The CDD Rule requires covered financial institutions to identify certain beneficial owners of legal entity customers and verify their identities. It also sits within a broader customer due diligence framework. A bank may therefore ask a company for ownership information even when that company has no duty to file a beneficial ownership report with FinCEN.
Two changes in 2026 make that distinction especially relevant. FinCEN granted relief from repeating beneficial ownership collection at every new account opening. It also finalized separate exemptions from Corporate Transparency Act reporting. Neither change eliminates the applicable financial institution’s ongoing due diligence responsibilities.
Compliance Officers helps review ownership and control information and organize supporting records. This article explains the applicable requirements, the limits of the relief, and the questions that can arise during an institution’s review. It reflects the official materials reviewed on September 30, 2026.
Who the CDD Rule covers
FinCEN adopted the Customer Due Diligence Requirements for Financial Institutions rule in 2016, with a compliance date of May 11, 2018. Its beneficial ownership provisions appear in 31 CFR 1010.230. Related customer identification and ongoing due diligence requirements appear in the regulations applicable to each covered financial sector.
Covered institutions include banks, securities brokers or dealers, mutual funds, futures commission merchants, and introducing brokers in commodities. An ordinary operating company does not become a covered financial institution merely because its bank requests ownership information.
However, that company still needs to respond accurately to the institution’s questions if it wants the institution to assess the relationship. The bank’s duties and the customer’s role are different. Our overview of customer due diligence requirements explains how those roles interact.
The CDD Rule within the wider review
FinCEN describes four core elements of customer due diligence. They include customer identification and verification, beneficial ownership identification and identity verification, understanding the relationship’s nature and purpose, and ongoing monitoring. The latter includes suspicious activity reporting and updates to customer information on a risk basis.
However, these elements serve different purposes. A customer identification program, or CIP, addresses the customer. The beneficial ownership provisions address relevant owners and a control person. Information about the business and expected activity helps the institution understand the relationship.
Consequently, a signed beneficial ownership certification does not complete every part of due diligence. An institution may need additional information to assess risk or explain activity. The absence of a particular question from the certification form does not automatically make that question optional or unrelated to regulation.
Which legal entity customers fall within the rule?
The definition generally includes corporations, LLCs, and other entities that a public filing creates. It also includes general partnerships and similar entities under foreign law. By contrast, natural persons, sole proprietorships, and unincorporated associations fall outside this specific legal entity customer definition.
Section 1010.230(e)(2) lists exclusions. Examples include qualifying regulated financial institutions, certain SEC-registered entities and issuers, specified CFTC-registered entities, and registered public accounting firms. It also includes qualifying holding companies, state-regulated insurers, certain investment vehicles, and specified government bodies.
However, each exclusion has conditions. In addition, some customers follow a modified requirement rather than a complete exclusion. Certain nonprofit entities and pooled investment vehicles, for example, remain subject to the control prong only.
A beneficial ownership exclusion does not decide every other compliance question. The institution must separately assess applicable customer identification, monitoring, sanctions, and other requirements, including any exceptions under those rules. It should not treat one exclusion as a general exemption from review.
CDD Rule ownership and control requirements
The ownership prong
The ownership prong covers each individual who directly or indirectly owns at least 25 percent of the legal entity’s equity interests. Depending on the structure, this may identify up to four individuals. It may identify none if no individual meets the threshold, subject to the rule’s special provisions.
Indirect ownership matters where one entity owns another. The analysis must reach the relevant ultimate owners instead of stopping at the first holding company. However, the rule also provides special treatment for interests that excluded entities hold.
Where a trust owns at least 25 percent, the rule identifies the trustee for the ownership prong. Multiple trustees or an entity acting as trustee require attention to the applicable guidance. A standard individual-owner form may not explain those situations adequately.
The control prong
The control prong identifies one individual with significant responsibility to control, manage, or direct the entity. A senior executive, managing member, or general partner may qualify. The person’s actual responsibilities matter; convenience or availability to sign is insufficient.
For example, the same person may qualify under both prongs. Also, an institution may collect information on additional owners or controllers under its risk-based procedures. Our article on the meaning of beneficial owner discusses ownership and control in more detail.
