Customer due diligence is the set of steps a bank or other covered financial institution must take, under the Bank Secrecy Act, to verify who you are, understand how you plan to use your account, and monitor your transactions over time for signs of money laundering or terrorist financing.1Financial Crimes Enforcement Network. Information on Complying with the Customer Due Diligence Final Rule It is not a single form or a one-time check. It is a continuous obligation that begins before an account is opened and lasts as long as the relationship does.
The federal rules break the obligation into four working parts: identifying the customer, understanding the purpose of the account, identifying the real people behind any business entity, and monitoring the relationship on an ongoing basis. Each part has its own regulatory footing, and each scales with the risk a particular customer presents.
Identifying the Customer
The starting point is the Customer Identification Program, or CIP. Every covered institution must have written CIP procedures suited to its size and business.2eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks Before or at the time you open an account, the institution collects four items:
- Your full legal name.
- Your date of birth, if you are an individual.
- A residential or business street address, or for a business entity, a principal place of business.
- An identification number: a Social Security number or other taxpayer identification number for U.S. persons, or a passport, alien identification card, or other government-issued document number for non-U.S. persons.
Collecting the information is only half the job. The institution then verifies it, either by reviewing a government-issued ID like a driver’s license or passport, by cross-referencing the information against credit bureaus and public databases, or by combining the two. Records of what was collected and how it was verified must be retained for five years after the account closes.3FFIEC BSA/AML InfoBase. Appendix P – BSA Record Retention Requirements
Understanding Why the Account Exists
Knowing who you are is not enough. The institution also has to understand what the account is for. That means asking about the types of transactions you expect to run through it, the expected volume and frequency, and the source of funds coming in. A personal checking account with direct deposit needs only a short conversation. A business account expecting international wire activity or large cash volumes needs a longer one. For high-net-worth individuals or accounts opened with a large initial deposit, the institution also asks about the source of wealth, not just the source of individual transactions.
The answers you give become a baseline. If a small personal savings account starts moving six-figure international transfers a few months later, the gap between the baseline and the actual activity is what prompts a closer look.
Beneficial Ownership for Business Accounts
When a business entity opens an account, the institution has to look past the company name to the people behind it. Federal regulations define a “beneficial owner” using two tests, and both must be applied.4eCFR. 31 CFR 1010.230 – Beneficial Ownership Requirements for Legal Entity Customers
The ownership test requires identifying every individual who directly or indirectly owns 25 percent or more of the entity’s equity. A company might have zero, one, or several people meeting that threshold. The control test requires identifying a single individual with significant management responsibility, such as a CEO, CFO, president, or managing member. The institution collects the same four pieces of identifying information for each of these people as it does for individual customers.5FFIEC BSA/AML InfoBase. Beneficial Ownership Requirements for Legal Entity Customers
A long list of entity types is exempt, generally because they are already regulated or publicly transparent: federally regulated financial institutions, publicly traded companies, registered investment companies, SEC-registered exchanges, state-regulated insurers, and bank holding companies, among others.4eCFR. 31 CFR 1010.230 – Beneficial Ownership Requirements for Legal Entity Customers
One point that causes confusion. The Corporate Transparency Act was designed to create a separate federal registry of beneficial owners at FinCEN, but in March 2025 FinCEN issued an interim final rule exempting all U.S.-formed entities from that reporting requirement; only entities formed under foreign law and registered to do business in the United States now file with FinCEN.6Financial Crimes Enforcement Network. FinCEN Removes Beneficial Ownership Reporting Requirements for US Companies and US Persons That change is about the federal registry only. The independent obligation of financial institutions to collect beneficial ownership information at account opening under 31 CFR 1010.230 is unchanged.7Financial Crimes Enforcement Network. Beneficial Ownership Information Reporting
Risk-Based Procedures
Not every customer gets the same treatment. CDD procedures must be risk-based, so the depth of review scales with the risk a particular customer, product, or geography presents.1Financial Crimes Enforcement Network. Information on Complying with the Customer Due Diligence Final Rule A salaried employee opening a personal checking account is low risk, and the standard CIP process is usually enough. Sometimes this is called simplified due diligence.
