Country Guide, United States: The Customer Identification Program Rule, Beneficial Ownership and the Corporate Transparency Act

For information; not legal advice.

The United States has no single remote-onboarding rule of the kind that Germany or Singapore has. What it has is a short, technology-neutral rule on customer identification, a second rule on the owners of companies that open accounts, a body of staff guidance that answers the practical questions, and a separate statute on company ownership reporting whose scope was cut back sharply from March 2025 onwards. A bank that onboards a customer through a phone or a browser applies the same two rules as a bank that does it at a branch counter, and the rules leave the method to the bank. This guide reads those texts side by side, so that a reader can see where the rule is fixed, where it leaves a choice, and what has changed since March 2025.

The guide is a reading aid and not a compliance opinion. It does not say that any product meets the American rules, and an institution should settle its approach with its own federal supervisor. Three limits of the sources are stated here, before the detail. First, the rules were read in the electronic version of the Code of Federal Regulations on 28 October 2026, which is an unofficial reproduction that the Government Publishing Office and the National Archives update continuously. Second, the interagency questions and answers on the customer identification rule are an agency staff document, and the agencies say about their own document that it does not answer every question that may arise. Third, this guide reads the Treasury text for banks. The rules for broker-dealers, mutual funds and futures intermediaries use the same structure but are separate sections, and the parallel rules that the banking agencies and the credit union regulator keep in their own chapters were not read either.

For the wider picture, see the article on how risk sets the verification steps under the FATF standard and the guides to Germany, Singapore and the United Kingdom, which set other national regimes beside this one. The business side of the same question is in the article on beneficial ownership under the FATF standard.

The instruments, in one table

Each row was read from the document itself, or from the agency page that publishes it, on 28 October 2026.

The customer identification program rule implements section 326 of the USA PATRIOT Act, and the order of June 2025 says so in its first sentence. The source note at the foot of the electronic text gives the original publication of the program rule as 26 October 2010 in the Federal Register and a later amendment on 16 September 2020. The beneficial ownership rule is sourced to a Federal Register publication of 11 May 2016, amended on 28 September 2017.

Who is a customer, and what is an account

The program rule applies to a "customer", and the definition decides when the duty starts. In the section of definitions for banks, a customer is a person that opens a new account, and also an individual who opens a new account for an individual who lacks legal capacity, such as a minor, or for an entity that is not a legal person, such as a civic club. The definition leaves out a financial institution regulated by a federal functional regulator, a bank regulated by a state bank regulator, and a person that already has an account with the bank, provided that the bank has a reasonable belief that it knows the true identity of that person. An account is a formal banking relationship established to provide or engage in services, dealings or other financial transactions, including a deposit account, a transaction or asset account, a credit account or another extension of credit. It also covers a safety deposit box or other safekeeping, and cash management, custodian and trust services.

Three exclusions matter for a product designer. A product or service where a formal banking relationship is not established, with check cashing, wire transfer and the sale of a check or money order as the examples, is not an account. An account that the bank acquires through an acquisition, merger, purchase of assets or assumption of liabilities is not an account for this purpose. An account opened to take part in an employee benefit plan under the Employee Retirement Income Security Act is not one either.

The staff questions and answers add a number of practical readings of these words. A person whose loan application is denied is not a customer, because the person does not receive banking services, and for a loan the account is opened when the bank enters into an enforceable agreement to provide it. Where an individual holds a power of attorney for a competent person who is the named owner, the customer is the named owner, and where the account is opened for a person who lacks legal capacity, the individual with the power of attorney is the customer. A person who becomes the co-owner of an existing deposit account is a customer, and so is a new borrower substituted for an existing one through an assumption of a loan. Where a parent opens an account for a minor the bank's customer is the parent, and where the minor opens the account the minor is the customer.

The four items of identifying information

The program rule sets a minimum of information that the bank must obtain before it opens an account. The bank must obtain a name, a date of birth for an individual, an address and an identification number. For an individual the address is a residential or business street address, with an Army Post Office or Fleet Post Office box number, or the street address of next of kin or another contact individual, as the fallback for a person who has no street address. For a person other than an individual, such as a corporation, partnership or trust, the address is a principal place of business, a local office or another physical location.

The identification number depends on who the customer is. For a US person it is a taxpayer identification number. For a non-US person it is one or more of a taxpayer identification number, a passport number and country of issuance, an alien identification card number, or the number and country of issuance of any other government-issued document that evidences nationality or residence and bears a photograph or similar safeguard. When the customer is a foreign business or enterprise without an identification number, the bank must ask for alternative government-issued documentation that proves the existence of the business.

