Who Is Exempt From the CDD Rule? Entities, Accounts, and 2026 Relief

Under the Customer Due Diligence Rule at 31 CFR 1010.230, exemptions from beneficial ownership collection fall into three groups: entities that don’t meet the definition of a “legal entity customer” at all, entities that are excluded because their ownership information is already available through another regulator, and specific account types that carry low money-laundering risk. A smaller category of customers gets partial relief and only has to identify a control person. Knowing who is exempt from the CDD Rule matters because it determines whether a covered institution must collect full ownership information, partial information, or none.

Who the Rule Applies to in the First Place

The beneficial ownership requirement binds “covered financial institutions”: banks, brokers or dealers in securities, mutual funds, and futures commission merchants or introducing brokers in commodities. When one of these opens an account for a “legal entity customer,” it must identify each individual owning 25 percent or more of the equity and at least one individual with significant management responsibility, the so-called control prong.¹

A legal entity customer means a corporation, LLC, or other entity created by filing a public document with a Secretary of State or similar office, a general partnership, or a similar entity formed under foreign law. That definition is the gate. Fall outside it, or fit one of the listed exceptions, and beneficial ownership collection does not apply.

Customers Outside the Definition

Some customers are not exempt so much as never covered. Individuals opening personal accounts are the clearest example. The rule targets entities, not natural persons.²

Sole proprietorships that were never created by filing organizational documents with a state office also fall outside the definition, as do many unincorporated associations. If no public document created the entity, it isn’t a legal entity customer under the rule.

Regulated Financial Institutions

Financial institutions supervised by a federal functional regulator or a state bank regulator are excluded from the definition of legal entity customer. That covers banks, credit unions, broker-dealers, mutual funds, and similar entities already running their own anti-money laundering programs. Regulators supervising these firms already have access to ownership and control information, so a second collection at account opening would duplicate what is on file.¹

Bank holding companies and savings and loan holding companies are excluded on the same rationale. The Federal Reserve Board already maintains beneficial ownership information on them, and the 2016 final rule added them to the exclusion list.³

Publicly Traded and SEC-Registered Entities

Companies with a class of securities registered under Section 12 of the Securities Exchange Act of 1934, or that file reports under Section 15(d) of that Act, are excluded. These are typically U.S.-listed public companies whose ownership shows up in SEC filings.¹

The exclusion extends to investment companies registered under the Investment Company Act of 1940, investment advisers registered under the Investment Advisers Act of 1940, exchanges and clearing agencies registered under the Securities Exchange Act of 1934, and any other entity registered with the SEC under that Act.

Watch the boundary. This exclusion is tied to U.S. securities registration, not to being publicly traded in general. A company listed only on a foreign exchange does not qualify unless it also files reports under the Securities Exchange Act of 1934.²

CFTC-Registered, Insurance, Utilities, and Other Regulated Entities

Several additional categories are excluded because their ownership or control data lives with another regulator:

Registered entities, commodity pool operators, commodity trading advisors, retail foreign exchange dealers, swap dealers, and major swap participants registered with the Commodity Futures Trading Commission.
Public accounting firms registered under Section 102 of the Sarbanes-Oxley Act, whose ownership sits with the Public Company Accounting Oversight Board.
Insurance companies regulated by any state.
Regulated public utilities defined in 26 U.S.C. 7701(a)(33)(A) or (D) that provide telecommunications, electrical power, natural gas, or water and sewer services within the United States.⁴
Foreign financial institutions established in a jurisdiction where the foreign regulator maintains beneficial ownership information about the institution.
Financial market utilities designated by the Financial Stability Oversight Council under Title VIII of the Dodd-Frank Act.

Private banking accounts sit in a separate slot. Any legal entity is excluded, but only to the extent it opens a private banking account subject to 31 CFR 1010.620. That is narrow. The entity is not exempt across the board; the exclusion attaches to that specific account because private banking accounts already carry their own enhanced due diligence obligations.¹

Government Entities

Certain governmental entities are excluded by cross-reference to 31 CFR 1020.315(b)(2) through (5). That covers departments and agencies of the United States, any state, or any political subdivision, along with entities established under federal, state, or subdivision law that exercise governmental authority, and entities formed under interstate compacts between two or more states.⁵

Non-U.S. governmental departments, agencies, and political subdivisions qualify too, but only if they engage exclusively in governmental rather than commercial activities. A foreign government entity running commercial businesses would not be excluded.¹

Tax-Exempt Organizations

The tax-exempt exclusion is broader than many summaries suggest. It is not limited to 501(c)(3) charities. It reaches any organization described in Section 501(c) of the Internal Revenue Code that is exempt from tax under Section 501(a). That means social welfare organizations under 501(c)(4), business leagues under 501(c)(6), and every other 501(c) subcategory. Political organizations exempt under Section 527(a) and charitable trusts described in Section 4947(a) are also covered.⁶

