7.2 The FinCEN CDD Rule & Beneficial Ownership Standards

Illicit actors have long exploited legal entities—including shell companies, complex corporate holdings, and anonymous partnerships—to conceal their identities, launder proceeds of crime, and evade economic sanctions. To close this loophole, the Financial Crimes Enforcement Network (FinCEN) promulgated the Customer Due Diligence Requirements for Financial Institutions (the CDD Rule). Compliance professionals must master the Core Four Pillars of CDD, calculate multi-tiered indirect equity ownership, apply statutory entity exclusions, and understand how the CDD Rule intersects with the Corporate Transparency Act (CTA) and FinCEN's Beneficial Ownership Information (BOI) database.

Regulatory Foundations and the "Fifth Pillar" of AML

Issued on May 11, 2016, with mandatory industry-wide compliance required by May 11, 2018, the FinCEN CDD Rule is codified at 31 CFR § 1010.230. Historically, the Bank Secrecy Act mandated a "Four-Pillar" AML program: (1) internal policies, procedures, and controls; (2) designation of a qualified compliance officer; (3) ongoing employee training; and (4) independent audit testing.

The CDD Rule formally amended federal AML program requirements by establishing a mandatory Fifth Pillar: risk-based procedures for conducting ongoing customer due diligence. Under this framework, FinCEN articulated the Core Four Pillars of CDD:

1. Customer Identification and Verification: Identifying and verifying the identity of customers opening accounts, maintaining baseline CIP compliance under USA PATRIOT Act § 326 (31 CFR § 1020.220).
2. Beneficial Ownership Identification and Verification: Identifying and verifying the identity of the natural persons who own or control legal entity customers opening new accounts.
3. Understanding the Nature and Purpose of Customer Relationships: Gathering sufficient information to understand the anticipated activity and economic rationale of the customer relationship to develop an accurate Customer Risk Profile (CRP).
4. Ongoing Monitoring and Risk-Based Profile Updates: Conducting ongoing transaction monitoring to identify and report suspicious activities and, on a risk basis, updating customer and beneficial ownership information over the account lifecycle.

The Two-Pronged Beneficial Ownership Standard

Under 31 CFR § 1010.230, whenever a legal entity customer opens an account at a covered financial institution, the institution must identify the natural persons behind the corporate veil using a two-pronged standard:

1. The Ownership Prong

Under the Ownership Prong, the institution must identify each individual (natural person), if any, who, directly or indirectly, through any contract, arrangement, understanding, relationship or otherwise, owns 25% or more of the equity interests of a legal entity customer.

• Variable Range: Depending on how shares or membership units are distributed, the Ownership Prong can yield between 0 and 4 individuals. For example, if an LLC is owned equally by five individuals each holding 20%, no natural person meets the 25% threshold, resulting in zero individuals under this prong. Conversely, if four individuals each own exactly 25%, all four must be identified.
• Risk-Based Thresholds: While the statutory ceiling is 25%, institutions may establish a more stringent internal threshold (e.g., 10% equity ownership) for high-risk customer segments, foreign operating entities, or complex holding structures based on their institutional risk assessment.

2. The Control Prong

Under the Control Prong, the institution must identify a single individual with significant responsibility to control, manage, or direct a legal entity customer.

• Eligible Executive Roles: This individual must be an executive officer or senior manager (e.g., Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, Managing Member, General Partner, President, Vice President, or Treasurer) or any other natural person who regularly performs similar executive management functions.
• Invariable Requirement: Every legal entity customer must always have exactly one control person identified under this prong. There are no exceptions where an entity has zero control persons.

Total Beneficial Owners Identified

Combining both prongs, a covered financial institution will identify between 1 and 5 natural persons (0 to 4 under the Ownership Prong, plus exactly 1 under the Control Prong). An individual who owns 25% or more of the equity may also serve as the designated executive under the Control Prong; in such cases, that individual is listed under both prongs on the certification form.

