The FinCEN CDD rule relief is exceptive order FIN-2026-R001, issued on 13 February 2026, which releases banks and other covered institutions from the Customer Due Diligence Rule's requirement to identify and verify a legal entity customer's beneficial owners each time it opens a new account. A bank that adopts it may limit that work to three scenarios: the customer's first account, any later moment when the bank "has knowledge of facts that would reasonably call into question" the owner information it holds, and whenever its own risk-based ongoing due diligence calls for it. In the third scenario it may rely on the information it already has if the customer confirms, verbally or in writing, that it is still accurate, and it must keep a record of that confirmation. For BSA officers the relief turns a mechanical step at every account into a judgment the bank must write down. Botminds' Beneficial Ownership Verification exists to make that judgment and its evidence visible on every file.
The order is short and its consequences are not. It does not change the first certification, the verification standard or the records, and it does not bind the bank to use it: "The extent to which a covered financial institution avails itself of the exceptive relief provided below is within the discretion of the covered financial institution" (FIN-2026-R001). What changes is the second account, and the third, and every renewal after that.
What changed at the second account
Before 13 February 2026: Owners identified and verified again, or the earlier certification relied on with a fresh confirmation that it is current (2018 FAQ guidance).
With the relief adopted: Opening the account does not, by itself, require anything. The bank identifies and verifies only in the three scenarios.
Before 13 February 2026: Certifies again, or confirms the earlier certification, at every new account.
With the relief adopted: Nothing, unless the bank knows of contrary information or its risk procedures call for an update.
Before 13 February 2026: Full update under ongoing due diligence.
With the relief adopted: May rely on the earlier information if the customer confirms it, verbally or in writing, and the confirmation is kept.
Before 13 February 2026: Identify and verify again.
With the relief adopted: Identify and verify again, in full: unchanged.
Before 13 February 2026: Covered by the September 2018 relief for renewals without new underwriting.
With the relief adopted: The bank may skip the confirmation at renewal entirely, absent scenario 2 or 3 (FAQ C.6).
Before 13 February 2026: A certification or a confirmation for each new account since 11 May 2018.
With the relief adopted: A first-account certification, and the bank’s written reason for anything it did, or did not do, afterwards.
What is the FinCEN CDD rule relief, FIN-2026-R001?
It is an exception order under 31 U.S.C. 5318(a)(7), not an amendment to the rule. The text of 31 CFR 1010.230 still says to identify each legal entity customer's owners "at the time a new account is opened" (1010.230(b)(1)), and the rule defines a new account as each account opened on or after 11 May 2018. FIN-2026-R001 grants relief from that requirement "at each new account opening" and lets institutions substitute the three scenarios. FinCEN describes it as part of its obligation under the Corporate Transparency Act to revise the 2016 rule, and says it "anticipates pursuing further changes to the 2016 CDD Rule through the rulemaking process".
Two features of an exception order matter to a procedure writer. It can be withdrawn: FinCEN notes that such exceptions "may be revoked at FinCEN's discretion". And it sits beside, not inside, the published rule and the examination manual, so the bank's procedure has to point to it by name. FinCEN's news release summarised the effect in one line: the order "excepts covered financial institutions from the requirement to identify and verify the beneficial owners of a legal entity customer each time the customer opens a new account" (FinCEN, 13 February 2026). NCUA relayed it to federally insured credit unions four days later (NCUA, 17 February 2026).
What are the three scenarios in the FinCEN order?
A bank that adopts the relief identifies and verifies a legal entity customer's owners in three scenarios only, and each has a different evidence standard.
Scenario 1, the first account. When a legal entity customer "first opens an account with a covered financial institution", the full rule applies: a certification from the person opening the account, verification of each person to Customer Identification Program standards, and the records in 1010.230(i). This is now the certification that carries the relationship, which is why the arithmetic behind it has to hold (see UBO verification, traced from clause to signature).