What beneficial owner verification requires
The CDD Rule distinguishes identifying beneficial owners from verifying their identities. An institution may collect the required information through the certification form in Appendix A or another method with the required certification of accuracy. It then applies appropriate risk-based identity verification procedures.
FinCEN permits reliance on the customer’s information about beneficial owner status unless known facts reasonably call its reliability into question. The rule does not require an independent investigation of every ownership structure in every case. Nevertheless, contradictory information or other risk factors may require further review.
This distinction prevents two errors. Collecting a signed form does not replace required identity checks. At the same time, a broad ownership investigation should not automatically be described as a minimum legal requirement for every customer.
For example, documentary and non-documentary methods may support identity verification. The institution’s procedures must address what happens if it cannot form a reasonable belief about identity. The appropriate evidence depends on those procedures and the circumstances of the file.
CDD Rule relief issued in February 2026
FinCEN issued Order FIN-2026-R001 on February 13, 2026. It grants covered institutions relief from identifying and verifying beneficial owners each time an existing legal entity customer opens another account. Institutions may choose whether to use the relief.
Under the order, an institution may limit identification and identity verification to initial account opening, later reliability concerns, and occasions when its ongoing risk-based procedures require the work. A new account by itself need not trigger repeat collection for an existing customer under this approach.
However, an institution may continue collecting beneficial ownership information at each new account opening. The order does not prohibit a stricter policy that fits the institution’s risk profile. Therefore, a customer cannot assume the relief requires its bank to abandon an existing process.
When confirmation of existing information matters
A specific condition applies when ongoing risk-based procedures trigger the need to identify and verify beneficial owners. In that situation, the institution may rely on previously collected information if the customer confirms or certifies that it remains current and accurate. The institution must record that confirmation, whether verbal or written.
If the customer cannot confirm the information, the institution must identify and verify the beneficial owners under the rule. The same applies when the institution knows facts that reasonably undermine the information’s reliability. A recorded confirmation cannot resolve a known contradiction by itself.
This condition should not become a claim that every additional account always requires a fresh confirmation. The order’s trigger and the institution’s chosen procedures must guide the analysis. Written procedures and ongoing monitoring remain necessary.
CDD Rule recordkeeping and account exceptions
The rule sets different retention periods for different records. Institutions retain identifying information for five years after the account closes. They retain verification records for five years after making the record. Those records include relevant methods, results, and the resolution of substantive discrepancies.
Section 1010.230(h) also provides limited account exemptions. They include certain point-of-sale retail credit accounts up to a $50,000 limit and qualifying postage, insurance-premium, or equipment financing accounts.
Conditions and limitations matter. For example, the latter financing exemptions do not extend to transaction accounts that permit payments to or from third parties. Potential cash refunds can also trigger beneficial ownership requirements. An institution should assess the actual product instead of relying on its name.
How the CDD Rule differs from BOI reporting
Corporate Transparency Act reporting sends beneficial ownership information, or BOI, to FinCEN. Customer due diligence supports the financial institution’s own relationship review. These duties have different covered populations, purposes, and records.
On August 11, 2026, FinCEN announced a final BOI rule that became effective on August 14. It made permanent the exemptions for U.S. companies and U.S. persons introduced through the 2025 interim rule. Reporting companies no longer report U.S.-person beneficial owners or company applicants.
U.S. persons with FinCEN identifiers also no longer need to update or correct their previously submitted information. Foreign entities that qualify as reporting companies still report the relevant foreign individuals, subject to applicable exemptions. FinCEN also announced deletion of previously reported U.S.-person information.
Those changes do not remove a covered institution’s CDD responsibilities. Our article on BOI reporting requirements addresses that separate reporting framework.
Why a registry search does not settle the file
FinCEN’s BOI database is not a public company-ownership search service. Access follows a separate authorization framework. A private business cannot assume that a routine database search will confirm every U.S. company’s owners or replace its counterparty review.
Depending on the purpose and risk, an ownership review may draw on company records, registry information, agreements, and representations. The reviewer should explain what each source establishes and any remaining uncertainty. A registered agent’s name or a formation filing may not identify the ultimate owners.