Multi-Tiered Ownership and Indirect Calculation Mechanics

In modern corporate structures, equity ownership is rarely direct. Criminals frequently layer intermediate holding companies, trusts, and offshore entities to obscure true ownership. FinTech and banking compliance analysts must execute indirect ownership calculations by multiplying equity percentages down the corporate chain:

• Scenario A (Indirect Qualifying Owner): Natural Person A owns 60% of the voting shares of "Alpha Holdings Inc." Alpha Holdings Inc. owns 50% of the membership interests of the legal entity customer, "Beta Technologies LLC." To determine Person A's indirect ownership in Beta Technologies LLC: Indirect Equity = 60% × 50% = 30% Because 30% meets or exceeds the 25% statutory threshold, Natural Person A must be identified under the Ownership Prong.
• Scenario B (Indirect Sub-Threshold Owner): Natural Person B owns 40% of "Gamma Enterprises LLC." Gamma Enterprises LLC owns 50% of the legal entity customer, "Beta Technologies LLC." To determine Person B's indirect ownership: Indirect Equity = 40% × 50% = 20% Because 20% is below the 25% threshold, Natural Person B is not required to be identified under the statutory Ownership Prong.
• Trust Holdings: When a trust holds 25% or more of the equity interests of a legal entity customer, the beneficial owner for the purposes of the Ownership Prong is the trustee (or multiple co-trustees). Institutions may also look through to grantors or beneficiaries on a risk basis, but the rule names the trustee for the Ownership Prong.

Legal Entity Customer Definition and Statutory Exclusions

Under 31 CFR § 1010.230(e)(1), a legal entity customer is defined as a corporation, limited liability company, general or limited partnership, business trust, or any other similar enterprise created by a filing with a state or foreign public authority. However, FinCEN explicitly excluded certain categories of entities from the beneficial ownership requirement because they are already subject to extensive public disclosure, securities supervision, or direct prudential oversight.

Statutory Exclusions (31 CFR § 1010.230(e)(2))

Covered institutions are not required to identify or verify beneficial owners for:

1. Publicly Traded Companies: Corporations listed on major national securities exchanges (such as the New York Stock Exchange or NASDAQ), and any majority-owned consolidated domestic subsidiaries of such public companies.
2. Regulated Depository Institutions: Federally regulated banks, credit unions, savings associations, and bank holding companies.
3. Registered Financial Market Intermediaries: Broker-dealers, investment advisers registered with the SEC, futures commission merchants, and national securities exchanges.
4. Governmental Entities: Federal, state, or municipal departments, agencies, political subdivisions, and public authorities.
5. Investment Companies: Open-end mutual funds and closed-end investment companies registered under the Investment Company Act of 1940.
6. Sole Proprietorships: Unincorporated businesses owned entirely by a single individual do not constitute separate legal entities; the individual owner undergoes standard individual CIP under 31 CFR § 1020.220.
7. Unincorporated Associations: Informal community clubs, social groups, or amateur athletic associations that do not file corporate formation documents with a secretary of state.

Entities Subject to Control Prong Only (31 CFR § 1010.230(e)(3))

Certain entities are exempt from the 25% Ownership Prong but remain strictly subject to the Control Prong:

• Non-Profit and Charitable Entities: Non-profit corporations, tax-exempt 501(c) organizations, and charitable foundations have no equity owners; therefore, the Ownership Prong is inapplicable, but they must identify one individual with significant managerial control (e.g., Executive Director, Board President, or Treasurer).
• Pooled Investment Vehicles: Pooled investment vehicles operated or advised by a financial institution that is not itself excluded from the legal entity customer definition.

Comparative Analysis: Beneficial Ownership Scope and Exclusions

The following table outlines the applicability of the CDD Rule across different commercial and institutional entity classifications:

Beneficial Ownership Certification and Verification Mandates

Covered financial institutions must obtain a completed Beneficial Ownership Certification Form (standardized in Appendix A to 31 CFR § 1010.230) or its digital equivalent whenever a legal entity customer opens an account.

Key operational requirements include:

• Authorized Execution: The certification must be signed by the natural person opening the account on behalf of the legal entity customer (e.g., an authorized corporate officer, manager, or corporate secretary). The individual certifies that the information provided is accurate to the best of their knowledge.
• Mandatory Identifying Elements: For every beneficial owner identified (under both the Ownership and Control prongs), the form must collect the identical four core CIP elements required for individuals: full legal name, date of birth, physical residential or business address, and government identification number (SSN/ITIN for U.S. persons; passport or foreign government ID number and country of issuance for non-U.S. persons).
• Identity Verification Mandate: The institution must verify the identity of each listed beneficial owner within a reasonable time using risk-based documentary or non-documentary CIP procedures. Crucially, the institution is verifying the identity of the beneficial owners (confirming that the natural persons exist and match their credentials), not auditing the corporate cap table or verifying equity percentages, unless red flags indicate fraudulent concealment.
• When to Collect (2026 Relief): In a February 13, 2026 order, FinCEN granted exceptive relief so that covered institutions no longer need to identify and verify the beneficial owners of an existing legal entity customer every time it opens a new account. They do so at the customer's first account opening, whenever they learn facts that reasonably call the reliability of the information into question, and as their risk-based ongoing CDD procedures require.

