US Bank Beneficial Ownership Rule: 31 CFR 1010.230 and the 2026 Order

If you advise companies with US bank accounts, you will have seen the form their bank asks them to sign about who owns and controls the business. That form comes from FinCEN's customer due diligence rule for "legal entity customers", which sits at 31 CFR 1010.230. This guide explains the rule and a February 2026 FinCEN order that changed how often banks must repeat it. It is written for accountants and finance students, and it is a different rule from the Corporate Transparency Act reporting that we cover in our post on FinCEN ending beneficial ownership reporting for US companies.

Please read "What we could not confirm" at the end. We read the rule text on Cornell's Legal Information Institute site, which does not show a current-as-of date, and the FinCEN order itself.

Who the rule applies to

The rule applies to "covered financial institutions", a term defined by reference to 31 CFR 1010.605(e)(1), which we did not read. Those institutions must keep written procedures reasonably designed to identify and verify the beneficial owners of legal entity customers, and include them in their anti-money laundering compliance program. It does not apply to accounting firms as such. Its relevance to an accountant is that your clients' banks apply it, so the questions your clients receive follow its structure.

Which customers count

Legal entity customers include corporations, limited liability companies and similar entities formed by filing a public document with a state, general partnerships, and comparable foreign entities. Section 1010.230(e)(2) lists many exclusions, such as SEC-registered issuers, certain regulated financial institutions and state-regulated insurance companies. Nonprofit entities are subject only to the control prong.

The two tests: ownership and control

The ownership prong

Each individual who directly or indirectly holds at least 25% of the entity's equity interests is a beneficial owner under this prong. The rule allows for up to four individuals. If a trust holds 25% or more, the trustee is treated as the beneficial owner for this prong.

The control prong

One individual with significant responsibility to control, manage or direct the entity is also identified. The rule gives examples such as a chief executive, chief financial officer, chief operating officer, managing member, general partner, president, vice president or treasurer, or anyone who regularly performs similar functions. This prong applies even where nobody holds 25%, which is why a widely held company still names at least one individual. Our guide to ultimate beneficial ownership explains the same idea from a UK angle.

Identification and the certification form

Beneficial owners must be identified when a new account is opened, unless an exclusion or exemption applies. The institution can obtain a certification in the form set out in Appendix A to the rule from the person opening the account. Alternatively it can collect the same information another way, as long as the person certifies its accuracy to the best of their knowledge.

Verification

Verification is risk-based and applies to the extent reasonable and practicable. At minimum it must include the elements used to verify individual customers under the customer identification program rules that apply to banks, broker-dealers, mutual funds and futures commission merchants. Photocopies are acceptable for documentary verification. Institutions may rely on the customer's information about its beneficial owners unless they know of facts that would reasonably call it into question.

The February 2026 order

On 13 February 2026, FinCEN issued Order FIN-2026-R001, titled "Exceptive Relief from Requirement to Identify and Verify Beneficial Owners at Each Account Opening". It applies to covered financial institutions subject to 31 CFR 1010.230 that open accounts for legal entity customers. Institutions no longer have to identify and verify a customer's beneficial owners every time it opens a new account. They may limit the exercise to three situations: when the customer first opens an account with the institution; when the institution learns of facts that reasonably call into question the reliability of the information it holds; and when its risk-based ongoing due diligence procedures call for it.

In the third situation, the institution may rely on information it already holds if the customer certifies or confirms, verbally or in writing, that it is up to date and accurate, and the institution keeps a record of that confirmation. If the customer cannot confirm, or the institution doubts the information, the institution must identify and verify under the rule. Other obligations remain, including written procedures, ongoing monitoring, suspicious activity reporting and risk-based updates to customer information. The order says the relief is optional, may be revoked at FinCEN's discretion, and that FinCEN expects to make further changes to the 2016 rule through rulemaking.

Record keeping

Identification records, including any certification, must be kept for five years after the account is closed. Verification records, covering the documents relied on, non-documentary methods and results, and how discrepancies were resolved, must be kept for five years after the record is made. Our comparison of AML record keeping across the UK, Ireland, the EU and the US shows how this compares.

Our suggestions for advisers to US clients

These are our own suggestions, not FinCEN requirements. Keep an up-to-date ownership chart for each US client so that the answer to a bank's request is consistent every time. Note who the control-prong individual is, and remind clients to tell their bank when ownership or management changes, since the order relies on customers confirming that information is current.

Frequently asked questions

Does the 25% test apply to every customer?

It applies to the ownership prong for legal entity customers. Nonprofit entities are subject only to the control prong.

Must a bank still collect ownership information at every new account?

Not under the February 2026 order, which allows banks to limit the exercise to three situations. The relief is optional, so some banks may keep their existing practice.

How long are the records kept?

Five years after account closure for identification records, and five years after the record is made for verification records.

What we could not confirm

The rule text we read does not show a current-as-of date, so later amendments could exist. We did not read the definition of covered financial institution, the exemptions list in full, or any FinCEN guidance or FAQs on the rule. We do not know how individual banks have applied the February 2026 order, and the order says FinCEN expects further rulemaking. This post is general information, not legal advice.