FinCEN's CDD Exceptive Relief: What the February 2026 Order Changes About Beneficial Ownership Verification at Account Opening

TL;DR

• FinCEN issued an exceptive relief order (FIN-2026-R001) on February 13, 2026, eliminating the requirement to re-collect beneficial ownership information every time an existing legal entity customer opens an additional account.
• The change does not remove the initial collection obligation — it removes the repeat-collection burden for returning business customers at the same institution.
• This is separate from, and does not affect, the Corporate Transparency Act’s BOI reporting obligations, which FinCEN addressed through a separate March 2025 interim final rule.
• BSA officers need to update CDD policies, account opening procedures, and staff training now.

If you’ve ever watched a frontline banker ask a longtime business customer to fill out the same beneficial ownership form they filed two years ago to open a new business checking account — and explained to a confused business owner why you need their CEO’s address again even though nothing has changed — you already understand the compliance problem FinCEN just fixed.

On February 13, 2026, FinCEN issued an exceptive relief order that eliminates the requirement for covered financial institutions to re-verify beneficial owners every time an existing legal entity customer opens a new account. It’s a targeted, overdue fix that most BSA officers will applaud — with one important caveat: the underlying CDD obligations aren’t gone. They’re restructured.

Here’s what changed, what didn’t, and what your policy and procedures need to reflect now.

The Old Rule: Every Account, Every Time

The Customer Due Diligence Final Rule, effective May 11, 2018, established a fifth pillar of BSA compliance for covered financial institutions: beneficial ownership identification and verification.

The core obligation required institutions to identify and verify the beneficial owners of legal entity customers “at the time a new account is opened.” The rule defined a legal entity customer broadly to include most businesses — LLCs, corporations, partnerships, trusts — and defined beneficial ownership through two prongs: a 25% equity ownership threshold and a single control prong (one individual with significant management authority).

On paper, the trigger was straightforward. In practice, it created a recurring burden: every time a business customer opened a new account — even a second checking account, a savings account, or a money market fund — the institution had to complete a new beneficial ownership certification. For large commercial clients with dozens of accounts, this meant repeated collections of the same information from the same ownership group.

Banks raised this with examiners. Compliance officers raised it in comment letters. The logic for collecting ownership information once — and updating it when something actually changes — was obvious.

FinCEN finally agreed.

What the February 2026 Order Changed

FinCEN’s exceptive relief order (FIN-2026-R001), issued February 13, 2026, grants covered financial institutions relief from the requirement to identify and verify beneficial ownership at each new account opening for existing legal entity customers.

Under the order, a covered financial institution is required to identify and verify beneficial owners only when:

1. A legal entity customer first opens an account with the institution
2. The institution has knowledge of facts that reasonably call into question the reliability of previously obtained beneficial ownership information
3. Otherwise required based on the institution’s risk-based procedures for ongoing customer due diligence

The practical effect: your BSA team no longer needs to collect a new CDD certification when Business Customer A opens their third business account, provided you collected accurate beneficial ownership information when they opened their first account and nothing has changed since.

What Didn’t Change

This is where BSA officers need to be precise.

The initial collection obligation is unchanged. Every new legal entity customer opening their first account still triggers full beneficial ownership identification and verification under the CDD Rule. The five-prong CDD program — customer identification, beneficial ownership, account purpose, risk understanding, and ongoing monitoring — applies in full.

The ongoing monitoring obligation is unchanged. Covered financial institutions are still required to maintain risk-based procedures for ongoing customer due diligence, including updating customer information when material changes occur. The exceptive relief removes the mechanical repeat-collection trigger at account opening; it does not remove the obligation to act when you learn something new.

The record retention requirements are unchanged. Beneficial ownership records must be retained for five years from the date of account opening, or, in the case of certifications, five years after the record is superseded.

Examiner expectations for quality haven’t shifted. If your beneficial ownership records are incomplete, inconsistent, or outdated because your ongoing monitoring program is inadequate, the exceptive relief doesn’t provide cover. Examiners will still assess whether your CDD program is reasonably designed to know your customers.

The CTA vs. the CDD Rule: Why Both Changed But Independently

There’s meaningful confusion in the market about how this order relates to the Corporate Transparency Act’s beneficial ownership changes. They’re separate, and the distinction matters.

What the CTA Changed (March 2025)

FinCEN’s interim final rule, published March 26, 2025, revised the definition of “reporting company” under the CTA to cover only entities formed under the law of a foreign country that have registered to do business in a U.S. state or tribal jurisdiction. Domestic U.S. companies — all corporations, LLCs, and other entities created under U.S. state law — are now exempt from BOI filing requirements.

This means your business customers no longer have an obligation to report their beneficial owners to FinCEN’s BOI database. The database, which covered financial institutions could theoretically access for customer due diligence purposes, is now materially incomplete for domestic entities.