One nuance to know. If an organization loses its tax-exempt status, it is still treated as excluded for 180 days after the loss. After that window, it becomes a legal entity customer and the institution must collect beneficial ownership information.⁶

Partial Exemption: Control Prong Only

Two types of customers get a partial break instead of a full exclusion. They remain legal entity customers but are subject only to the control prong. The financial institution must identify one individual with significant management responsibility and does not need to identify equity owners at the 25 percent threshold.¹

The first is a pooled investment vehicle operated or advised by a financial institution that is not itself excluded under the regulation. If the adviser or operator is already excluded, say an SEC-registered investment adviser, the pooled vehicle is fully excluded. If not, the vehicle still gets the reduced treatment.

The second is any nonprofit corporation or similar entity that has filed organizational documents with the appropriate state authority. Note the distinction from the full tax-exempt exclusion. A nonprofit that has filed state formation documents but hasn’t received or doesn’t qualify for IRS tax-exempt status still benefits from the control-prong-only rule. The institution just needs to identify one person who manages or directs the entity.

Account-Level Exemptions

Separately from entity status, the rule exempts specific account types. Even where the customer is a legal entity customer with no other exclusion, the institution can skip beneficial ownership collection for these accounts:

Commercial private label retail credit cards used solely to purchase goods or services at specific retailers, with a credit limit of $50,000 or less.
Accounts used to finance postage purchases, where payments go directly from the institution to the postage provider.
Accounts used to finance insurance premiums, where payments go directly to the insurance provider or broker.
Accounts used to finance equipment purchases or leases, where payments go directly to the vendor or lessor.

The last three come with two limits. They don’t apply if the account allows the entity to make or receive payments from third parties. And if the account activity could produce a cash refund, the institution must collect beneficial ownership information either when the first payment is remitted or when the refund occurs.¹

2026 Exceptive Relief: When Collection Is Triggered

On February 13, 2026, FinCEN issued an exceptive relief order (FIN-2026-R001) that changed the trigger for collection. Institutions previously had to identify and verify beneficial owners at each new account opening. The order relaxes that as part of FinCEN’s effort to align the 2016 CDD Rule with the Corporate Transparency Act.⁷

Under the order, institutions may now limit collection to three situations: when a legal entity customer first opens an account, when the institution learns facts that call into question previously obtained ownership information, and as needed under its risk-based ongoing due diligence procedures. In the third scenario, the institution can rely on previously collected information if the customer confirms, verbally or in writing, that it is still accurate. That confirmation must be recorded.

The relief is optional. An institution can keep collecting at every account opening if it prefers. FinCEN has indicated further rulemaking may follow.

The CDD Rule Is Not the CTA BOI Report

The CDD Rule is often confused with the Beneficial Ownership Information reporting requirement under the Corporate Transparency Act. They are different obligations. The CDD Rule is a bank-side duty: covered institutions collect ownership data from their legal entity customers at account opening. The CTA’s BOI reporting is a company-side duty: companies file ownership information directly with FinCEN, independent of any bank relationship.

As of March 2025, FinCEN revised the BOI reporting rule to exempt all U.S.-formed entities from filing. Only entities formed under foreign law that registered to do business in a U.S. state or tribal jurisdiction remain subject to BOI reporting. FinCEN has stated it will not enforce BOI reporting penalties against U.S. citizens or domestic companies.⁸

The practical consequence: a domestic company currently relieved of BOI filing is not thereby exempt from the CDD Rule when it opens an account. The two regimes run independently. Exemption from one does not carry to the other.

What Still Applies When You’re Exempt

Exclusion isn’t a determination an institution can make quietly and forget about. It must have a reasonable basis for concluding the customer qualifies and must document that basis. In practice, this is where compliance breaks down: the entity genuinely qualifies, but the file has nothing showing it.³

Exemption from beneficial ownership collection also does not reduce the other core CDD obligations. The institution must still verify the identity of the legal entity itself, understand the nature and purpose of the customer relationship to build a risk profile, and conduct ongoing monitoring for suspicious activity. Those requirements apply regardless of which exemption box a customer fits into.³

1
eCFR. 31 CFR 1010.230 – Beneficial Ownership Requirements for Legal Entity Customers
2
eCFR. 31 CFR 1010.230 – Beneficial Ownership Requirements for Legal Entity Customers
3
Federal Register. Customer Due Diligence Requirements for Financial Institutions
4
Federal Register. Update to the Public Utility Exemption Under the Beneficial Ownership Information Reporting Rule
5
eCFR. 31 CFR 1020.315 – Transactions of Exempt Persons
6
eCFR. 31 CFR Part 1010 – General Provisions
7
FinCEN. Exceptive Relief from Requirement to Identify and Verify Beneficial Owners at Each Account Opening
8
FinCEN. Beneficial Ownership Information Reporting