Scenario 2, knowledge that casts doubt. "Any time thereafter when the covered financial institution has knowledge of facts that would reasonably call into question the reliability of beneficial ownership information previously obtained." The wording is the rule's own reliance test, moved from account opening to the life of the relationship. A registry filing that adds a member, an adverse-media hit on a named owner, a wire pattern inconsistent with the stated business: once the bank knows, the earlier certification no longer carries it.
Scenario 3, the bank's own risk procedures. "As needed based on a covered financial institution's risk-based procedures for conducting ongoing customer due diligence." Here the bank decides what triggers an update. And here alone the order offers a lighter path: the bank "may rely on beneficial ownership information previously obtained … provided the customer certifies or confirms (verbally or in writing) that such information is up-to-date and accurate".
FIN-2026-R001 in four numbers
3
scenarios in which a bank still identifies and verifies owners after adopting the relief
first account, doubt, risk procedures
0
new certifications a new account requires by itself, for a bank that adopts it
FAQ C.6
2
ways a customer may confirm earlier information: verbally or in writing
a record of either is kept
1
path back to full verification: the customer cannot confirm, or the bank knows better
Is the FinCEN CDD relief mandatory?
No. The order says so twice, and the May 2026 FAQs repeat it: a bank "may elect to either establish or continue existing customer due diligence processes of identifying and verifying the identities of a legal entity customer's beneficial owners at each new account opening" (FAQ B.1.b). FinCEN adds that the relief "does not discourage covered financial institutions from exceeding minimum compliance requirements should doing so align with their risk profile and tolerance".
That leaves three positions a bank can take, and each needs to be written down. It can keep certifying at every account. It can keep asking for a confirmation at every account, as the 2018 guidance allowed, which costs a phone call and keeps a dated statement in the file. Or it can adopt the order fully and ask for nothing at a second account unless scenario 2 or 3 applies. The choice can differ by line of business: a treasury desk opening a dozen subaccounts for one corporate group in a week has a different case from a branch opening a second checking account for a three-member LLC.
"The extent to which a covered financial institution avails itself of the exceptive relief provided below is within the discretion of the covered financial institution."
FinCEN, order FIN-2026-R001
Does a verbal confirmation count for beneficial ownership?
Yes, in the cases the order and the FAQs describe, as long as it is recorded. In scenario 3 the bank may rely on earlier information if the customer "certifies or confirms (verbally or in writing)" that it is current, and "must maintain a record of such certification or confirmation, including for both verbal and written confirmations" (FIN-2026-R001). FAQ D.3 applies the same standard to a bank that still asks at each new account. A confirmation that exists only in a banker's memory does not count, because nothing shows the examiner it happened.
The record needs four things to be useful: who confirmed, on behalf of which customer, when, and what exactly was confirmed (the owners and controller as last certified, not just "no changes"). Verbal confirmation also has a limit. It covers information that is unchanged. If the owners have changed, the new owner must be identified, certified and verified from scratch (FAQ B.19), and no phone call substitutes for that.
Do we need a beneficial ownership form for every new account now?
Not if your bank has adopted the relief: a new account for an existing legal entity customer "does not, by itself, require" identification and verification (FAQ C.6). It is still required for a customer's first account at your bank, and whenever scenario 2 or 3 applies. Two traps sit in the word "existing". A customer is existing at the institution, not at an affiliate with a separate charter, unless the bank relies on that affiliate under the rule's reliance provision, which needs a contract and an annual certification (1010.230(j)). And a customer whose only earlier account opened before 11 May 2018 never gave a certification under the rule, because the rule does not reach accounts opened before that date (FAQ C.3); for that customer the next account is, in practice, the first certification.