What the CDD Relief Changed (February 2026)

The February 2026 order addresses what your institution must collect directly from customers under the CDD Rule. It does not interact with the CTA BOI database access question; it simply restructures when the collection obligation is triggered at the account level.

The practical implication: Your institution cannot substitute FinCEN’s BOI database for direct customer collection, particularly given the CTA’s domestic exemption. Your CDD program must collect beneficial ownership directly — the February 2026 order just makes that process less burdensome for existing customers.

The Risk-Based Re-Collection Trigger: What Counts as “Knowledge of Facts”

The February 2026 order replaced the mechanical “every new account” trigger with a risk-based standard: re-collect when the institution has “knowledge of facts that reasonably call into question” previously obtained information.

Examiners will look at how your procedures define this standard. It should be specific enough to drive consistent action, not vague enough to create discretion risk.

Examples that should trigger re-collection in any defensible CDD program:

Your CDD policy and procedures should explicitly list these trigger categories. Without documented procedures, an examiner cannot assess whether your ongoing monitoring program would reliably surface them.

What BSA Officers Need to Update Now

The February 2026 order is in effect. If your institution hasn’t updated its CDD program to reflect the change, you’re either:

• Still collecting unnecessary certifications from existing business customers (operational inefficiency), or
• Treating the order informally without updating your policy and procedures (documentation risk)

Neither is a good position heading into your next exam.

Five items to address:

1. Update Your CDD Policy

Your written CDD policy likely references the account-opening collection trigger in language consistent with the pre-2026 rule. Update it to reflect:

• Initial collection obligation at first account opening (unchanged)
• Risk-based re-collection when you have knowledge of facts calling prior information into question (new standard)
• Reference to FinCEN’s exceptive relief order FIN-2026-R001 as the authority

2. Revise Account Opening Procedures

Your account opening checklist or workflow probably includes a step to collect a beneficial ownership certification for all legal entity customers. Add a branching question: Is this customer opening an account for the first time at this institution? If no, confirm whether prior beneficial ownership information is current — if yes, no new certification is required.

3. Build or Strengthen the Re-Collection Trigger Process

If your institution doesn’t have explicit procedures for when to update beneficial ownership information during an existing relationship, build them now. The re-collection trigger process is where examiners will probe following the rule change. A policy that says “we’ll collect when something changes” without specifying what triggers that review is insufficient.

4. Brief Frontline and BSA Operations Staff

Branch personnel, commercial relationship managers, and deposit operations teams will encounter the practical change first. Many will still ask business customers to re-certify out of habit. Training should be specific: explain what changed, why, and what the new account opening workflow looks like for existing customers.

5. Document Your Rationale

Add a program note documenting that your CDD program reflects FinCEN’s FIN-2026-R001 exceptive relief, effective February 13, 2026. When your next exam opens, the examiner will ask whether your CDD policy is current. Having an explicit reference to the authority for the change reduces the risk of an unnecessary finding.

Connection to the April 2026 AML/CFT NPRM

If this CDD update feels like the beginning of a larger change, that’s because it is.

FinCEN’s April 2026 NPRM on AML/CFT Program Modernization proposes a comprehensive overhaul of how covered financial institutions must structure their BSA programs — shifting from a rules-based “five pillars” framework to a risk-based program centered on outcomes and documented risk assessment.

The February 2026 CDD exceptive relief is a preview of that direction: less mechanical compliance, more risk-based judgment. Once the AML/CFT NPRM is finalized — expected late 2026 — institutions will need to revisit their CDD programs again, this time more comprehensively.

What Examiners Will Ask

Don’t assume the CDD exceptive relief reduces examiner attention on beneficial ownership. FFIEC examiners continue to focus on:

• Whether initial collection is complete, accurate, and documented
• Whether ongoing monitoring is capable of surfacing material changes in customer ownership or control
• Whether re-collection procedures are sufficiently specific and consistently applied
• Whether beneficial ownership records are retained for the required period
• Whether CDD program documentation reflects current regulatory guidance

What’s changing is the mechanical trigger. What isn’t changing is the underlying risk that beneficial ownership was designed to address: knowing who actually controls the accounts at your institution.

For practical guidance on building and maintaining your BSA/AML documentation, see how BSA/AML Independent Testing and KYC Policy development feed into your overall compliance program.

So What?

The February 2026 CDD exceptive relief is a meaningful, practical improvement for covered financial institutions — but it doesn’t simplify your program as much as it might appear. The initial collection obligation, the ongoing monitoring obligation, and the record retention requirements are unchanged.

What changed is the account-opening trigger for existing customers. That’s a workflow update, a policy update, and a staff training update. Done correctly, it reduces unnecessary burden without creating gaps your next examiner would flag.

Do the documentation work now. A rule change with no corresponding policy update looks like you haven’t caught up.

The Compliance Essentials bundle includes the policy templates, compliance calendar, and monitoring program documentation that financial services teams use to build and maintain defensible BSA programs. Updated for the 2026 regulatory landscape.