FinCEN's New CDD Rule: What Changed for Banks and Businesses

Banks used to open accounts for companies without really knowing who was behind them.

That loophole is exactly what the FinCEN CDD rule was written to close.

What Is FinCEN's Customer Due Diligence (CDD) Rule?

A company name doesn't tell you much about who's actually running it, so regulators pushed institutions toward something more thorough than a basic ID check. So what is customer due diligence? At its simplest, it's confirming who an account holder really is, what they're doing with their money, and flagging it when something looks wrong.

What is customer due diligence?

Cut through the jargon, and it comes down to three things: verify identity, understand the business, watch for anything odd. What's changed is how much proof banks now need on file. Businesses going through incorporation with Icon.Partners usually notice the overlap, since it mirrors the checks tied to company incorporation itself.

Purpose of the FinCEN CDD Rule

Shell companies are basically why this rule exists in the first place. Layered ownership and offshore holding chains made moving dirty money through a “normal-looking” account far too easy. 

Regulators wrote customer due diligence requirements into law, bringing U.S. practice roughly in line with what's already standard in Europe and much of Asia: know the actual owner, not just the paperwork owner.

Customer Due Diligence Requirements

Four things anchor the compliance setup: verify identity, identify beneficial owners, understand what the relationship is for, and keep monitoring once the account is live. None of that shrinks for smaller institutions — a two-branch credit union answers to the same rulebook as a national bank.

Core CDD requirements for financial institutions

Onboarding itself is pretty mechanical: name, date of birth, address, an ID number. The real work starts after, since ongoing monitoring is where a program proves itself — a payment that doesn't match usual behavior should raise a flag instead of sliding through. Meeting CDD requirements also means training the front desk, since they're usually first to spot something odd.

Beneficial ownership identification and verification

Anyone owning 25% or more of a legal entity has to be identified, plus someone running day-to-day operations. Sounds simple until trusts or multi-layer structures show up — a trading company might route ownership through several entities before anyone can name an actual human. That tracing process is usually where account opening grinds to a halt.

What Changed Under the New FinCEN CDD Rule?

The recent updates pull this closer to the beneficial ownership reporting under the Corporate Transparency Act, narrowing the gap between what a company files directly with regulators and what a bank still has to check.

Key regulatory updates

Banks now have clearer instructions on how much weight to give ownership data already in the federal registry, cutting some duplicate paperwork. Risk profiling got stricter too — you can't stamp “medium risk” on someone without writing down why anymore. Periodic review, once more of a suggestion, is something auditors actually check for now.

Impact on banks and regulated businesses

For banks, that means more cross-checking between internal files and the federal registry, plus policy updates and more staff training. For a business opening a bank account in the U.S. (see our guide on Banking Setup for Remote-First Companies), it usually means handing over ownership documents more than once. Companies with clean, centralized records move through this faster — one reason Icon.Partners pushes clients to get that documentation right at the incorporation stage.

Customer Due Diligence in Banking

Customer due diligence for banks isn't one team's job. Onboarding, compliance, risk, even IT teams running the monitoring software all touch it somewhere, and that's usually where gaps sneak through.

How banks perform CDD

It usually starts with paperwork — incorporation documents, proof of address, a beneficial ownership declaration, a plain description of the business. From there, the bank scores risk based on industry, geography, and expected volume. 

CDD banking teams also run sanctions and PEP checks before the green light is given.

Risk-based customer due diligence procedures

Not every account gets the same attention — a corner bakery and a cross-border payments platform don't carry the same level of risk. Cash-heavy businesses or clients in weaker-AML jurisdictions usually end up  enhanced screening. One fintech client, after expanding into new markets, was asked for updated ownership charts before its account tier moved up — a decent example of how customer due diligence in banking shifts once a business gets more complicated.

Customer Due Diligence Forms & Documentation

This is where good intentions hold up or fall apart, since examiners want a paper trail, not a verbal explanation after the fact.

Customer due diligence form requirements

A standard customer due diligence form captures the entity's legal details, its beneficial owners, why the account exists, and the activity a bank should expect, signed by someone authorized to do so. Incomplete forms are, by far, the most common reason a legitimate business gets stuck in limbo.

Information and documents businesses must provide

Certificates of incorporation, share registers, organization charts, IDs for owners and directors, plus a plain explanation of company activity — that's the baseline. Cross-border companies often also explain the reasoning behind any tax advantages (see What Is the OBBBA and How It Changes US Business Taxes in 2026) claimed under a treaty, since reviewers care about the underlying logic, not just a favorable number.

CDD Compliance Best Practices

The programs that actually hold up share a few unglamorous habits: policies that get revisited, staff who get retrained instead of trained once, and risk ratings that shift when the facts do.

Building an effective CDD compliance program

Start with a risk methodology built around your own client base, not something copied from another bank's manual. Layer automated monitoring on top to catch what a human might miss, but keep trained people in the loop — software flags patterns, it doesn't understand context. Institutions that revisit their customer due diligence requirements every year, instead of setting a policy once and forgetting it, tend to do better in examinations.

Ongoing monitoring and periodic reviews

Review schedules should track risk — annually for high-risk files, longer for lower-risk ones — with triggers built in for anything that shifts: new ownership, a change in activity, an unexpected payment. That discipline is exactly what examiners look for when deciding whether CDD requirements are being met in substance, not just checked off on paper.

Common CDD Compliance Challenges

Even well-funded compliance teams run into the same friction points, mostly around ownership transparency and clients working across several jurisdictions.

Identifying beneficial owners

Complex structures and nominee arrangements make tracing a 25% ownership threshold back to a real person genuinely difficult, not just tedious. Reviewers sometimes dig several layers deep, which frustrates owners who assumed local paperwork would be enough.

Working with someone who understands international structuring — Icon.Partners does this regularly — shortens the process, mainly because the ownership chain gets documented properly from day one.

Cross-border customers and enhanced due diligence

International clients bring their own headaches — different documentation standards, language gaps, uneven transparency depending on where the entity sits. Cross-border ownership rules rarely line up neatly, whether it's international corporate reporting or U.S. transparency laws. Businesses that sort out banking and tax structuring early clear that extra scrutiny faster than those fixing it later.

Frequently Asked Questions

Who must comply with the FinCEN CDD Rule?

Banks, credit unions, broker-dealers, mutual funds, and futures commission merchants operating in the U.S. all fall under it — coverage is deliberately wide.

How is CDD different from KYC and AML?

KYC is the narrower piece, mostly identity verification at onboarding. What's described here is the bigger picture — ongoing monitoring plus beneficial ownership work on top. AML sits above both, the umbrella term for catching illicit money as it moves through the system.

What happens if CDD requirements are not met?

Fall short on customer due diligence requirements, consequences range from formal warnings to serious fines, and in bad cases, license restrictions. For business customers, it's usually smaller but still painful — delayed account opening, or a closed file with barely any warning.

Final Guide to FinCEN's Customer Due Diligence Rule

This rule has reshaped how banks assess risk, and how businesses need to show up prepared before opening an account. Companies that keep tidy records, answer the question of what is customer due diligence in banking, and have documentation ready before it's requested skip most of the delays everyone else runs into. Whether it's company incorporation, cross-border accounts, or keeping compliance from piling up, Icon.Partners works with clients to keep ownership structures clear and banking relationships steady.