FinCEN CDD Rule: Beneficial Owners, Verification, and Penalties

The FinCEN CDD Rule’s beneficial ownership requirements make your business identify, to any covered bank or broker where you open an account, every individual who owns 25 percent or more of the entity plus one person who controls it. You supply each person’s name, date of birth, address, and Social Security number (or passport number for non-U.S. persons) on a standard certification form, and the institution verifies their identities before opening the account. A February 2026 FinCEN order means most existing customers no longer repeat the process at every new account, but first-time customers still complete the full disclosure.

Which Institutions Ask, and Which Businesses Have to Answer

Five types of financial institutions are required to collect this information: banks (including federally insured credit unions), securities brokers and dealers, mutual funds, futures commission merchants, and introducing brokers in commodities.¹ Each maintains written procedures for identifying beneficial owners as part of its anti-money laundering program.

You fall within the rule if your business is a “legal entity customer,” which the regulation defines as any corporation, LLC, or other entity formed by filing a public document with a Secretary of State or similar office, plus general partnerships and comparable foreign entities.² Non-profit corporations and statutory trusts are covered. Non-statutory trusts, the kind created by a trust agreement rather than a state filing, are not.³

Sixteen categories of entities are excluded, mostly because they already disclose ownership under other regulatory regimes. The main ones are other regulated financial institutions, publicly traded companies registered under the Securities Exchange Act, SEC-registered investment companies and advisers, state-regulated insurance companies, bank and savings and loan holding companies, and pooled investment vehicles operated by an excluded financial institution. Foreign financial institutions from jurisdictions that keep beneficial ownership records are also exempt, as are accounts subject to private banking rules under 31 CFR 1010.620.² There is no small-business exemption. A one-owner LLC with no employees goes through the same process as a larger operating company.

Who Counts as a Beneficial Owner

The rule uses two independent tests, and you have to answer both.

The Ownership Prong

Any individual who directly or indirectly owns 25 percent or more of the entity must be listed.¹ Since four people each holding 25 percent would account for all the equity, the maximum reportable here is four. If nobody reaches 25 percent, nobody is reported under this prong.

Indirect ownership counts. If a company sits between you and the individual, multiply the ownership percentages down the chain. Someone who owns 60 percent of a company that in turn owns 50 percent of the account-opening entity holds 30 percent indirectly and crosses the threshold. A person’s stakes through different chains are added together, so someone with 20 percent through one holding company and 17 percent through another is over the line.⁴

If a trust owns 25 percent or more of the entity, the trustee is the person reported, whether that trustee is a person or another entity. When co-trustees exist, information on at least one is required. The institution does not have to look through the trust to its beneficiaries under the CDD Rule.⁴

The Control Prong

Every legal entity customer must also name a single individual with significant responsibility for managing or directing the entity. This is typically the CEO, CFO, COO, managing member, or general partner.⁵ Unlike the ownership prong, this one always produces a name; every business has someone in charge. The same person can satisfy both tests. A founder who owns 40 percent and runs the company is listed once as a beneficial owner and identified as the control person.

Information You Have to Provide

The person opening the account fills out a standard Certification Regarding Beneficial Owners of Legal Entity Customers.⁶ For each identified beneficial owner and the control person, the form asks for:

Full legal name
Date of birth
Residential or business street address
Social Security number for U.S. persons, or passport number or comparable government-issued document number for non-U.S. persons

These are the same data points required by existing Customer Identification Program rules.⁵ Whoever signs the certification attests that the information is accurate to the best of their knowledge. The institution can rely on what you provide unless it has reason to doubt it.⁴

How the Bank Verifies It

After receiving the certification, the institution has to verify each listed person’s identity. Documentary verification is the usual method: a government-issued photo ID such as a driver’s license or passport, copied or scanned for the institution’s records. When a physical ID is not available, non-documentary methods are allowed, including checks against consumer reporting agency data or other reliable public records. The account often sits in pending status until verification is complete. The bank does not have to independently investigate your ownership structure beyond what the certification discloses, but it cannot proceed if the information looks unreliable or incomplete.⁴