The rule has two narrow exceptions to collection before opening. A bank may open an account for a customer that has applied for a taxpayer identification number but has not yet received it, if the program confirms that the application was filed before the account is opened and obtains the number within a reasonable period afterwards. For a credit card account the bank may obtain the information from a third-party source before it extends credit. That second exception is the origin of a wider order that the agencies issued in June 2025, described below.

Verification: a reasonable belief, by documents or otherwise

The central sentence of the rule is about belief and not about method. The program must include risk-based procedures for verifying the identity of each customer to the extent reasonable and practicable, and the procedures must enable the bank to form a reasonable belief that it knows the true identity of each customer. The procedures must rest on the bank's assessment of the relevant risks, and the rule lists what the assessment includes: the types of accounts, the methods of opening accounts, the types of identifying information available, and the bank's size, location and customer base. The phrase "methods of opening accounts" is the place where remote onboarding enters the text.

Verification must take place "within a reasonable time after the account is opened". The wording allows a bank to open an account in a restricted state and to verify afterwards, and the rule's lack-of-verification paragraph, described below, assumes that this happens. The rule does not say how long a reasonable time is, and the program must describe when the bank will use documents, non-documentary methods or both.

Documents

A bank that relies on documents must set out in the program the documents it will use. For an individual the rule gives, as examples, unexpired government-issued identification that evidences nationality or residence and bears a photograph or similar safeguard, such as a driver's license or a passport. For a person other than an individual the examples are documents that show the existence of the entity, such as articles of incorporation, a government-issued business license, a partnership agreement or a trust instrument. The word "may" in the rule makes the lists examples and not requirements.

The staff questions and answers say that the rule's examples are long-standing primary sources of identification and reflect the agencies' expectation that banks will obtain government-issued identification from most customers. They add that other forms of identification may be used if they enable the bank to form a reasonable belief, and that, given the availability of counterfeit and fraudulently obtained documents, a bank is encouraged to obtain more than a single document. On one point they relax the rule: a bank need not establish the accuracy of every element of identifying information it obtains, but must do so for enough information to form a reasonable belief that it knows the true identity of the customer.

Non-documentary methods

A bank that relies on non-documentary methods must describe in the program the methods it will use. The rule's examples are contacting a customer, independently verifying identity by comparing the information the customer provided with information from a consumer reporting agency, a public database or another source, checking references with other financial institutions, and obtaining a financial statement. The non-documentary procedures must address five situations: an individual who cannot present an unexpired government-issued photo identification; a bank that is not familiar with the documents presented; an account opened without obtaining documents; a customer who opens the account without appearing in person at the bank; and other circumstances that increase the risk that the bank cannot verify identity through documents.

The fourth item is the rule's whole treatment of remote onboarding. It does not forbid opening an account without the customer appearing, and it does not name a technology. It requires the program to address the situation, which in practice means saying which non-documentary checks the bank will run when nobody stands at a counter.

For a customer that is not an individual, the rule adds a further step. Where the bank cannot verify the customer's identity by documents or other methods, and the bank's risk assessment of the new account calls for it, the program must say when the bank will obtain information about individuals with authority or control over the account, including signatories.

Electronic credentials, as revised in September 2026

The interagency questions and answers carry a note at the foot of the first page. It says that the document was revised in June 2026 to remove references to reputational risk, and in September 2026 to update guidance on electronic credentials. The revised question asks whether a bank or credit union can use an electronic credential, such as a digital certificate or a verifiable digital credential, as a non-documentary means of verification when a customer opens an account in person, remotely over the Internet or through another digital or virtual channel.

The answer has three parts. A bank or credit union may obtain such a credential as one of the methods it uses, to the extent that its own program permits. The program rule still requires a reasonable belief about the customer's true identity. For credentials issued and maintained by a non-government third party, the bank or credit union is responsible for ensuring that the third party uses the same level of authentication as the bank or credit union itself would use, and the answer points to the federal banking agencies' guidance on authentication in an electronic banking environment.

This is the only passage in the staff guidance that speaks to digital credentials by name, and two points follow from its wording. First, a credential is treated as one method among others and not as a substitute for the program's own judgement. Second, the sentence on non-government issuers puts the burden of comparing authentication levels on the bank, so that a bank accepting a credential from a private issuer needs to know how that issuer authenticates. The answer does not say what happens with a credential issued by a government, and a reader should not infer a rule from the silence.