The Corporate Transparency Act (CTA) vs. FinCEN CDD Rule

Enacted as Title LXIV of the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021 (part of the Anti-Money Laundering Act of 2020, or AMLA 2020), the Corporate Transparency Act (CTA) created a federal Beneficial Ownership Information (BOI) database administered by FinCEN, which began accepting reports on January 1, 2024.

Compliance professionals must avoid confusing the CTA with the CDD Rule:

• Filing Obligation: Under FinCEN's March 2025 interim final rule, companies formed in the United States and their U.S. beneficial owners are exempt from CTA reporting. Only foreign companies registered to do business in a U.S. state still file through the Beneficial Ownership Secure System (BOSS), and they need not report U.S. persons as beneficial owners. The CDD Rule is separate: legal entity customers still give beneficial ownership information directly to covered financial institutions when opening accounts.
• Access Framework: Financial institutions may request access to FinCEN's BOI database, but only with the explicit consent of the reporting company customer, and solely to facilitate compliance with customer due diligence requirements under applicable law. With U.S. companies now exempt, the database holds far less information about U.S. customers.
• CRITICAL COMPLIANCE PRINCIPLE: The availability of the FinCEN BOI database does NOT relieve financial institutions of their independent regulatory obligation under 31 CFR § 1010.230. A bank cannot simply bypass the Beneficial Ownership Certification Form or fail to independently verify beneficial owners by claiming the customer already filed with FinCEN under the CTA.

Realistic Exam Scenario

A commercial onboarding analyst at a digital business banking platform evaluates an account application for "Horizon Dynamics LLC," a Delaware limited liability company specializing in cross-border software development. The individual opening the account, David Chen, presents a corporate resolution establishing his position as Vice President of Engineering and submitting the following ownership breakdown:

1. 50% of the equity of Horizon Dynamics LLC is held by "Starlight Ventures Inc."
2. 50% of the equity of Horizon Dynamics LLC is held by "Solstice Capital LLC."

Upon examining intermediate corporate registers:

• Starlight Ventures Inc. is 100% owned by Maria Rodriguez (an individual).
• Solstice Capital LLC is owned 40% by John Taylor (an individual) and 60% by Kevin Patel (an individual).
• The company's operating agreement designates Samantha Jones as Chief Executive Officer.

Compliance Analysis: The analyst must calculate indirect equity ownership to identify individuals qualifying under the 25% Ownership Prong:

1. Maria Rodriguez: 100% × 50% = 50% (Exceeds 25% → Qualifies under Ownership Prong).
2. John Taylor: 40% × 50% = 20% (Below 25% → Does not qualify under statutory Ownership Prong).
3. Kevin Patel: 60% × 50% = 30% (Exceeds 25% → Qualifies under Ownership Prong).
4. Samantha Jones holds 0% equity, but serves as Chief Executive Officer → Qualifies under Control Prong.

David Chen (the applicant) is an authorized representative opening the account. On the Beneficial Ownership Certification Form, the bank must identify Maria Rodriguez and Kevin Patel under the Ownership Prong, and Samantha Jones under the Control Prong (total of 3 natural persons). The bank must then collect the mandatory four CIP elements for all three individuals and verify their identities.

Common Exam Traps

• Trap 1: Assuming Every Entity Has an Ownership Beneficial Owner: Believing that every legal entity customer must identify at least one individual under the Ownership Prong. If equity is divided equally among 5 or more unrelated individuals (e.g., 20% each), no natural person reaches 25%. In this case, zero individuals are listed under the Ownership Prong, but exactly one individual must still be identified under the Control Prong.
• Trap 2: Believing Public Companies Must File Beneficial Ownership Forms: Assuming that because a company is massive or high-profile, it must disclose beneficial owners. Publicly traded companies listed on the NYSE or NASDAQ (and their majority-owned subsidiaries) are explicitly excluded from the CDD Rule under 31 CFR § 1010.230(e)(2).
• Trap 3: Confusing the CDD Rule with the Corporate Transparency Act: Assuming that because an entity submitted a BOI report to FinCEN under the Corporate Transparency Act, the financial institution is relieved of collecting a Beneficial Ownership Certification Form. Financial institutions maintain an independent legal duty under 31 CFR § 1010.230 to collect and verify beneficial ownership directly from the customer.
• Trap 4: Overlooking the Control Prong for Non-Profits: Assuming that non-profit organizations or charities are entirely exempt from the CDD Rule. While non-profits are exempt from the Ownership Prong (since they have no equity owners), they are strictly required to identify a single executive manager under the Control Prong.