Higher-risk relationships call for enhanced due diligence, which means additional information, more rigorous verification, and often approval from senior compliance staff. Common triggers include:
- Cash-intensive businesses such as restaurants, convenience stores, and car washes, where cash volume makes the origin of funds harder to trace.
- Customers or transactions tied to jurisdictions with weak anti-money laundering controls or known corruption problems.
- Complex ownership structures with layered subsidiaries, trusts, or nominees that obscure who really owns the entity.
- Transaction patterns with no clear business rationale, such as frequent large transfers between unrelated parties.
- Foreign financial institutions, particularly in correspondent banking relationships.
One category worth flagging because it is often misunderstood: politically exposed persons. There is no specific BSA regulation that requires banks to screen for PEPs or to apply a set procedure to them.8FFIEC BSA/AML InfoBase. Politically Exposed Persons Most large institutions screen for them anyway and apply heightened procedures, but that practice comes from each institution’s own risk assessment rather than a rule that names them.
Ongoing Monitoring
CDD continues for the life of the account. The anti-money laundering program must include risk-based procedures for monitoring the relationship, and monitoring has two components.9FFIEC BSA/AML InfoBase. Assessing Compliance with BSA Regulatory Requirements – Customer Due Diligence
The first is keeping customer information current. This obligation is event-driven, not calendar-driven. The CDD rule does not require institutions to refresh every customer file on a fixed schedule. When the institution learns through its normal monitoring that something material has changed, whether a new beneficial owner, a different business model, or a shift in expected transaction patterns, it updates the record. Many institutions still set periodic review cycles for their highest-risk customers, but that is an internal choice.
The second is transaction monitoring. Automated systems compare actual activity against the baseline built at account opening and flag anomalies: large cash deposits in an account opened for payroll, sudden spikes in international wires, rapid movement of funds through multiple accounts with no apparent purpose, or transactions structured just below reporting thresholds. Flagged items go to internal investigation. If the activity has a reasonable explanation, the matter is documented and closed. If it does not, the institution must file a Suspicious Activity Report with FinCEN, generally within 30 calendar days of first detecting facts that may warrant a report, with a possible 30-day extension to identify a suspect and a hard 60-day outer limit.10eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions
Which Institutions Must Comply
CDD is not limited to traditional banks. Federal regulations define “financial institution” broadly, and the covered categories include banks and credit unions, broker-dealers in securities, money services businesses (check cashers, money transmitters, currency dealers, and providers of prepaid access), casinos and card clubs, futures commission merchants, introducing brokers in commodities, and mutual funds.11FFIEC BSA/AML InfoBase. General Definitions Each covered institution must maintain an anti-money laundering program with, at minimum, internal policies and controls, a designated compliance officer, ongoing employee training, and an independent audit function.12Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority
SEC-registered investment advisers are a notable gap. FinCEN finalized a 2024 rule that would bring them under the BSA, but in early 2026 it pushed the effective date to January 1, 2028 while it reviews and tailors the rule.
Consequences of Failing To Comply
The penalty structure is why institutions treat CDD as a live program rather than paperwork. For willful violations of BSA requirements, a financial institution faces a civil penalty of up to the greater of the amount involved in the transaction (capped at $100,000) or $25,000 per violation.13Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties Each day and each branch where a violation continues can count separately, so the total escalates quickly. Special due diligence violations carry a penalty floor of twice the transaction amount and a ceiling of $1,000,000. Repeat violators face additional penalties of up to three times the profit gained or loss avoided, or two times the maximum penalty for the underlying violation, whichever is greater. Criminal penalties under 31 USC 5322 also apply when violations are willful.14Internal Revenue Service. IRM 4.26.7 – Bank Secrecy Act Penalties
Beyond fines, an institution that fails a BSA examination faces formal enforcement action from its primary regulator, which can include cease-and-desist orders, removal of officers and directors, and restrictions on opening new accounts or expanding operations.