many layers sit between the customer and the individuals who ultimately own or control it, and which jurisdictions issue the underlying records. A single-state LLC with two natural-person members is quick. A structure running through several foreign holding entities is not, and legalisation adds its own timeline. We assess both before starting, so you get a realistic date rather than an optimistic one.
What does an ownership verification file cost?
There is no flat answer, because cost tracks the number of entities, the jurisdictions involved and whether documents need certification or apostille. Government and registry fees are fixed and factual; the professional work varies with the structure. Contact us to evaluate your case and we will scope it against what your institution or counterparty is actually demanding, rather than against a worst-case assumption.
Does your bank or counterparty need beneficial ownership verified, and you need it right the first time?
Compliance Officers runs the verification end to end: zero paperwork for you, zero errors, zero unnecessary delays.
Phone and WhatsApp: +1 305 647 3000
