Beneficial owner declaration for existing customers: the 2018 line

A beneficial owner declaration for existing customers is not required by FinCEN's rule for business accounts opened before May 11, 2018: the CDD rule's own FAQ answers "No. The rule does not cover existing accounts that were opened before the applicability date." For accounts opened since, the certification should already have been taken at opening. What reaches the back book is the separate duty to maintain and update customer information, beneficial owners included, on a risk basis, so a bank's remediation scope for older business files is a risk decision it must write down and defend. Botminds' KYC Remediation applies that written scope to every business file, searching the bank's own loan and imaging records for certifications before any customer is asked.

The examples come from a fictional sample institution, Norrell Federal Credit Union, whose merger brought 6,120 business member files without verified beneficial owners. The rules are linked to FinCEN's and the regulators' own texts.

Do accounts opened before 2018 need beneficial ownership?

Not under the beneficial ownership rule. 31 CFR 1010.230 requires a bank to identify the owners of a legal entity customer when it opens a new account, and FinCEN's consolidated FAQs, re-issued on May 6, 2026, are explicit that the rule does not cover accounts opened before its applicability date of May 11, 2018 (FinCEN, CDD Rule FAQ C.3). A business that has banked with the same institution since 2012 and never opened another account was never owed a certification under the rule.

That answer is narrower than it looks, for two reasons. First, "account" is broad: a loan, a line of credit or a new deposit account opened after May 11, 2018 was a new account, and should have brought a certification with it. Many back-book business customers therefore already have one, sitting in a loan file rather than on the deposit record. Second, the rule is not the only duty. The ongoing due diligence requirement applies to every customer, whenever the account was opened.

Does the CDD rule apply to existing accounts? The ongoing duty does

The beneficial ownership requirement does not apply to pre-2018 accounts, but the ongoing due diligence requirement in the same rulemaking does. 31 CFR 1020.210 requires risk-based procedures for understanding each relationship, for ongoing monitoring and for keeping customer information current where risk calls for it, and it says that customer information includes "information regarding the beneficial owners of legal entity customers" (31 CFR 1020.210(a)(2)(v)).

So the honest summary for a BSA officer is this. There is no blanket duty to collect a declaration from every pre-2018 business customer. There is a duty to collect or update ownership when the bank's own monitoring makes it relevant to the customer's risk, and to have procedures that say when that is. A remediation that targets older business files is the bank applying those procedures across a book at once, usually because they were not applied file by file.

When must beneficial ownership be updated for existing customers?

Beneficial ownership must be updated for an existing customer when the bank learns something in the course of normal monitoring that is relevant to the customer's risk, including a possible change of owner. FinCEN's FAQ puts it in those terms: "the obligation to obtain or update information is triggered when, in the course of normal monitoring", the institution becomes aware of information relevant to assessing or reassessing the customer's risk profile (FAQ B.18).

What happens next depends on what changed. If only an existing owner's address changed, FinCEN says a fresh certification is probably unnecessary. If ownership changed, "then the new beneficial owner's identity would need to be collected, certified, and verified" (FAQ B.19). And since February 13, 2026, FinCEN's exceptive relief lets a bank that re-identifies under its ongoing due diligence rely on ownership it already holds once the customer confirms, in writing or by word of mouth, that it is still current and accurate, and the bank records that confirmation (FinCEN's 2026 CDD rule relief reads the order); if the customer cannot confirm, the bank identifies and verifies afresh (FIN-2026-R001).

Is a periodic review a trigger for beneficial ownership?

No. FinCEN's FAQ says that institutions do not have to solicit or update ownership as a matter of course during regular or periodic reviews, and that "periodic reviews are not by themselves a trigger to obtain or update beneficial ownership information" (FAQ B.18). A bank may choose to ask at review, especially for higher-risk customers, but that is policy, and a remediation scope should label it as policy.

The distinction matters in a remediation because programmes often bundle a periodic review and a back-book clean-up into one letter. If the letter tells a customer the regulation requires a new certification, and the account predates the rule, the bank has misstated the law to its own customer. "Our policy asks" is accurate; "federal law requires" is not.

The CommunityBank of Texas lesson: a new question never asked of the back book

The rule's line does not protect a bank that raises its own standard and leaves the back book behind it. In its 2021 action against CommunityBank of Texas, FinCEN described a bank that added an international transactions question to its CDD questionnaire on May 28, 2019, after a particular customer was already onboarded, and then: "Thereafter the Bank did not go back to ask that question to the previously on-boarded customer" (FinCEN Consent Order No. 2021-03). The bank paid an $8,000,000 civil money penalty for its AML failures, of which that was one.

Thereafter the Bank did not go back to ask that question to the previously on-boarded customer.

FinCEN, CommunityBank of Texas, N.A., December 16, 2021

The lesson for ownership is direct. Once a bank decides that knowing the owners of a business customer matters to risk, which every bank with a 2018 certification process has decided, it needs a reasoned position on the business customers it onboarded before that decision. "The rule did not require it" answers the regulatory question; it does not answer the risk question, and examiners ask both. The OCC's 2024 order against Blue Ridge Bank required ownership information for every customer, both at opening and on an ongoing basis (OCC AA-ENF-2023-68), which is what an order looks like when a bank's own line was not drawn in time; BSA consent orders that ordered KYC remediation sets that order beside the others.

