Corporate Transparency Act changes: the owner check left to banks

The Corporate Transparency Act changes of 2025 and 2026 took US companies out of FinCEN's ownership registry, and that leaves the bank's own file. Beneficial ownership information at banks is the record of who owns and controls each business customer that a bank collects under FinCEN's Customer Due Diligence Rule: up to four people holding 25% or more, one controller, and each person's identity, certified by the customer and verified by the bank. Since FinCEN exempted US companies from reporting their owners under the Corporate Transparency Act, first by an interim rule in March 2025 and then permanently in August 2026, that bank file has become the main place in the US system where a US company's owners are written down and checked against anything. Banks now face it with a sharper question than before: if our certification is wrong, nobody else will catch it. Botminds' Beneficial Ownership Verification exists to make that one check hold, comparing each certification with the company's own documents before the account opens.

What is beneficial ownership information in banking now?

Two different things share the name, and the difference now decides who holds the record. Under the CDD Rule, a bank collects owner information from each legal entity customer when it opens its first account and keeps it, with the verification behind it, in its own files (31 CFR 1010.230). Under the Corporate Transparency Act, companies were to report their owners directly to FinCEN, which would hold them in a central database that banks could query in limited circumstances.

The second system no longer covers US companies. FinCEN's interim final rule of March 2025 exempted every company formerly classed as a domestic reporting company from filing, updating or correcting beneficial ownership reports (90 FR 13688). The final rule, issued on 11 August and published on 14 August 2026, made that permanent (91 FR 52508). FinCEN's own page now tells US companies plainly that they are exempt and no longer file (fincen.gov/boi; is beneficial ownership still required at the bank answers the business owner's side). Foreign companies registered to do business in the US still report, but not their US-person owners.

Do banks still need beneficial ownership after the Corporate Transparency Act changes?

Yes. The CTA change exempted companies from reporting to FinCEN; it did not touch the bank's rule. FinCEN said so in the final rule: the reporting rule "and the CDD Rule serve different purposes and arise under different legal authorities. Compliance with the CDD Rule is an important part of covered financial institutions' overall anti-money laundering and countering the financing of terrorism programs" (91 FR 52508). The OCC told its banks the same in spring 2025, weeks after the interim rule: the 2016 CDD rule still bound them in full (OCC Semiannual Risk Perspective, Spring 2025).

What did change is the bank's position. Before 2025, a bank's certification was one of two records that could in time be compared. Now, for a US limited liability company opening its first account, the bank's certification and the documents behind it are the record. FinCEN listed, among the points commenters asked it to clarify, "the possibility that the diminution of BOI collection under the IFR and this final rule might imply an actual increase in financial institutions' CDD obligations". It has not yet answered.

Can banks access the FinCEN BOI database?

Only with the company's consent, and for US companies there is nothing new to access. The statute lets FinCEN disclose beneficial ownership information on "a request made by a financial institution subject to customer due diligence requirements, with the consent of the reporting company, to facilitate the compliance of the financial institution with customer due diligence requirements" (31 U.S.C. 5336(c)(2)(B)(iii)). FinCEN's access rule put that into effect on 20 February 2024 (88 FR 88732).

Even at its best, then, the registry was a source the customer had to open for the bank, which limited its value as an independent check: a company concealing an owner from its bank could decline to consent. Since March 2025, US companies have not been required to file or update reports at all. And FinCEN has said nothing final about what it expects banks to do with the "still-extant BO IT System", listing among open questions whether "verification under the CDD Rule need not involve the BO IT System" (91 FR 52508). A procedure that names the FinCEN registry as a verification source for US customers is out of date.

What happens to the BOI data FinCEN already has?

FinCEN is deleting most of what US persons gave it. Its question-and-answer document on the final rule says that "FinCEN is implementing a process to delete information about any individuals—company applicants, beneficial owners, or recipients of a FinCEN ID—that FinCEN reasonably believes was provided by a U.S. person" (FinCEN, final rule Q&A, August 2026). Reports that US companies filed during 2024 will not remain as a reference point. A bank that hoped to use them later to check a long-standing customer's certification cannot plan on it.

"FinCEN is still legally required to modify the CDD Rule in light of the Reporting Rule, and now that FinCEN has completed its changes to the Reporting Rule, it can refocus on the CDD Rule."

FinCEN, final rule on beneficial ownership information reporting, August 2026

Who verifies beneficial ownership in the US now?

For US companies, the institutions that open their accounts. FinCEN no longer collects US-company reports. That leaves the covered institutions under the CDD Rule: banks, credit unions, broker-dealers, mutual funds and futures firms, each verifying the identity of the owners a customer names and relying on the customer's statement of ownership unless it knows better.