A note on the text. The questions and answers were written about the rule in its earlier numbering, under which the program rule was section 103.121, and the text still uses that numbering, with dates of January 2004 and April 2005 on the original answers. The rule now in force is the one reproduced in the electronic Code under section 1020.220, and the two should be read together.

When verification fails

The program must include procedures for the case where the bank cannot form a reasonable belief that it knows the true identity of a customer. The rule lists four things that the procedures should describe: when the bank should not open an account; the terms under which a customer may use an account while the bank attempts to verify identity; when the bank should close an account after attempts to verify have failed; and when the bank should file a Suspicious Activity Report. The second item is the legal basis for the restricted-account pattern mentioned earlier, in which the customer can do some things before verification is complete. The rule leaves the terms of that restriction to the bank.

A verification flow that returns a result to the bank should therefore be able to say more than "pass" or "fail". The bank's program needs states for "not yet verified", "verified by documents", "verified by other means", "could not be verified" and "verification referred for review", because each of them maps to something the program must describe. That is a reading of the rule and not a quotation of it.

Records, notice, government lists and reliance

The remaining elements of the program are shorter.

Records. The bank must keep a record of all identifying information obtained, a description of any document relied on with its type, number, place of issuance and any dates of issuance and expiry, a description of the methods and results of the non-documentary measures, and a description of how any substantive discrepancy was resolved. The identifying information is kept for five years after the date the account is closed, or, for a credit card account, five years after it is closed or becomes dormant. The other records are kept for five years after the record is made. The rule asks for a description of the document and does not require the bank to keep an image of it. Whether to keep an image is a separate decision that the bank takes under its own retention and privacy policy.

Government lists. The program must include procedures for determining whether the customer appears on any list of known or suspected terrorists or terrorist organizations that a federal agency issued and Treasury designated, in consultation with the federal functional regulators, for this purpose. The determination must happen within a reasonable period after the account is opened, or earlier if another law or directive requires it. The staff answers say that, when they were written, no such list had been designated, and that lists published by the Office of Foreign Assets Control had not been designated for this purpose, although banks are separately obliged to check those lists under that office's regulations. A reader should check the current position with the supervisor before relying on that old answer.

Customer notice. The program must provide customers with adequate notice that the bank is requesting information to verify their identities. Notice is adequate if the bank generally describes the identification requirements and gives the notice in a way reasonably designed to ensure that the customer can view it, or is otherwise given notice, before the account is opened. The rule's examples include a notice in the lobby, on the bank's website or on the account application, and it supplies sample wording. For a flow on a screen, the practical point is that the notice has to appear before the account is opened and not after.

Reliance. The program may specify when the bank will rely on another financial institution to perform parts of the program. Three conditions apply: the reliance is reasonable under the circumstances; the other institution is subject to a rule implementing the anti-money laundering program requirement and is regulated by a federal functional regulator; and the other institution enters into a contract requiring it to attest annually that it has implemented its program and will perform the specified requirements.

A verification provider is an agent, not a relied-upon institution

The reliance paragraph has a consequence for a bank that buys identity verification from a vendor. A vendor of verification technology is not a financial institution regulated by a federal functional regulator, so the reliance route in the rule is not the one that describes it. That is the article's reading of the three conditions, and it is not a statement by an agency.

The staff answers describe the route that does apply, in an example about loans made through a car dealer or mortgage broker acting as the bank's agent. They say that the bank may delegate to its agent the obligation to perform the requirements of the program, that in contrast to the reliance provision the bank is ultimately responsible for the agent's compliance with the rule, and that an agent can give the customer notice by any manner reasonably designed to ensure the customer receives it. In another answer, about a bank that acts as agent for a credit card issuer, they say that the agent may perform parts of the program on behalf of the issuer but that, as with any other responsibility performed by an agent, the issuer ultimately is responsible for the agent's compliance.

Neither answer concerns a technology vendor, and the examples are older than the current market for remote verification. They do state a principle that is useful when reading a vendor contract: delegation is possible, and responsibility stays with the bank. In practice that points to three contract subjects: the bank's right to see how the vendor performs each step of the program, a record the bank can retrieve for an examiner, and notice to the bank when the vendor changes a method.

The June 2025 order on taxpayer identification numbers

On 27 June 2025 the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation and the National Credit Union Administration, with the concurrence of the Financial Crimes Enforcement Network, issued an order under the exemption power in the program rule. The exemption power is itself in the rule, which lets the appropriate federal functional regulator, with the concurrence of the Secretary of the Treasury, exempt any bank or type of account from the section.