Why the bank's file is now the only owner record for US companies

Since 2025, the bank's own certification is the only routine record of who owns a US business customer. FinCEN exempted domestic companies from beneficial ownership reporting under the Corporate Transparency Act in an interim final rule of March 26, 2025, and made the exemption final on August 14, 2026 (91 FR 52508). The same final rule says the two regimes are separate and that FinCEN still has a legal duty to revise the CDD rule, which it has not yet proposed.

For a remediation, that removes a shortcut some programmes were planning on. There is no federal registry entry to check a US customer's owners against, and bank access to the database required the reporting company's consent in any case. The certification in the bank's file, and the evidence that it is current, is the record. For older business files that is a reason to find the certifications the bank already holds before deciding which customers to ask.

Where back-book certifications already sit

Back-book certifications usually already exist for any business customer that opened a loan, a line or a new deposit account after May 11, 2018, but they sit wherever that account was opened. A commercial loan's certification is in the loan origination system or the loan's imaged closing package; a treasury account's may be in a separate onboarding tool. The deposit record that the remediation tests may show nothing at all.

A certification found in a loan file, with the lines the agent used highlighted

The sample programme shows how much this changes the work. Of 5,614 business files with no verified owners and no work started, a single search of the acquired loan files found a signed certification for 5,222 and current identification for 11,215 of 11,874 owners and control persons. 4,103 certifications agreed with the business's latest state annual report; 1,119 showed a changed owner or officer and went to the customer for one item. In the end 3,982 files closed from the credit union's own records, 1,240 needed one item and 392 needed a full request.

Requests held until the bank’s own records have been searched

Writing the beneficial ownership scope for a back-book remediation

A defensible back-book scope says which business files must carry verified owners, why, and what evidence counts. It distinguishes what the rule requires from what policy adds, so that letters, board reports and examiner answers say the same thing. And it records the risk reasoning, so that the decision not to ask a low-risk 2012 customer is as documented as the decision to ask a high-risk one.

One more line belongs in the scope: what examiners will test. The FFIEC's beneficial ownership examination procedures, in the version captured in April 2026, direct examiners to sample legal entity accounts opened "since May 11, 2018" (FFIEC BSA/AML Examination Manual, beneficial ownership procedures). A remediation that cleans up older files is doing more than that sample tests, and should say so; one that skips post-2018 accounts with no certification is leaving exactly the files an examiner will pull. The KYC remediation process shows where the scope is applied file by file.

How KYC Remediation applies a written scope to business files

KYC Remediation makes the scope a versioned setting and applies it the same way to every file. Its Gap Finder sorts business files into the ownership cohort under the approved scope; its Records Searcher looks in the loan origination system, document imaging and state business filings, and proposes closing a file only when the certification, the owners' identification and a state report from the last 12 months agree; its Screening agent screens every owner and control person, and any similar name goes to a person.

Disagreement is never resolved by the agents. In the sample, a 2019 certification for one business names a single member while the current state report lists a second, so the file is not closed; the member is asked only for the item that settles it. Every beneficial owner batch goes to the BSA officer, who samples 40 files stratified by loan type before approving, and every answer the agents give about a file points to the scope version and the record behind it. To see the scope, the search and the batch together, start from KYC Remediation.

Questions people ask

What is the beneficial ownership rule's effective date?

FinCEN published the CDD rule on May 11, 2016, and covered institutions had to comply from May 11, 2018, the applicability date. Accounts opened before that date are outside the beneficial ownership requirement, according to FinCEN's FAQ C.3. The ongoing due diligence requirement applies to all customers.

Do existing business customers need a new beneficial ownership certification for each new account?

Not since FinCEN's exceptive relief of February 13, 2026, if the bank chooses to use it. A bank may limit identification and verification to the customer's first account, to cases where facts call the information into question, and to what its risk-based ongoing due diligence requires. It may rely on prior information the customer confirms, verbally or in writing, and must keep a record of the confirmation.

Can we tell a customer the law requires a new beneficial ownership declaration?

Only if it does. For an account opened before May 11, 2018 with no later account, the federal rule does not require one, so the accurate wording is that the bank's policy asks for it. Customers who are told the wrong reason tend to call, and the contact center has to correct it.

Can we use FinCEN's beneficial ownership database for existing US customers?

Not in practice. US companies have been exempt from reporting since March 2025, made final on August 14, 2026, and bank access always required the reporting company's consent. FinCEN has said it still needs to revise the CDD rule and has not proposed how.

What if the certification in our file and the state's records disagree?

Treat it as a fact that may call the certification into question. Do not close the file on either source; ask the customer for the one item that settles the difference, and record both sources and the answer. If ownership has changed, the new owner is collected, certified and verified, as FinCEN's FAQ B.19 describes.