FinCEN CDD Rule Explained: Beneficial Ownership Questions from Your Bank

If you advise US business clients, you have probably seen a bank ask them for the names, dates of birth and ID numbers of their owners. That request comes from FinCEN's customer due diligence (CDD) rule, which applies to the bank, not to your client or to you. Knowing how it works helps you prepare clients, explain why banks keep asking, and spot what changed in 2026. This guide sets out what we could confirm from FinCEN's own documents, and flags what we could not. For the wider picture, see our guides to KYC and customer due diligence for accountancy practices and ultimate beneficial ownership.

What the rule is and when it started

FinCEN, the US Treasury's Financial Crimes Enforcement Network, published the CDD final rule in the Federal Register on 11 May 2016 (81 FR 29398). It took effect on 11 July 2016, and institutions had to comply from 11 May 2018. According to FinCEN, the rule amended Bank Secrecy Act regulations for banks, broker-dealers in securities, mutual funds, and futures commission merchants and introducing brokers in commodities. FinCEN's FAQs also list federally insured credit unions. Accountancy firms do not appear in those lists, so the rule's direct obligations fall on financial institutions rather than on CPA practices.

The four core elements

FinCEN's CDD page describes four elements that a covered institution must build into its AML programme:

• identifying and verifying the identity of customers;
• identifying and verifying the beneficial owners of companies opening accounts;
• understanding the nature and purpose of customer relationships, to develop a customer risk profile; and
• ongoing monitoring to detect and report suspicious transactions and, on a risk basis, to keep customer information up to date.

Who counts as a beneficial owner

The rule uses two tests. The ownership test covers each individual who owns, directly or indirectly, 25 per cent or more of the equity of a legal entity customer. The control test covers one individual with significant responsibility to control, manage or direct the entity, such as a chief executive or president. In the final rule's discussion, FinCEN said that where a trust holds 25 per cent or more, the trustee is identified, that it declined to adopt a 10 per cent threshold, and that an institution may apply a lower threshold based on risk. There may be no individual who meets the ownership test, but a control person must always be identified.

Which customers are "legal entity customers"

As described in the Federal Register preamble, the term covers corporations, limited liability companies and other entities created by a public filing with a Secretary of State or similar office, general partnerships, and similar foreign entities that open an account. It does not cover sole proprietorships, unincorporated associations, individuals opening accounts for themselves, or trusts other than statutory trusts. The preamble also lists a range of exclusions, including federally regulated financial institutions, government bodies, exchange-listed companies, SEC-registered issuers and PCAOB-registered public accounting firms. FinCEN's FAQs add that institutions are generally not required to look through a trust to its beneficiaries, although they may still need to identify people with control, such as trustees.

What banks ask your client for

According to FinCEN's FAQs, for each 25 per cent owner and one control person the customer is asked for a name, date of birth, address, and a Social Security number or other government ID number (for foreign persons, a passport number or similar). The person opening the account does not have to be a beneficial owner. FinCEN's form is optional, and institutions may use their own forms or other methods that meet the rule. Under the final rule, the individual opening the account certifies the information to the best of their knowledge, and the institution may rely on it unless it has knowledge of facts that would reasonably call its reliability into question. Verification is risk-based and applies "to the extent reasonable and practicable".

What changed in February 2026

On 13 February 2026, FinCEN issued order FIN-2026-R001, an exceptive relief order under 31 U.S.C. 5318(a)(7) and 31 CFR 1010.970. It relieves covered financial institutions from having to identify and verify beneficial owners of a legal entity customer each time a new account is opened. As we read the order, identification and verification are still required in three situations:

• when the legal entity customer first opens an account;
• when the institution knows of facts that reasonably call into question the reliability of the information it already holds; and
• as needed under the institution's risk-based ongoing customer due diligence procedures.

In the third case, the institution may rely on previously collected information if the customer confirms, verbally or in writing, that it is up to date and accurate, and the institution keeps a record of that confirmation. The order says the other CDD obligations remain, including written procedures, risk-based updating of customer information, ongoing monitoring and suspicious activity reporting, and that institutions may still verify at every account opening if they choose. The order does not state an end date and says relief may be revoked at FinCEN's discretion.

Practical steps for CPAs advising clients

These are our suggestions, not FinCEN guidance. Keep an up-to-date ownership chart for each corporate client, with the individuals behind any holding companies. Tell clients that banks may ask them to confirm their ownership information after a change of owners or officers, and that a prompt, accurate answer avoids delays. If a client's structure includes trusts, explain that banks may ask who controls the trust even though they are not required to look through to every beneficiary. For the separate question of company-level reporting to FinCEN, see our piece on FinCEN ending BOI reporting for US companies, which is a different regime from the bank CDD rule.

What we could not confirm

• We did not read the codified text of 31 CFR 1010.230 or the related programme rules, so we do not state record retention periods or the precise wording of the nature-and-purpose requirement.
• FIN-2026-R001 was the version we read. We did not check whether FinCEN has changed or revoked it since February 2026.
• We did not review how individual banks apply the rule in practice, which varies by institution.

Frequently asked questions

Does the CDD rule apply to my accountancy firm?

Accountancy firms are not among the institution types FinCEN lists as covered. Other rules, including the US AML requirements for CPAs, may apply to you in other ways.

Does the bank have to verify every owner every time?

Not at every new account since FIN-2026-R001, though it must at the first account and in the other situations above.

Is a trust a legal entity customer?

Generally no, except for statutory trusts created by a filing with a state office, according to FinCEN's FAQs.