How the FinCEN CDD rule works, what changed with BOI reporting in 2026, how an AI employee collects, verifies and refreshes beneficial ownership data.
Every US bank, broker-dealer, mutual fund and futures commission merchant has to know who stands behind a business customer. The rule that requires it is almost ten years old, and it is still one of the most manual workflows in a compliance department: a certification form arrives, someone keys four names into the core system, and the file is not looked at again until something goes wrong. This post covers what the rule requires, what happened to the Corporate Transparency Act reporting regime in 2026, and how an AI employee can run the repeatable parts while your team keeps the decisions.
The rule uses two prongs, and both apply to every legal entity customer unless an exclusion fits.
Legal entity customers include corporations, LLCs, general partnerships and similar foreign entities that open an account. Certain entities are excluded, including federally regulated financial institutions, SEC-registered issuers and state-regulated insurers. Other entity types, such as nonprofits and some pooled investment vehicles, are covered only by the control prong. Trusts are handled in the rule's own paragraph, with the trustee typically being the control person.
You can read the rule text on eCFR. For the plain-language definition, see the glossary entries for customer due diligence and beneficial ownership.
As of October 16, 2026, US companies no longer file beneficial ownership information (BOI) reports with FinCEN. On August 11, 2026, FinCEN and Treasury announced a final rule that permanently removes the reporting requirement for US companies and US persons, and the rule took effect on August 14, 2026. It makes permanent the exemptions FinCEN first issued in an interim final rule in March 2025. Only foreign entities that are reporting companies still report, and only for foreign individuals. FinCEN also said it will delete previously reported information about US persons from its database.
Two details matter for a compliance team. First, FinCEN's own BOI reference pages still carry some older banner text, so check the date on any page you cite internally. The primary sources are the Treasury announcement and FinCEN's BOI pages.
Second, none of this changes the CDD rule. The CDD rule is a separate Bank Secrecy Act obligation on financial institutions, and it never depended on the BOI database. Institutions have always collected ownership information from their own customers. What changes is the tool you might have hoped to use as a cross-check. With US company filings gone, there is no federal registry to reconcile against for domestic customers, so the evidence has to come from the customer's own documents and from state and commercial records.
Yes, in part. On February 13, 2026, FinCEN issued order FIN-2026-R001, which grants exceptive relief from repeating beneficial ownership identification and verification at every new account opening. Under the order, an institution may limit that work to three situations:
The relief is optional, and all other Bank Secrecy Act program, recordkeeping and reporting requirements still apply. Read the order itself and FinCEN's CDD rule FAQs before you change your procedures, and have your BSA officer document the decision.
The practical effect is that trigger-based refresh now matters more. If you no longer re-collect ownership at every account, you need a dependable way to notice when the data you hold has gone stale.
The three get mixed up because they share an onboarding queue. They answer different questions.
Workflow | Question it answers | Where to read more |
|---|---|---|
CIP (customer identification program) | Is this individual who they say they are, and how do we refresh that file? | |
KYB (know your business) | Is this business real, in good standing and clear of risk flags? | |
CDD rule (31 CFR 1010.230) | Who owns and controls this entity, and what risk does the relationship carry? | This post |
Know your business covers the entity itself. The CDD rule covers the people behind it, plus the risk profile and ongoing monitoring that follow. A KYB check can pass cleanly while the ownership file is incomplete, which is why examiners treat them as separate findings.
Beyond identification and verification, the CDD rule's fourth pillar sits in the AML program requirements for each covered institution (for banks, 31 CFR 1020.210(a)(2)(v)). Institutions must understand the nature and purpose of each customer relationship so they can build a customer risk profile. They must also conduct ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information, including beneficial ownership information.
Record retention is spelled out in the rule. Identifying information, including any certification, is kept for five years after the account is closed. Verification records, including the documents relied on and how discrepancies were resolved, are kept for five years after they are made.
For a lender or bank with a few thousand business customers, the burden is not the first collection. It is keeping profiles current and being able to show an examiner exactly what was collected, from whom, and what was done about every mismatch. That evidence trail is where transaction monitoring and the AML hub connect back to the CDD file.
An AI employee works the queue the way a trained analyst would, inside your systems, with a written procedure and an approval gate. A typical beneficial ownership workflow looks like this:
Every step is logged. The file shows what the AI employee collected, which sources it checked, what it concluded and who approved it. For the broader operating model, see the AI compliance analyst and AI agents for financial crime investigations.
The automation is for the repeatable work. These decisions stay with your staff:
The design rule is simple: the AI employee prepares the file, a named person approves the decision, and the record shows both.
The ownership-tree workflow above runs under one AOP that your BSA officer approves and your KYC lead maintains. Three parts of it are specific to this job.
Sources of truth and the percentage rule. The AOP names which sources count as reliable for verification, the escalation threshold when stated and documented ownership differ, and how indirect stakes are multiplied. It also records whether you use the FIN-2026-R001 relief, since that is a policy choice a person signs off, not something the agent decides.
Reaching registries with no API. Where a registry or data source offers no API, Zamp's integration surface includes browser-based action for portals with no API, described on our deployment models page. In a freight deployment, an agent worked more than 50 vendor portals this way at over 95% browser-agent accuracy, with each session recorded; see the freight case study. A registry pull is the same kind of task, though that deployment was not a banking one.
What the identity cannot do. It can write the ownership tree and gap list to the customer record. It cannot accept a risk rating, waive a missing control person, or disposition a sanctions or PEP match.
Cases go to Needs Attention when the tree does not add up, no control person is named, a nominee or bearer-style structure appears, or a layered chain cannot be resolved. Before a profile is marked complete, the validate step in the PEV loop re-multiplies the percentages, confirms a control person exists, and confirms each stated owner appears in a cited document. The reasoning is written to the customer record in your system, so an examiner sees collected, checked and concluded in one place.
Corrections feed back the same way as elsewhere. When an analyst fixes a misread shareholder register, the change goes on a branch, runs against a golden set of past files, is reviewed and merges. Banks usually choose BYOC or on-premises for ownership documents, since they carry personal identifiers.
Pick one entity type and one trigger. Many teams begin with new-account intake for LLCs and corporations, where the documents are most standard, and add the ownership tree and reconciliation steps first. Run it alongside your analysts for a few weeks, compare outputs on the same files, and tighten the written procedure before widening scope. Add refresh triggers once the intake output matches your analysts' work.
Before you go live, agree with your BSA officer on three things: which sources count as reliable for verification, what percentage mismatch forces escalation, and where the approval gate sits. Document each one in the procedure the AI employee follows.
