FinCEN CDD Rule: The Beneficial Owner Certification Playbook

The bank's question is not the registry's question

A founder opens a business account and the bank hands over a form asking for the names, dates of birth, addresses, and SSNs of every person who owns 25 percent or more of the company, plus one person who controls it. The founder has heard United States companies no longer file beneficial ownership reports with FinCEN, so the form looks like a mistake. It is not. Two rules share the words "beneficial owner," and they point at two different recipients.

The first rule is the Corporate Transparency Act registry: a company files a BOI report with FinCEN's database. On August 11, 2026, FinCEN made permanent the March 26, 2025 interim final rule exempting all United States companies, effective August 14, 2026.

The second rule is the Customer Due Diligence rule, 31 CFR 1010.230. It asks the company to file nothing with FinCEN. It orders the bank to collect, verify, and keep the same ownership information in its own files before the account opens. A filed BOI report never satisfied it, and the end of BOI filing for domestic companies leaves it untouched. Our FinCEN BOI beneficial ownership reporting guide covers the registry side; the interim final rule that limited BOI reporting to foreign companies explains why the registry went quiet while the bank's form stayed loud.

The four core requirements and the fifth pillar

FinCEN published the CDD Rule on May 11, 2016 (81 FR 29451); it took effect July 11, 2016, and banks had until May 11, 2018 to comply. The rule states four core requirements: a covered financial institution must have written procedures reasonably designed to identify and verify the identity of customers; identify and verify the identity of the beneficial owners of companies opening accounts; understand the nature and purpose of customer relationships to develop customer risk profiles; and conduct ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information.

The first is the older Customer Identification Program. The third and fourth were already expected of banks as sound practice; the rule wrote them into the AML program rule at 31 CFR 1020.210(a)(2)(v) as the fifth pillar, next to internal controls, independent testing, a designated compliance officer, and training.

Covered financial institutions are federally regulated banks (FDIC-insured) and federally insured credit unions, mutual funds, brokers or dealers in securities, futures commission merchants, and introducing brokers in commodities. A non-bank money transmitter or payment app is not covered, though its bank partner is. Our foreign founder banking guide shows how sponsor banks apply the rule through Mercury and Relay.

Who counts as a beneficial owner

Section 1010.230(d) defines a beneficial owner in two prongs. The ownership prong covers each individual, if any, who directly or indirectly owns 25 percent or more of the equity interests of the legal entity customer. The control prong covers a single individual with significant responsibility to control, manage, or direct the company — a chief executive officer, chief financial officer, chief operating officer, managing member, general partner, president, vice president, treasurer, or anyone who regularly performs similar functions.

A legal entity therefore has between one and five beneficial owners: zero to four under the ownership prong and exactly one under the control prong. If no individual owns 25 percent or more — five partners at 20 percent each is the classic case — the bank still collects the control person. There is no company with zero beneficial owners under this rule.

The bank collects the same four facts for each of them: name, date of birth, address, and SSN, or passport number and country of issuance for a foreign person. The individual opening the account supplies them and certifies they are complete and correct to the best of that person's knowledge. That individual need not be a beneficial owner.

Worked example: the indirect-ownership calculation

Indirect ownership multiplies down the chain. Individual A owns 60 percent of Company B, and Company B owns 50 percent of Company C, the customer opening the account. A's indirect stake in C is the product of the two links:

Thirty percent clears the 25 percent threshold, so A is a beneficial owner of C under the ownership prong.

FinCEN's own worked example in the consolidated FAQs runs the same arithmetic through two holding companies. Allan owns indirectly 30 percent of the customer through Company A. Betty owns indirectly 20 percent through Company A plus 16⅔ percent through Company B, for a total of 36⅔ percent. Carl and Diane each own indirectly only 16⅔ percent through Company B, so neither is a beneficial owner.

A trust that owns 25 percent or more changes the answer: under section 1010.230(d)(3), the beneficial owner is the trustee; with several trustees the bank collects at least one.

The certification form: Appendix A

The form the bank hands over is the Certification Regarding Beneficial Owners of Legal Entity Customers, Appendix A to section 1010.230. The form has five parts: general instructions, the legal entity's information (including its EIN), the control person's information, the ownership-prong individuals' information, and the signature.

Use of the Appendix A form is optional. FinCEN's FAQs confirm there is no requirement to use it; the bank may use its own form or any other means that collects the same information, provided the individual opening the account certifies its accuracy. What is not optional is the content: name, date of birth, address, and identifying number for each owner, plus the signed certification. Either way, the bank keeps the form. It does not file it with FinCEN, and the company must not send it there. Under section 1010.230(i)(2), the bank retains identification records, including the certification, for five years after the account closes, and verification records for five years after the record is made.