Proposed AML/CFT changes remain a separate issue
In April 2026, the OCC, FDIC, and NCUA proposed amendments to their AML/CFT program requirements alongside FinCEN’s proposal. OCC Bulletin 2026-11 describes a risk assessment process, attention to national priorities, and changes to program evaluation and supervisory coordination.
The bulletin presents a proposal, not an enacted requirement. An institution assessing these developments should track the rulemaking and any effective dates separately from the February exceptive order. A proposal does not replace current obligations merely because it points toward a future approach.
Common CDD Rule problems in a customer file
Unclear control or inconsistent ownership information
A file may name a convenient signatory without explaining that person’s management role. It may also contain different ownership accounts across forms and supporting records. Those issues call for clarification before anyone relies on the conclusions.
Similarly, an unexplained holding company can make the ownership information difficult to assess. Further review should address the specific gap. It should not assume that every layered structure is suspicious or that a longer evidence file necessarily resolves the uncertainty.
Confusing regulatory minimums with institutional procedures
A bank may request ownership information below the 25 percent threshold or ask about expected activity and source of funds. Such requests may reflect its risk-based program or other applicable duties. They should not automatically be characterized as demands with no regulatory basis.
Conversely, the institution should explain the scope of its request clearly. Understanding the purpose helps a company provide relevant records and identify unanswered questions. A disagreement about the requested evidence does not itself establish a right to account approval.
Foreign records and unresolved reliability concerns
Foreign structures may involve limited public records, different legal terminology, or documents that need translation or authentication. The available evidence and the institution’s requirements affect the review. An unfamiliar jurisdiction alone does not dictate the outcome.
Where risk or reliability concerns justify closer examination, enhanced due diligence may help address them. The institution must still determine what additional work is appropriate and whether the relationship meets its requirements.
How Compliance Officers supports the review
Compliance Officers can help organize formation and standing records, review ownership and control information, and identify gaps in the file. Depending on the assignment, support may include sanctions and adverse-media screening or coordination of translations and document authentication.
The work should match the institution’s stated requirements and the transaction’s scope. A useful file distinguishes confirmed facts, customer representations, and unresolved questions. It also makes clear which records support each conclusion.
Timing depends on the ownership layers, the availability of records, and the authorities involved. The team can assess those constraints at the outset and coordinate follow-up. It cannot guarantee an account opening, a regulator’s findings, or an authority’s delivery date.
CDD Rule: frequently asked questions
Does the CDD Rule apply directly to my company?
It applies to covered financial institutions. An ordinary operating company usually supplies information as a customer of such an institution. That distinction does not remove the need to answer the institution’s questions accurately or satisfy its applicable requirements.
Did the 2026 relief end beneficial ownership checks?
No. The relief changes when an institution may repeat identification and identity verification. Initial collection, reliability concerns, and risk-based triggers remain relevant. Written procedures and other applicable BSA obligations continue.
Can a FinCEN search prove who owns a U.S. company?
The BOI database is not a public ownership directory. Access has separate restrictions, and the 2026 reporting exemptions limit its coverage. A customer or counterparty review must assess suitable evidence for its own purpose.
Can identity verification take place remotely?
Yes, where the institution’s risk-based procedures permit suitable documentary or non-documentary methods. FinCEN permits certain reproductions of identity documents for beneficial owner checks. The institution decides whether the available evidence satisfies its procedures.
How long does an ownership review take?
The structure, document availability, and any translation or authentication needs affect timing. A review should identify those constraints before setting expectations. The institution’s own assessment adds a separate stage.
What determines the scope of the service?
The relevant entities, jurisdictions, evidence gaps, and recipient’s requirements determine the work. Contact Compliance Officers for a case-specific review. The scope should state which records and checks the service covers.
Discuss your customer due diligence file
Visit Compliance Officers to discuss the institution’s request and the documents available. Call +1 305-647-3000, use WhatsApp, or email info@complianceofficers.org. Include the type of review and any deadline so the team can assess the work involved.
This article provides general information and does not constitute legal advice. Regulatory requirements and guidance can change. The applicable institution retains responsibility for its compliance decisions and acceptance of a customer file.