What the relief leaves unchanged
More than it changes. The bank still needs written procedures "reasonably designed to identify and verify" owners (1010.230(a)), still verifies each person to CIP standards at the first account, and still keeps the certification five years after the account closes and each verification record five years after it is made. Ongoing due diligence is untouched: banks must still, "on a risk basis, maintain and update customer information", including beneficial ownership (31 CFR 1020.210). Periodic reviews still do not, by themselves, trigger a beneficial ownership update (FAQ B.18). And the account exemptions in 1010.230(h), for point-of-sale credit, postage, insurance premium and equipment finance, are unaffected.
The Corporate Transparency Act side has moved in the other direction. US companies stopped reporting to FinCEN under the March 2025 interim rule, made final in August 2026 (91 FR 52508), and FinCEN says it is still legally bound to revise the CDD rule now that the reporting rule is settled. The relief is therefore one step in a rewrite that is not finished. Why the bank's own file is now the main US record of who owns a business is the subject of beneficial ownership information at banks.
The dates behind the second-account rule
| Date | What happened | What it means for the second account |
|---|---|---|
| 11 May 2016 | CDD Rule published (81 FR 29398) | Owners identified at each new account, once the rule applies |
| 3 Apr 2018 | FinCEN FAQs on the rule | A bank may rely on an earlier certification if the customer confirms it, and keep the confirmation |
| 11 May 2018 | Rule applies | Accounts opened from this date are “new accounts”; earlier ones are not covered |
| 7 Sep 2018 | Relief for rollovers and renewals | CD rollovers and loan renewals without underwriting need no new certification |
| 26 Mar 2025 | Interim rule exempts US companies from reporting to FinCEN | The bank’s certification becomes the main US record of a US company’s owners |
| 13 Feb 2026 | Order FIN-2026-R001 | Optional: identify and verify only in the three scenarios |
| 6 May 2026 | Consolidated CDD FAQs re-issued | FAQs B.1.b, C.2, C.6 and D.3 rewritten around the order |
| 14 Aug 2026 | Final rule on beneficial ownership reporting | The US-company exemption made permanent; a CDD Rule revision still owed |
The exam gap: the FFIEC procedure still samples accounts opened since 11 May 2018
The FFIEC's published examination procedure for beneficial ownership has not been updated for the order, as far as we could find. In the version published in April 2026, the latest we could read, step 3 tells examiners to "select a sample of new accounts opened for legal entity customers since May 11, 2018" and to determine whether the bank "opened the account in accordance with the requirements of the Beneficial Ownership Rule", including whether it "obtained the identifying information for each beneficial owner" (FFIEC BSA/AML examination procedures, beneficial ownership). Read literally, that sample now includes second and third accounts for which an adopting bank holds no new certification.
The supervisors know about the order. The OCC's spring 2026 risk report notes that "on February 13, 2026, FinCEN issued exceptive relief to streamline customer due diligence requirements" (OCC Semiannual Risk Perspective, Spring 2026). The practical answer is documentary: a bank that uses the relief should be able to hand an examiner, for any sampled account, the board-approved procedure that adopts it, the first-account certification it relied on, and the reason no new identification was owed. Step 2 of the same procedure asks whether the bank's risk-based procedures for keeping customer and ownership information current are adequate, which is precisely what scenario 3 depends on.
Writing the procedure: what a BSA officer has to decide
Adopting the relief takes a handful of written decisions, and most of them concern scenarios 2 and 3, because those are where judgment replaces a fixed step. The checklist below is the minimum we would expect a procedure to answer before the first second account is opened under it.
Seven decisions to write down before adopting the CDD rule relief
- Where the relief applies
All legal entity customers, or some lines of business only; and whether the bank still takes a confirmation at each new account by choice.
- What counts as knowledge that casts doubt
Registry filings, a new signer or member, sanctions or adverse-media alerts on an owner, activity inconsistent with the stated business.
- Which risk events trigger an update
A risk-rating change, a change of control reported by the customer, a new high-risk product: the bank’s own list, applied consistently.
- How a confirmation is taken and kept
Who may take it, verbal or written, what exactly is confirmed, and where the dated statement is stored.