Verification follows the CIP model with two relaxations. The bank verifies each beneficial owner under risk-based procedures that contain at least the same elements as the CIP procedures for individual customers under 31 CFR 1020.220(a)(2) for banks. Unlike CIP, the bank may accept photocopies of identity documents, and it may verify an owner who never appears in person through non-documentary means: contacting the owner, comparing the information against other sources, or checking references with other financial institutions.

Who must certify, and when

The trigger event is a new account: each account opened by a legal entity customer — LLC, C-Corp, S-Corp, or LP — on or after May 11, 2018, the rule's applicability date. The bank identifies and verifies the beneficial owners when the account opens, unless the customer is excluded or the account is exempt. Accounts opened before May 11, 2018 are not covered retroactively.

That was the rule until February 13, 2026, when FinCEN issued exceptive relief order FIN-2026-R001. Under the order, a bank may — but need not — limit identification and verification to three circumstances: when a legal entity customer first opens an account; any time thereafter when the bank has knowledge of facts that would reasonably call into question the reliability of information previously obtained; and as needed under its risk-based procedures for ongoing customer due diligence. The relief is optional: a bank may keep collecting at every opening.

The certification runs in four steps:

1. Collect — gather the four facts for each beneficial owner before the account opens.
2. Certify — the individual opening the account signs that the information is complete and correct.
3. Verify — the bank checks each owner under its risk-based procedures.
4. Retain — the bank files the certification and keeps it five years past account closure.

Ongoing monitoring: what updates, and what does not

The fourth core requirement is where CDD stops being an account-opening event and becomes a standing duty. The bank must understand the nature and purpose of the relationship to build a customer risk profile, monitor for suspicious transactions, and, on a risk basis, maintain and update customer information — including beneficial ownership.

A routine periodic review, by itself, is not a trigger. FinCEN's FAQs say so directly: no obligation to solicit or update beneficial ownership information during regular reviews, absent specific risk-based concerns. The obligation attaches when, in normal monitoring, the bank becomes aware of information relevant to the customer's risk profile, including a possible change of beneficial ownership.

When an update is required, only what changed must be updated. A change of beneficial owner is different: the new owner's identity must be collected, certified, and verified as at account opening.

CDD versus BOI: the comparison that ends the confusion

The two regimes share a threshold and a vocabulary, and almost nothing else.

The shared 25 percent threshold is the trap. A founder who reads that domestic companies are exempt from BOI reporting and concludes the bank's 25 percent question is gone has confused the recipient for the rule. The bank's question survives because the bank's rule survives.

When certification fails

A certification fails in three ways: the company cannot name its owners, the named owners cannot be verified, or the information supplied does not hold together. Under 31 CFR 1020.220(a)(2)(iii), a bank's CIP must include procedures for responding to circumstances in which the bank cannot form a reasonable belief that it knows the true identity of a customer. Those procedures must describe when the bank should not open an account, the terms under which a customer may use an account while verification is attempted, when the bank should close an account after verification attempts have failed, and when it should file a Suspicious Activity Report.

In practice, three outcomes follow, in order of severity. The account is not opened, and the application is declined. The account is opened with restricted use while verification runs, and transactions are limited until the certification is complete. Or the account is closed after the bank's attempts to verify have failed.

Execution checklist: from cap table to open account

• [x] Draw the ownership chain on one page before contacting the bank: every individual, every holding company, every percentage, with anyone at 25 percent or more marked.
• [x] Name the control person: the one individual with significant responsibility to control, manage, or direct the company, by title and by function, not by shareholding.
• [x] Gather a passport or unexpired government photo ID for each beneficial owner, plus an address and date of birth; photocopies are acceptable.
• [x] Complete the Appendix A certification or the bank's equivalent form, and have the individual opening the account sign that the information is complete and correct to the best of their knowledge.
• [x] At renewal, confirm in writing that the certified information is still accurate, or supply updates for anything that changed; a change of beneficial owner requires a fresh collection, certification, and verification.
• [x] When ownership changes between renewals, notify the bank first; do not wait for transaction monitoring to surface it. Before opening the account, confirm the expected monthly volume with the business loan calculator if the account will carry financing.

The CDD rule is the bank's oldest question about a new company: who owns this, and who runs it. Answer it with a clean cap table, a named control person, and a signed certification, and the account opens on the bank's timetable. Leave any of the three out, and the bank's procedures — not its discretion — decide what happens next.