The order applies to all accounts at all banks, and their subsidiaries, that are subject to the three agencies' jurisdiction. It exempts those banks from the requirement to obtain taxpayer identification number information from the customer before opening an account, and it permits a bank instead to use an alternative collection method that obtains the information from a third-party source. The OCC's bulletin on the order says that the exemption is optional, and that banks are not required to use an alternative collection method.

The order keeps the rest of the rule in place. The bank must still have written procedures that enable it to obtain the number before opening an account, that rest on its assessment of the relevant risks, and that are risk-based for the purpose of verifying identity, so that it can form a reasonable belief that it knows the true identity of each customer. The OCC's bulletin repeats the same three conditions, and it is numbered OCC Bulletin 2025-15.

For a remote flow the order matters in one way. A bank that uses a data source to retrieve the number, instead of asking the customer to type it, now has an order that covers that design for all accounts, where before the express exception was limited to credit card accounts. The order does not make the retrieved number a verified fact, and the bank still has to verify identity under the rest of the program.

Beneficial ownership of legal entity customers

The second rule applies where the customer is a company. It requires covered financial institutions to establish and maintain written procedures that are reasonably designed to identify and verify the beneficial owners of legal entity customers, and to include those procedures in their anti-money laundering program. The rule applies at the time a new account is opened.

Who counts as a beneficial owner

There are two prongs, and a legal entity customer can have both. The first is each individual, if any, who directly or indirectly owns 25 percent or more of the equity interests of the legal entity customer. The second is a single individual with significant responsibility to control, manage or direct the customer, such as an executive officer or senior manager, or any other individual who regularly performs similar functions. The rule's own note counts the possible numbers: up to four individuals under the ownership prong and one under the control prong, and the same person may satisfy both. A trust that owns 25 percent or more is dealt with through its trustee.

A "legal entity customer" is a corporation, a limited liability company or another entity created by the filing of a public document with a Secretary of State or similar office, a general partnership, and a similar entity formed under foreign law that opens an account. The rule lists many entities that are not legal entity customers, including a regulated financial institution, an issuer of securities registered under section 12 of the Securities Exchange Act, a registered investment company, a bank holding company, a state-regulated insurance company and a foreign financial institution established where its regulator maintains beneficial ownership information about it. A pooled investment vehicle that is operated or advised by a financial institution that is not excluded, and a nonprofit corporation, are subject only to the control prong.

Identification and verification

Identification may be done by obtaining the beneficial ownership form that the rule reproduces as its Appendix A from the individual opening the account for the entity, or by obtaining the same information by another means, provided that the individual attests to its accuracy as far as the individual knows. The information on the form is the name, date of birth, address and identification number of each beneficial owner.

Verification is a separate step. The institution must verify the identity of each beneficial owner identified to it, according to risk-based procedures to the extent reasonable and practicable. At a minimum those procedures must contain the elements the program rule requires for verifying individual customers, with one deliberate difference: for documentary verification the institution may use photocopies or other reproductions of the listed documents. The institution may also rely on the information the legal entity customer supplies about its beneficial owners, provided that it has no knowledge of facts that would reasonably call the reliability of that information into question.

Two points of this paragraph deserve emphasis for a product that verifies people remotely. The beneficial owner is verified, but the beneficial owner often does not appear, because the person who opens the account is an employee or an agent. The rule's allowance for photocopies is what lets the institution verify an absent owner from a copy of the document.

What the May 2026 questions and answers say

FinCEN reissued its customer due diligence questions and answers in May 2026, consolidating three earlier sets that were published in July 2016, April 2018 and August 2020. The reissue updates certain answers to align with the February 2026 order described below.

Two entries bear on identity verification. Under question B.14, the verification procedures for beneficial owners must contain at least the same elements as the program's procedures for individual customers, but they need not be identical, and the institution may accept photocopies of a driver's license from the entity when the beneficial owner is not present, which the program rule does not allow for customers. The answer lists non-documentary methods that include contacting a beneficial owner and comparing information provided with information from other sources, and tells the institution to conduct its own risk-based analysis of the methods and documents it will accept. Under question B.16, for a beneficial owner who is unavailable to appear in person, the institution may verify identity through a photocopy or other reproduction of a valid identity document, or by the non-documentary means described in question B.14.

