CDD Relief in Practice: When Beneficial Owners Must Still Be Re-Verified

Answer in brief
FinCEN’s February 13, 2026 exceptive relief means covered financial institutions no longer have to identify and verify a legal entity customer’s beneficial owners at every new account opening. But re-verification is still required in three key situations: first account opening, when facts call prior BOI reliability into question, and when risk-based ongoing CDD procedures say it is needed. ([FinCEN.gov][2])

Who this applies to

FinCEN’s CDD rule applies to U.S. banks, mutual funds, brokers or dealers in securities, futures commission merchants, and introducing brokers in commodities. FinCEN says the CDD rule still has four core requirements, including customer identification, beneficial ownership identification, understanding the nature and purpose of the relationship, and ongoing monitoring. ([FinCEN.gov][2])

What changed in 2026

FinCEN’s exceptive relief removed the requirement to identify and verify beneficial owners each time the same legal entity customer opens a new account. FinCEN said covered institutions now must do that only when the legal entity first opens an account, when the institution knows facts that reasonably call earlier beneficial ownership information into question, or when risk-based ongoing CDD requires it. ([FinCEN.gov][3])

When beneficial owners still must be re-verified

The practical triggers are:

• the customer’s first account with the institution,
• any time there are facts suggesting the old beneficial ownership data may no longer be reliable,
• any time the institution’s ongoing, risk-based CDD process says updated ownership information is needed. ([FinCEN.gov][3])

What did not change

FinCEN expressly said the relief does not remove other AML/CFT obligations. Institutions still have to conduct ongoing monitoring, report suspicious transactions, and maintain and update customer information on a risk basis. ([FinCEN.gov][3])

The compliance trap

The trap is reading “CDD relief” as “no more beneficial ownership refresh.” That is wrong. The rule change removed one repetitive trigger, but it did not remove risk-based updating, suspicious activity obligations, or first-account ownership identification and verification. ([FinCEN.gov][3])