Certification of Beneficial Owners: Filing, Renewal, and Penalties

When your company opens its first account at a bank, brokerage, or similar institution, federal law requires you to complete a certification of beneficial owners: a signed statement identifying the individuals who own or control the business. Under the Customer Due Diligence (CDD) Rule at 31 CFR 1010.230, you must name any individual who holds 25 percent or more of the entity’s equity and at least one individual who exercises significant control over it, and provide four pieces of identifying information for each person. The requirement applies at account opening and, since a February 2026 FinCEN order, generally does not repeat when you open additional accounts at the same institution.

Who You Have to List

The CDD Rule uses two separate tests. You can trigger one or both, and the same person can satisfy both at once.

The Ownership Prong

Any individual who directly or indirectly holds 25 percent or more of the entity’s equity is a beneficial owner. That covers stockholders, LLC members, and partners with a large enough stake. Depending on how ownership is split, up to four people may need to be listed under this prong.¹ If no single individual crosses 25 percent, nobody gets listed here, but you still have to complete the control prong.

The Control Prong

Separately from ownership, you must identify one individual with significant responsibility to manage or direct the company. That is typically a senior officer such as the CEO, CFO, president, treasurer, or managing member. Only one control person is required under the rule, though the bank may ask for additional names as part of its own risk-based review.¹

If your CEO owns 30 percent of the company, list them once. They satisfy both prongs.

When Ownership Runs Through Other Companies

Ownership doesn’t have to be direct. If a person owns the entity through one or more intermediate companies, the percentages multiply through the chain. FinCEN’s guidance illustrates this simply: if Allan owns 60 percent of Company A, and Company A owns 50 percent of the entity opening the account, Allan’s indirect ownership is 30 percent (60 percent of 50 percent), which puts him over the threshold.² When someone owns pieces of several intermediate companies that each hold equity in the customer, those indirect percentages are added together.

The bank isn’t expected to audit the ownership chain. It can rely on the information the person opening the account provides, unless something the bank already knows suggests the answers are unreliable.²

Whether the Certification Applies to Your Business

The rule reaches most operating companies. A “legal entity customer” is any corporation, LLC, or other entity created by filing a public document with a secretary of state or similar office, plus any general partnership. Foreign entities that open a U.S. account are included.¹

Five types of financial institutions have to collect the certification: banks (credit unions are included), brokers and dealers in securities, mutual funds, futures commission merchants, and introducing brokers in commodities.³ If you’re opening an account somewhere outside those five categories, this specific CDD certification may not apply.

The regulation also exempts a range of entities that are already subject to transparency requirements elsewhere. Publicly traded issuers registered under Section 12 of the Securities Exchange Act, entities registered with the SEC or CFTC, banks and other regulated financial institutions, bank and savings-and-loan holding companies, state-regulated insurance companies, public accounting firms registered under Sarbanes-Oxley, non-U.S. government departments engaged only in governmental activities, and certain pooled investment vehicles operated by an excluded institution are all off the hook, along with accounts already covered by the private banking due diligence rules.¹ Most small and mid-sized private companies are not on that list and do have to certify.

What Information You Provide

For each beneficial owner identified under either prong, you supply four items:

Full legal name.
Date of birth.
A residential or business street address. A standard P.O. box generally doesn’t work, though military APO and FPO addresses are acceptable when no street address is available.²
An identification number. For U.S. persons, that’s typically a Social Security number or taxpayer ID. Non-U.S. persons may use a passport number or another government-issued ID number from their country.¹

Banks verify identities using the same procedures they use for individual customers under their Customer Identification Program. That may include reviewing a copy of a government-issued ID such as a driver’s license or passport; the regulation explicitly allows photocopies.¹ Some institutions rely on non-documentary methods like database cross-checks instead. Ask your bank what it wants before you start pulling documents together.

FinCEN publishes an optional standardized “Certification Regarding Beneficial Owners of Legal Entity Customers” form that many banks use.⁴ Others use their own branded form or an online portal. The information collected is the same regardless of format.

Submitting the Certification

How you turn in the certification depends on the institution. Most banks accept digital uploads through their business banking portals; you can also drop paperwork off at a branch or mail it in, with certified mail useful if you want proof of delivery.

Once the bank has the information, it runs the identified individuals against OFAC sanctions lists and other watchlists. Processing time varies. Some institutions clear the certification the same day; others take several business days if a manual review is triggered. No federal regulation fixes a specific window. If something doesn’t match, the bank will come back to you for clarification before finalizing the account.

When You Have to Do It Again

FinCEN’s February 2026 exceptive relief order (FIN-2026-R001) narrowed the situations in which covered institutions must collect a new beneficial ownership certification. Under the order, collection is required in three situations:

First account opening, when the entity first establishes a relationship with that institution.
When the institution has reason to believe the previously collected information may no longer be accurate.
When the institution’s own risk-based procedures call for an update.

Opening a second or third account at the same bank no longer automatically triggers a fresh certification.⁵ Routine periodic account reviews also don’t require re-collection on their own, and when an update is warranted, the bank can rely on information gathered through normal business interactions rather than making you fill out a new form.⁶

If your ownership changes materially, such as a co-founder selling a 30 percent stake to a new investor, notify your bank rather than waiting for it to catch up during a review. Getting ahead of the change avoids friction on future transactions.

This Is Not the Same as the CTA Report

The bank certification under the CDD Rule is separate from the Beneficial Ownership Information (BOI) report under the Corporate Transparency Act. They go to different places and satisfying one does not satisfy the other.

The bank certification goes to your financial institution when you open an account. The BOI report was designed to go directly to FinCEN. Under a March 2025 interim final rule, all entities created in the United States are exempt from CTA reporting; only foreign entities registered to do business in a U.S. state or tribal jurisdiction still file BOI reports with FinCEN.⁷ The bank-level CDD certification is unaffected by that change. Domestic companies that no longer file BOI reports still must complete the certification when they open their first account at a covered institution.⁸

Penalties and Practical Consequences

The Bank Secrecy Act penalty framework applies to the CDD Rule. Negligent violations can draw a civil penalty of up to $500 per violation, with an additional penalty of up to $50,000 for a pattern of negligent violations.⁹ Willful violations are far more serious: civil penalties reach the greater of $25,000 or the transaction amount, capped at $100,000, and criminal penalties include fines up to $250,000 and up to five years in prison. Where the violation is part of a pattern of illegal activity involving more than $100,000 in a 12-month period, the maximum fine rises to $500,000 and the prison term to 10 years.¹⁰

The everyday consequence is more mundane and more common: banks routinely refuse to open, or move to close, accounts when a customer won’t provide adequate beneficial ownership information. Completing the certification accurately the first time is the shortest path to keeping the account.

1
eCFR. 31 CFR 1010.230 – Beneficial Ownership Requirements for Legal Entity Customers
2
Financial Crimes Enforcement Network. Frequently Asked Questions Regarding Customer Due Diligence Requirements for Financial Institutions
3
Federal Register. Customer Due Diligence Requirements for Financial Institutions
4
Financial Crimes Enforcement Network. Certification Regarding Beneficial Owners of Legal Entity Customers
5
FinCEN. FinCEN Issues Exceptive Relief to Streamline Customer Due Diligence Requirements
6
FinCEN. CDD Rule FAQs
7
FinCEN. Beneficial Ownership Information Reporting
8
FinCEN. Information on Complying with the Customer Due Diligence Final Rule
9
Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties
10
Office of the Law Revision Counsel. 31 USC 5322 – Criminal Penalties