Summary: US companies no longer report beneficial owners to FinCEN. That change, made by interim rule in March 2025 and final in August 2026, applies to the Corporate Transparency Act reporting rule at 31 CFR 1010.380. It did not touch the customer due diligence rule at 31 CFR 1010.230, which still requires a bank to identify and verify the beneficial owners of every legal entity customer that opens an account. The only 2026 change to the bank-side rule is an optional relief order on repeat account openings.
What the March 2025 interim final rule changed
FinCEN’s interim final rule was published March 26, 2025 at 90 FR 13688 and took effect the same day. Its summary states the change in one sentence: “Under this interim final rule, entities previously defined as ‘domestic reporting companies’ are exempted from the reporting requirements and do not have to report BOI to FinCEN, or update or correct BOI previously reported to FinCEN.”
Foreign reporting companies kept their obligation, with a new deadline of 30 days from publication, and were exempted “from having to report the BOI of any U.S. persons who are beneficial owners of the foreign reporting company.”
Where the CTA stands in October 2026
FinCEN finalized the rollback in a final rule published August 14, 2026 at 91 FR 52508, effective the same day. The rule adopts “as final and with certain limited changes the interim final rule issued on March 26, 2025.” Only foreign entities registered to do business in a US state or tribal jurisdiction still report, and only for their non-US owners. FinCEN’s estimate is “a total population of non-exempt reporting companies numbering approximately 28,000, of which approximately 13,000 have already reported as of December 31, 2025.”
The final rule also answers the question this post is about. FinCEN declined commenters’ requests to drop the bank-side rule: “the Reporting Rule (as modified by the IFR and again by this final rule) and the CDD Rule serve different purposes and arise under different legal authorities. Compliance with the CDD Rule is an important part of covered financial institutions’ overall anti-money laundering and countering the financing of terrorism programs.” It added that “The IFR did not revise FinCEN’s CDD Rule.”
A revision is coming. The final rule says FinCEN “is still legally required to modify the CDD Rule in light of the Reporting Rule, and now that FinCEN has completed its changes to the Reporting Rule, it can refocus on the CDD Rule.” The Unified Agenda lists “Revisions to Customer Due Diligence Requirements for Financial Institutions,” RIN 1506-AB60, with a proposed rule targeted for March 2027. Nothing has been proposed yet.
What the CDD rule still requires of banks
31 CFR 1010.230 has been in force since its May 11, 2018 applicability date. Paragraph (a) requires covered financial institutions “to establish and maintain written procedures that are reasonably designed to identify and verify beneficial owners of legal entity customers.”
Paragraph (b) sets the two steps. First, “Identify the beneficial owner(s) of each legal entity customer at the time a new account is opened,” either by “obtaining a certification in the form of appendix A of this section from the individual opening the account” or by obtaining the same information another way with the individual’s certification that it is accurate. Second, “Verify the identity of each beneficial owner identified to the covered financial institution, according to risk-based procedures to the extent reasonable and practicable,” using at least the elements the bank uses to verify an individual customer under its customer identification program. FinCEN’s February 2026 order summarizes the information required for each owner as “the individual’s name, address, date of birth, and Social Security number (or other permitted identification number for non-U.S. persons).”
A legal entity customer is “a corporation, limited liability company, or other entity that is created by the filing of a public document with a Secretary of State or similar office, a general partnership, and any similar entity formed under the laws of a foreign jurisdiction that opens an account.” Paragraph (h) exempts a few account types that matter to lenders, including accounts opened “To finance the purchase or leasing of equipment and for which payments are remitted directly by the financial institution to the vendor or lessor,” unless the account can make or receive third-party payments or a cash refund is possible.
Records must be kept. Identification records are retained “for five years after the date the account is closed,” and verification records “for five years after the record is made.”
The February 13, 2026 order, FIN-2026-R001, is the one 2026 change. A bank may limit identification and verification to three circumstances: “(1) when a legal entity customer first opens an account with a covered financial institution; (2) any time thereafter when the covered financial institution has knowledge of facts that would reasonably call into question the reliability of beneficial ownership information previously obtained about the legal entity customer; and (3) as needed based on a covered financial institution’s risk-based procedures for conducting ongoing customer due diligence.” Using the relief “is within the discretion of the covered financial institution.” A bank that relies on earlier information must get the customer’s confirmation that it is current and “must maintain a record of such certification or confirmation.”
The 25 percent ownership prong and the control prong
The rule defines beneficial owner in two parts, and a bank needs both.
The ownership prong is “Each individual, if any, who, directly or indirectly, through any contract, arrangement, understanding, relationship or otherwise, owns 25 percent or more of the equity interests of a legal entity customer.” The rule’s note says that “up to four individuals may need to be identified” under this prong. If a trust owns 25 percent or more, the beneficial owner is the trustee.
The control prong is “A single individual with significant responsibility to control, manage, or direct a legal entity customer,” with examples including “a Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, Managing Member, General Partner, President, Vice President, or Treasurer.” The phrase “directly or indirectly” does the work. If a holding company owns 50 percent of the customer and one person owns 60 percent of the holding company, that person indirectly owns 30 percent and belongs on the certification.
Checking operating agreements against certifications
The certification is a self-report. The rule lets a bank rely on it “provided that it has no knowledge of facts that would reasonably call into question the reliability of such information.” The operating agreement, partnership agreement or cap table in the same onboarding file is exactly such a fact when it disagrees with the form.
An example, with made-up numbers. A limited liability company opens a line of credit. The certification lists two owners at 40 percent each and names the managing member under the control prong. The operating agreement in the file shows four members: 40, 30, 25 and 5 percent. The 25 percent member is a beneficial owner under paragraph (d)(1) and is missing from the certification. The bank holds the document that contradicts the form, so it cannot rely on the form as filed. The fix is to go back to the customer for the missing owner’s information, verify it, and record the discrepancy and its resolution, which paragraph (i) requires.
How the automated version works
MightyBot is an AI agent platform for lending and finance. Agents read the operating agreement, cap table and certification in every onboarding file, work the ownership chain through holding entities, and compare the result to the names on the form, against rules written in plain English. Each finding cites the page it came from, and any mismatch routes to a BSA analyst for a decision rather than being closed automatically. See document processing and compliance.
