Ongoing Customer Due Diligence

Deregulation in Customer Due Diligence

Financial institutions in the United States have long faced a requirement under the 2016 Customer Due Diligence (CDD) Rule to identify and verify the beneficial owners—typically individuals owning 25% or more or exercising significant control—of legal entity customers every time those entities opened a new account. This applied regardless of prior relationships or unchanged ownership, creating redundancy and administrative burden.

On February 13, 2026, the Financial Crimes Enforcement Network (FinCEN) issued an exceptive relief order that fundamentally alters this. Covered institutions—banks, credit unions, brokers, dealers, and similar entities—now need to collect and verify beneficial ownership information only when a legal entity opens its first account with them, when facts cast doubt on previously provided information, or as dictated by the institution's own risk-based ongoing due diligence procedures.

This shift comes amid a deregulatory environment, explicitly tied to Executive Order policies aimed at reducing private compliance costs and aligning with the Corporate Transparency Act (CTA). The CTA established a national beneficial ownership information (BOI) registry, which financial institutions can access, diminishing the need for duplicative collection from customers. Recent FinCEN actions, including narrowing CTA reporting to foreign entities only, further reduce overlap.

The real-world impact hits banks, credit unions, and other covered entities handling business accounts. They avoid repetitive paperwork and verification for established clients adding accounts, potentially saving significant staff time and costs. However, the core obligation for ongoing monitoring remains: institutions must watch for red flags, update information as risks evolve, and report suspicious activity.

A non-obvious tension lies in the balance between burden reduction and risk management. Critics might argue the relief could weaken scrutiny if institutions lean too heavily on old data without robust monitoring. Yet proponents see it as smarter, risk-focused compliance, freeing resources for higher-threat areas like emerging risks in crypto or high-risk jurisdictions. The order took effect immediately, prompting institutions to update policies swiftly.

Broader AML shifts, such as delayed investment adviser rules and EU consultations on harmonized due diligence, underscore a global trend toward more proportionate, less duplicative regimes—though U.S. relief stands out for its immediacy and scope.