When You Have to Do This Again

On February 13, 2026, FinCEN issued Order FIN-2026-R001, which changed how often existing customers repeat the process. Before the order, institutions collected and verified beneficial ownership information at every new account opening, even for long-standing customers. Now, full identification and verification is required in only three situations:⁷

When a legal entity customer opens its first account with the institution
When the institution learns something that calls into question previously collected information
When the institution’s risk-based due diligence flags the customer for a beneficial ownership update

For the third case, the institution can rely on what it already has if you confirm, verbally or in writing, that the information is still accurate. That confirmation gets recorded. If you cannot confirm it, or if the institution has specific concerns, full re-identification and verification kicks back in.

Even outside those three triggers, the CDD Rule requires ongoing monitoring. Institutions build a risk profile for each customer and watch for unusual activity. A change in ownership, new management, a shift in transaction patterns, or negative news about your business can all prompt a request for updated beneficial ownership information. Ignoring that request can lead to account restrictions or closure, since the institution cannot maintain compliance with stale data.¹

Penalties for a False Certification

A false certification is not a paperwork problem. Under the Bank Secrecy Act, willful violations of the CDD requirements can produce civil penalties of up to the greater of $100,000 or $25,000 per violation for institutions and their personnel. Negligent violations carry up to $500 per incident, with a separate $50,000 penalty for a pattern of negligent violations.⁸

Anyone who knowingly puts false information on a beneficial ownership certification can also be prosecuted under the federal false-statements statute, which carries up to five years in prison and a fine. That statute reaches materially false statements made in connection with any matter within the jurisdiction of a federal agency, and BSA compliance qualifies.⁹

This Is Not the Same as CTA Reporting

The CDD Rule is easy to confuse with the Corporate Transparency Act, and the two obligations run in opposite directions. The CDD Rule requires your business to give beneficial ownership information to its bank or broker. The CTA required certain companies to file beneficial ownership reports directly with FinCEN.

In March 2025, FinCEN issued an interim final rule removing the BOI reporting requirement for all entities created in the United States. Only foreign entities registered to do business in a U.S. state or tribal jurisdiction remain subject to CTA reporting.¹⁰ The definitions also differ: the CDD Rule caps the control prong at one person, while the CTA has no such cap, and the CTA exempts large operating companies with more than 20 U.S. employees, a physical U.S. office, and more than $5 million in prior-year gross receipts.¹¹ The CDD Rule has no size-based exemption. Even a business that never had to file with FinCEN under the CTA still has to complete beneficial ownership disclosure at its bank, unless it falls into one of the sixteen excluded categories of legal entity customer.

1
Financial Crimes Enforcement Network. Information on Complying with the Customer Due Diligence (CDD) Final Rule
2
eCFR. 31 CFR 1010.230 – Beneficial Ownership Requirements for Legal Entity Customers
3
Financial Crimes Enforcement Network. Frequently Asked Questions Regarding Customer Due Diligence Requirements for Financial Institutions
4
Financial Crimes Enforcement Network. FinCEN CDD Rule Beneficial Ownership Requirements – FAQ
5
Federal Register. Customer Due Diligence Requirements for Financial Institutions
6
Financial Crimes Enforcement Network. Certification Regarding Beneficial Owners of Legal Entity Customers
7
Financial Crimes Enforcement Network. Exceptive Relief from Requirement to Identify and Verify Beneficial Owners at Each Account Opening (FIN-2026-R001)
8
Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties
9
Office of the Law Revision Counsel. 18 USC 1001 – Statements or Entries Generally
10
Financial Crimes Enforcement Network. FinCEN Removes Beneficial Ownership Reporting Requirements for U.S. Companies and U.S. Persons
11
Financial Crimes Enforcement Network. Small Entity Compliance Guide