FinCEN CDD Exceptive Relief: Reducing Repeat Beneficial Ownership Collection

FinCEN issued a pivotal exceptive relief order that eliminates the requirement to re-identify and re-verify beneficial owners at each new account opening for an existing legal entity customer. Instead, institutions are now required to collect beneficial ownership information at the first account opening and update it only when risk or reliability concerns arise.

On February 13, 2026, the Financial Crimes Enforcement Network (FinCEN) issued a pivotal exceptive relief order (FIN-2026-R001) that fundamentally changes how covered financial institutions collect and verify beneficial ownership information under the Customer Due Diligence (CDD) Rule. This order eliminates the requirement to re-identify and re-verify beneficial owners at each new account opening for an existing legal entity customer. Instead, institutions are now required to collect beneficial ownership information at the first account opening and update it only when risk or reliability concerns arise. This shift is designed to reduce operational burdens while maintaining strong anti-money laundering (AML) controls.

NETBankAudit experts have over 25 years of experience in CDD Rule audits and compliance. If you have any questions after reading this guide, please reach out to our team.

What the New Exceptive Relief Does

The exceptive relief order allows covered financial institutions to stop re-collecting and re-verifying beneficial ownership information at every new account opening for an existing legal entity customer. Instead, beneficial ownership identification and verification under 31 C.F.R. § 1010.230(b) is now limited to three scenarios:

When a legal entity customer first opens an account at the institution.
Any time thereafter when the institution has knowledge of facts that reasonably call into question the reliability of previously obtained beneficial ownership information.
As needed, based on the institution’s risk-based procedures for ongoing customer due diligence.

This relief is optional. Institutions may still choose to collect and verify beneficial ownership at each new account opening if it aligns with their risk appetite. Importantly, the order does not alter any other Bank Secrecy Act (BSA) or AML/CFT program, recordkeeping, or reporting requirements. The intent is to streamline compliance without weakening foundational controls, aligning beneficial ownership processes with the BSA’s risk-based framework and Treasury’s modernization efforts.

How This Changes the Prior CDD Rule Practice

Original CDD Rule Framework

Under the 2016 CDD Rule, covered financial institutions were required to:

Identify the beneficial owner(s) of each legal entity customer, generally at the time a new account is opened.
Verify each beneficial owner’s identity using risk-based procedures “within a reasonable time” after account opening.
Treat “new account” as “each account opened” by a legal entity customer on or after the applicability date, which in practice meant re-identifying and re-verifying beneficial owners every time the customer opened an additional account.

FinCEN previously attempted to ease this burden through several measures:

2018 FAQs allowed reuse of a prior CDD certification if the customer confirmed the information was still accurate and the institution had no contrary information, provided records of the certification/confirmation were maintained.
2018 exceptive relief for specific low-risk events, such as CD rollovers and certain renewals/extensions without underwriting.
COVID-era guidance generally did not require re-verification of beneficial ownership for existing PPP borrowers.

Despite these efforts, industry feedback consistently highlighted that the “each new account” trigger was operationally burdensome and produced little incremental AML benefit, especially for large corporate customers frequently opening multiple accounts.

New Standard vs. Old Standard

Element	Old CDD Rule Expectation	New Exceptive Relief Standard
Trigger for BO collection	Every “new account” by a legal entity customer.	First account only, plus risk-based or reliability triggers.
Existing customer, new account	Re-identify and re-verify each time.	No automatic re-collection required.
Risk-based updates	Required as part of ongoing CDD.	Explicitly a main trigger for BO refresh.
Ability to exceed minimums	Not framed as optional extra.	Institutions may voluntarily continue “each account” practice.

Operational Impact and Conditions

When Institutions Must Still Act

Even with the new relief, institutions must still identify and verify beneficial owners in the following situations:

A legal entity customer opens its first account.
Monitoring or other information suggests beneficial ownership information may be inaccurate, incomplete, or outdated (such as after an acquisition, restructuring, public filings, or adverse media).
The institution’s own risk-based procedures call for updating beneficial ownership information, for example, during periodic reviews of high-risk entities.

In the third scenario, institutions may rely on previously obtained beneficial ownership information if the customer certifies or confirms verbally or in writing that the information is current and accurate, and the institution keeps a record of that certification or confirmation. If the customer cannot certify accuracy, or if the institution has knowledge of facts casting doubt on the information’s reliability, the institution must identify and verify beneficial owners again under the CDD Rule.

