Ongoing Customer Due Diligence

U.S. Deregulation in AML Compliance

In mid-February 2026, the U.S. Treasury's Financial Crimes Enforcement Network (FinCEN) issued an exceptive relief order that fundamentally alters how financial institutions handle customer due diligence under the Bank Secrecy Act. The 2016 CDD Rule had required covered institutions—banks, credit unions, brokers, and others—to identify and verify beneficial owners of legal entity customers each time those customers opened a new account, a process many viewed as redundant and costly after the first interaction.

The new order eliminates that per-account requirement, restricting verification to three scenarios: the customer's first account with the institution, cases where facts cast doubt on prior information, and situations triggered by the institution's own risk-based ongoing monitoring procedures. This change took effect immediately and aligns with broader efforts to reduce regulatory burdens while preserving core protections against money laundering and terrorist financing.

The stakes are concrete for the industry. Repetitive verifications had imposed operational overhead, particularly for institutions serving active business clients who frequently open additional accounts. Relief promises efficiency gains and lower private-sector compliance expenditures, without eliminating the duty to conduct ongoing CDD, which includes monitoring for suspicious transactions and updating customer information on a risk basis. Failure to maintain effective ongoing monitoring still exposes institutions to enforcement actions and substantial fines.

A key non-obvious angle is the interplay with other regulations, such as the Corporate Transparency Act, which FinCEN cites as a driver for reducing duplicative burdens. The order signals potential future rulemaking to further streamline the CDD framework. Meanwhile, in parallel jurisdictions, ongoing CDD faces tightening: Australia's reforms mandate it from March 31, 2026, and the EU's AML Authority is consulting on detailed standards in early 2026 for application in 2027. These developments highlight a global tension between risk-focused efficiency and sustained vigilance against financial crime.