The international standard expects more than that. FATF Recommendation 24 asks countries to ensure "adequate, accurate and up-to-date information on the beneficial ownership and control of legal persons … through either a register of beneficial ownership or an alternative mechanism", and to "consider facilitating access … by financial institutions" (FATF Recommendations, February 2025). How the US answers that question after 2026 is for Treasury and FATF's assessors. For a bank, the practical consequence is narrower and more immediate: its own file is relied on by others. The FFIEC manual explains why banks collect the information at all: it "can provide law enforcement with key details about suspected criminals who use legal entity structures to conceal their illicit activity and assets" (FFIEC BSA/AML manual, beneficial ownership).

How criminals use shell companies to open bank accounts

Mostly by being ordinary. Treasury's 2024 risk assessment notes that willing money mules are used to set up shell companies whose business accounts then carry laundered funds, and that while the CDD Rule "has helped mitigate this vulnerability to an extent", enforcement cases show banks that were slow to follow their own identification procedures (Treasury, 2024 National Money Laundering Risk Assessment). The same report cites FATF's finding that "only 9 percent of countries are meeting the overall effectiveness requirements concerning beneficial ownership transparency". It predates the 2025 exemption, so its picture of the CTA is out of date; its picture of mule companies is not.

The other half of the problem is how easy the companies are to get. In a field experiment published in International Organization, researchers posing as consultants asked 1,264 incorporation firms in 182 countries for confidential companies (Findley, Nielson and Sharman, 2013). Their university's summary reports that nearly half of the firms never asked for adequate identification, and that in the US a deal could be closed in under three hours, while in tax havens "it took more than double the time and effort" (University of Texas at Austin, 2014). Firms warned about legal penalties were less likely to comply, not more. A bank cannot assume that whoever formed a customer asked who was behind it.

What the bank's file now has to answer on its own

The file has to stand without a registry behind it, and since February 2026 it may have to stand for years. Under FinCEN's optional relief order, a bank may identify and verify owners at the first account and afterwards only on doubt or on its own risk triggers (FIN-2026-R001); what changed at the second account is set out in FinCEN CDD rule relief (Feb 2026). The first certification is therefore both the only check and the longest-lived one, and it should be built to be read by someone else: an examiner, an investigator with a subpoena, or the bank's own analyst in 2031.

The last question is the one most files fail. A customer's ownership changes; the file is updated; the version the examiner or investigator needs, the one the bank relied on when it opened the account, is overwritten. Keeping each version of the ownership picture by date is a small design choice with a large effect on whether the file can answer for itself.

The ownership tree as it stood on each date

The side panel answers the examiner's question directly: what changed, why, who approved it, and that no version is overwritten.

Where Beneficial Ownership Verification fits, now the file stands alone

The solution treats the bank's file as the record that it now is. Agents read every document in the packet, build the ownership tree twice on two different models, compare it with the certification person by person, verify each person's identity and screen people and entities against OFAC. The KYC analyst records each decision and a QC reviewer approves it; only then are the owners written to the client lifecycle and core systems. Every action by a person or an agent is kept with its evidence and reason, and an examiner pack collects the documents, every version of the tree and each decision with its maker and checker.

The audit trail and a sealed examiner pack

It does not replace what only people can supply: the customer's certification, the bank's judgment about what calls it into question, and the bank's decision to ask for more when a structure looks wrong. What it changes is how much of the file a reviewer can reproduce. Where the paper is complete but the ownership is not, the signals to look for are catalogued in how to verify beneficial ownership, and the cost of getting the first certification wrong in what a missed owner costs.

Questions people ask

Do US companies still have to file a BOI report with FinCEN?

No. FinCEN's interim final rule of March 2025, made final in August 2026, exempts companies created in the US from beneficial ownership reporting. Foreign companies registered to do business in the US still report, but need not report US-person owners.

Do banks still ask for a beneficial ownership certification?

Yes. The bank's obligation comes from the CDD Rule, 31 CFR 1010.230, which the CTA changes did not alter. A business opening its first account at a bank still certifies its owners of 25% or more and one controller, and the bank still verifies each person's identity.

Can a bank verify a customer's owners against FinCEN's database?

Not usefully for US companies. Access always required the company's consent, US companies no longer file, and FinCEN is deleting information it believes US persons provided. FinCEN has not issued final guidance on any role for its database in CDD verification.

Will FinCEN change the CDD Rule because of the CTA?

It says it must. The August 2026 final rule states that FinCEN "is still legally required to modify the CDD Rule" and can now "refocus" on it, and its February 2026 relief order is described as part of that duty. No proposed rule had been published as of October 2026.

Is beneficial ownership information confidential at a bank?

It is customer information held under the bank's privacy and BSA obligations, and it may be shared with law enforcement through the channels the BSA provides, such as subpoenas and suspicious activity reports. Inside the bank, good practice limits who sees identifiers such as dates of birth and ID numbers.

Does the CTA change mean banks should collect more beneficial ownership information?

The rule has not changed, so the minimum has not. Commenters asked FinCEN whether the end of US-company reporting "might imply an actual increase in financial institutions' CDD obligations", and FinCEN listed it as a point to clarify. Until it does, each bank decides on risk whether to ask for more, such as owning-entity documents.