Interaction with Risk-Based AML Programs

FinCEN stresses that institutions must still maintain written procedures “reasonably designed” to identify and verify beneficial owners and include them in their AML program. Ongoing monitoring and, on a risk basis, maintaining and updating customer information (including beneficial owners) remain core obligations. The order is intended to align beneficial ownership processes with the BSA’s risk-based framework and Treasury’s broader modernization efforts, not to weaken foundational controls. Institutions may choose to not use the relief or to use it only for some customer segments, depending on their risk profiles and tolerances.

Drivers, Context, and Sector-Specific Notes

Policy and Regulatory Drivers

Several factors drove FinCEN’s decision to issue this relief:

Ongoing concerns from banks and trade associations about duplicative, low-value work in re-certifying beneficial ownership at every account.
Executive Order 14192, “Unleashing Prosperity Through Deregulation” (Jan. 31, 2025), which directs agencies to reduce private compliance costs and alleviate unnecessary regulatory burdens.
FinCEN’s obligations under the Corporate Transparency Act (CTA) to revise the CDD Rule and reduce unnecessary or duplicative burdens in light of the beneficial ownership information (BOI) reporting regime.

FinCEN views this exceptive relief as an interim, targeted step while it works on broader CDD Rule amendments through notice-and-comment rulemaking.

Impact on Credit Unions and Other Covered Institutions

America’s Credit Unions and related compliance resources highlight this order as Bank Secrecy Act regulatory relief for business accounts. The exceptive order removes the requirement for credit unions to identify and verify beneficial ownership for business members each time they open a new account. Credit unions may limit collection and verification to the first account, reliability-questioning events, and as needed under risk-based CDD procedures, mirroring the general order. Use of the exceptive relief is optional; credit unions must still meet all other BSA/AML obligations. For credit unions, this offers particular operational relief for business members that frequently open new sub-accounts or specialized accounts, while still tying updates to risk-based monitoring and ongoing CDD processes. This change is also applicable to all covered financial institutions, not just credit unions, as confirmed by legal analysis of the order.

Practical Compliance Steps and Risk Considerations

Institutions implementing the relief will typically need to:

Update CDD policies and procedures to incorporate the new trigger framework (first account plus risk-based/reliability triggers) and define internal standards for when facts “reasonably” call information into question.
Modify account-opening workflows and systems so that additional accounts for existing legal entity customers do not automatically trigger new beneficial ownership collection, while still capturing required certifications when a risk-based review is initiated.
Enhance monitoring and customer review processes to ensure they detect changes or red flags that should trigger a beneficial ownership refresh.
Train front-line and AML staff on when they may rely on existing beneficial ownership information, how to obtain and document verbal or written confirmations, and when to escalate for full re-identification.

From a risk perspective, institutions must be able to show examiners that reduced duplication is offset by robust risk-based monitoring and clear rationales for when beneficial ownership information is revisited, rather than simply collecting less data without compensating controls.

Sector-Specific Relief for Credit Unions

Credit unions, in particular, benefit from this relief as it reduces the operational burden of repeatedly collecting beneficial ownership information for business members who frequently open new sub-accounts or specialized accounts. The relief allows credit unions to focus their resources on risk-based monitoring and ongoing due diligence, rather than duplicative data collection. For more on the credit union perspective, see FinCEN issues Bank Secrecy Act relief for credit unions.

Broader Applicability Across Financial Institutions

While much of the discussion has focused on credit unions, the exceptive relief applies to all covered financial institutions under the CDD Rule, including banks and other entities. The order’s language and supporting legal commentary confirm its broad applicability, ensuring that all covered institutions can benefit from reduced duplication and more efficient compliance processes. For a detailed breakdown, refer to information sharing across borders to combat illicit finance.

Partner with NETBankAudit to Enhance Compliance

The FinCEN exceptive relief order marks a significant step toward aligning beneficial ownership collection with risk-based principles and operational efficiency. By eliminating unnecessary duplication, institutions can focus on meaningful risk management and ongoing due diligence. However, the relief does not diminish the importance of robust AML controls or the need for vigilant monitoring and documentation.

For financial institutions seeking to update their CDD programs and ensure compliance with the latest FinCEN guidance, NETBankAudit offers tailored audit and advisory services. Our team can help you implement risk-based procedures, update policies, and train staff to meet evolving regulatory expectations. To discuss how these changes impact your institution, contact NETBankAudit today.

THE GOLD STANDARD IN
Cybersecurity and Regulatory Compliance

Request For Proposal Ask a Question

 
class SampleComponent extends React.Component { 
  // using the experimental public class field syntax below. We can also attach  
  // the contextType to the current class 
  static contextType = ColorContext; 
  render() { 
    return <Button color={this.color} /> 
  } 
}

FinCEN CDD Exceptive Relief: Reducing Repeat Beneficial Ownership Collection

What the New Exceptive Relief Does