- What happens when the customer cannot confirm
Full identification and verification, as the order requires, with a deadline and a consequence.
- How an examiner sample is answered
For any account since February 2026: the first certification, the procedure, the determination and its reason.
- How the bank reverts if the relief is withdrawn
Exception orders may be revoked; keep the every-account process documented and ready.
One decision deserves care because it is easy to blur. A bank may well want a higher customer risk rating to trigger a fresh look at the owners. That is a sound policy, and it is the bank's policy: under the order, a risk-based trigger is scenario 3, where the bank may still rely on a recorded confirmation. Only an inability to confirm, or knowledge that casts doubt, makes full re-identification a requirement of the order itself. A procedure that requires full re-verification on every risk upgrade is stricter than the order, which is allowed, and should say that it is a choice.
How Beneficial Ownership Verification applies the relief, account by account
The solution treats each new account for an existing customer as a determination to be made and recorded, not a step to skip. A Relief agent reads the last verification, the customer's confirmation if the bank's procedure asks for one, and anything since that would reopen the question: a new member in a registry filing, a refused confirmation, a change in the customer's risk rating. It proposes "not owed" or "re-verify" with the reason, and a KYC analyst confirms or overrides each one. The screen below uses a fictional bank, Corvane National Bank, whose own procedure asks for a confirmation at every later account and re-verifies on a move to high risk: both stricter than the order, both written as Corvane's choices.
Existing customers: is re-verification owed under the relief order?
The October panel is the examiner's answer in one place: 233 determinations, each with a reason code, none without one.
Two controls make the relief defensible rather than merely cheaper. Every determination has a maker and a checker, and the analyst who records a decision can never approve it. And every confirmation, verbal or written, is kept with the date, the person who gave it and what was confirmed, for as long as the rule requires. The roles screen shows how the bank's BSA officer, not an administrator or an agent, owns the thresholds and the procedure behind them.
Who may decide what: roles and separation of duties
What the solution does not do is decide, on the bank's behalf, whether to adopt the order. That is a policy choice for the BSA officer and the board, and the solution's settings simply carry it out. How each person's identity is verified at the first account, which is the account the relief leans on, is traced step by step in UBO verification, traced.
Questions people ask
What is beneficial ownership exceptive relief?
It is an order in which FinCEN exempts covered institutions from part of a rule without amending the rule's text. The February 2026 order, FIN-2026-R001, exempts them from identifying and verifying a legal entity customer's owners at each new account. Earlier orders gave similar relief for CD rollovers and loan renewals in September 2018.
Does the 2026 relief apply to credit unions and broker-dealers?
Yes. It applies to all "covered financial institutions" under the CDD Rule, which include federally regulated banks, federally insured credit unions, brokers or dealers in securities, mutual funds and futures commission merchants. NCUA relayed the order to credit unions on 17 February 2026.
Do we have to re-verify owners when a customer's risk rating goes up?
Only if your procedure says so. A risk-based trigger falls under the order's third scenario, where the bank may rely on earlier information if the customer confirms it is current and the confirmation is kept. Full re-identification is required by the order when the customer cannot confirm or the bank knows of information that casts doubt.
Does the relief cover a business whose first account opened before May 2018?
Only from its first certification. The rule never covered accounts opened before 11 May 2018 (FAQ C.3), so a business whose only account predates that date has never certified its owners at your bank, and in practice gives its first certification at its next new account.
Is the beneficial ownership rule changing again?
Probably. FinCEN says the order is part of its Corporate Transparency Act duty to revise the 2016 rule and that it "anticipates pursuing further changes … through the rulemaking process". As of October 2026 no proposal to amend 31 CFR 1010.230 had been published.
Can examiners still cite a bank for not certifying a second account?
Not for following the order, but the bank has to show it adopted it. The FFIEC procedure as last published still samples accounts opened since 11 May 2018, so the file for each sampled account should show the procedure, the first-account certification and the reason no new identification was owed.