The text of these answers is about photocopies and not about images captured by a phone. How a live capture of a document relates to a "photocopy or other reproduction" is a point the answers do not address, and a reader who needs a firm position should ask the supervisor.

Exceptive relief of 13 February 2026

On 13 February 2026 FinCEN issued an order numbered FIN-2026-R001, titled "Exceptive Relief from Requirement to Identify and Verify Beneficial Owners at Each Account Opening". Before the order, the rule was read to require identification and verification of the beneficial owners every time a legal entity customer opened an account, however little time had passed between account openings.

Under the order, a covered financial institution may limit identification and verification to three occasions: when a legal entity customer first opens an account with it; at any time afterwards when it has knowledge of facts that would reasonably call into question the reliability of the beneficial ownership information it already has; and as needed under its risk-based procedures for ongoing customer due diligence. The order requires the institution to keep complying with all other anti-money laundering requirements under the Bank Secrecy Act, including its program, recordkeeping and reporting requirements. FinCEN's consolidated questions and answers state that whether to use the relief is within the discretion of the institution, which may choose to keep identifying and verifying at each new account opening. The order itself says that exceptions of this kind may be revoked at FinCEN's discretion.

For a verification workflow the order changes the frequency of one step, and it leaves the step itself as it was. An institution that adopts the relief still needs to identify and verify at the first account, still needs a trigger for doubt about the information on file, and still needs a way to refresh the information under its ongoing due diligence.

Records

The institution must keep the identifying information obtained, including the form if one was obtained, for five years after the account is closed. For verification it must keep a description of any document relied on, of any non-documentary method and the results of the measures, and of the resolution of each substantive discrepancy, for five years after the record is made. The rule has its own reliance paragraph, with the same three conditions as the program rule.

The Corporate Transparency Act: a timeline, and what it does not change

The beneficial ownership rule and the Corporate Transparency Act are often confused, because both concern the owners of companies. They are different rules with different duties. The beneficial ownership rule obliges a bank to collect ownership information from its customers when they open accounts. The reporting rule, which is a separate part of the regulations numbered 31 CFR 1010.380, obliged companies to report their beneficial owners to FinCEN. FinCEN's own final rule says that the two rules serve different purposes and arise under different legal authorities.

The text of the final rule adds the background to the interim rule: in late 2024 and early 2025 district courts in two cases issued nationwide orders that preliminarily enjoined FinCEN from implementing and enforcing the reporting rule and stayed its effective date, and FinCEN extended the reporting deadlines for most reporting companies until 21 March 2025.

The Treasury Department's press release of 26 March 2025 says that the interim final rule removes the requirement for US companies and US persons to report beneficial ownership information to FinCEN and narrows the scope of the rule to foreign reporting companies. It also says that the action followed the suspension of enforcement announced on 2 March 2025, and that FinCEN intended to finalize the rule that year. The final rule describes the suspension as limited in scope: it covers U.S. citizens, domestic reporting companies, and their beneficial owners. FinCEN's own page records that the interim final rule changed the meaning of "reporting company" to cover only entities formed under the law of a foreign country that registered to do business in a US state or tribal jurisdiction by filing with a secretary of state or similar office.

The final rule of August 2026

The Federal Register abstract of the final rule, document 2026-16576, states its content. The rule continues to exempt reporting companies from reporting the ownership information of US-person beneficial owners, and to exempt US-person beneficial owners from providing it to reporting companies. It also exempts reporting companies from submitting information about their US-person company applicants and exempts those applicants from any obligation to provide it. It exempts all US persons from the requirement to update information already provided to FinCEN in connection with obtaining a FinCEN identifier. The Federal Register record gives the effective date as 14 August 2026.

FinCEN's reporting page, updated on 11 August 2026, puts the result in plain terms. US companies are exempt from the reporting requirements and are no longer required to file reports. Reporting companies do not need to report the beneficial ownership information of US-person beneficial owners or US-person company applicants. The page still describes foreign entities that meet the narrowed definition of a reporting company and do not qualify for an exemption as required to report. The interim rule's deadline for such entities registered before 26 March 2025 was 25 April 2025, and entities registered on or after that date have 30 calendar days to file after receiving notice that their registration is effective.

What the final rule leaves for the banks

The final rule says plainly that the bank-side rule is not revised. In its discussion of the beneficial ownership rule, FinCEN writes that the interim rule did not revise it, that compliance with it is an important part of covered institutions' anti-money laundering programs because it gives them valuable information about their legal entity customers, and that the changes should not be read as diminishing the value of beneficial ownership information in general. It adds that it is still legally required to modify the beneficial ownership rule in light of the reporting rule, and that when it does so it intends to address the issues raised by commenters. It lists the points that commenters asked it to clarify, among them the expectations on institutions about using FinCEN's ownership information system for compliance with the rule, the reconciling of disparities between the information obtained under the Act and the information the institution collects itself, and how the federal regulators' guidance on the rule might change. FinCEN writes that it is considering whether to clarify those points and in what way.

Two practical conclusions follow, and both are labelled as readings. A bank cannot treat the end of company reporting as an end of its own duty to collect and verify ownership information from legal entity customers, because the text of the bank-side rule has not changed. And a bank should expect a future rulemaking on that rule, whose content is not known, so that a design which hard-codes today's two prongs and form is more brittle than one that treats the ownership model as configuration.

What a firm can decide now

The texts leave room, and a firm has to use it with a reason. Six decisions follow from the reading above.

1. Decide which non-documentary methods the program names for an account opened without the customer appearing in person, since the rule requires the program to address that situation.
2. Decide whether electronic credentials are in the program, from which issuers, and how the bank will compare an issuer's authentication level with its own, since the staff answer places that comparison on the bank.
3. Decide the account state between opening and completed verification, and write down the terms of the restriction and the point at which the bank closes the account.
4. Decide whether to use the alternative collection method for taxpayer identification numbers, knowing that the order is optional and that verification of identity remains.
5. Decide whether to adopt the February 2026 relief on beneficial ownership, and if so which events re-trigger identification and verification.
6. Decide what the contract with a verification vendor says about records, change notice and examiner access, since the bank stays responsible for an agent's performance.

The international baseline

The Financial Action Task Force's Recommendation 10 is the standard that these rules implement. Its first measure is identifying the customer and verifying that customer's identity using reliable, independent source documents, data or information. The rest of the baseline is explained in the article on the risk-based approach, and it is not repeated here. The text read here is the consolidated text 2012-2026, in the copy hosted by the Eurasian Group.

The American program rule follows that text in three places. It allows verification after opening, within a reasonable time. It uses the "reasonable belief" standard in place of a technology list. And it requires procedures for what the bank does when verification fails, including a Suspicious Activity Report.

Questions to put to a provider

• Which of the program rule's identifying items does the product collect from the customer, which does it retrieve from a source, and how does it record the difference?
• How does the product report a verification that is incomplete, so that the bank's program can apply its terms for a restricted account?
• If the product accepts or issues an electronic credential, how does it document the authentication level, and can the bank compare that with its own?
• What does the product keep for each verification, in the form of the description the rule asks for, and can the bank retrieve it for an examiner?
• For a company customer, does the product collect the beneficial ownership form fields, does it verify an owner who is not present from a copy of a document, and can it show how that was done?
• When the provider changes a method, how and when does the bank hear about it?
• Where are the images stored, who can open them, and how long are they kept?

Where this sits in a verification flow

A flow built on NeuroVision KYC places the identity steps in one session: document, selfie, liveness and face match, with the scenario assembled in an editor. The individual steps are described on the document verification page. This article does not state that these steps meet the American rules, that they count as a method in any bank's program, or that they replace the bank's own verification procedures.

To see how these steps look in your own scenario, contact the team.

Sources

All sources were fetched on 28 October 2026, except the FATF text, which was fetched on 27 October 2026.

• 31 CFR 1020.220, Customer identification program requirements for banks, electronic Code of Federal Regulations.
• 31 CFR 1020.100, Definitions, electronic Code of Federal Regulations.
• 31 CFR 1010.230, Beneficial ownership requirements for legal entity customers, electronic Code of Federal Regulations.
• Frequently asked questions: final customer identification program rule, Federal Reserve Board, FDIC, FinCEN, NCUA, OCC, Office of Thrift Supervision and Treasury staff, with revisions of June 2026 and September 2026.
• Order granting an exemption from the CIP rule requirement to obtain taxpayer identification number information from the customer, issued 27 June 2025 by the OCC, FDIC and NCUA with the concurrence of FinCEN.
• OCC Bulletin 2025-15, Customer Identification Program Tax Identification Number Alternative Collection Method, Office of the Comptroller of the Currency, 27 June 2025.
• Exceptive Relief from Requirement to Identify and Verify Beneficial Owners at Each Account Opening, FIN-2026-R001, Financial Crimes Enforcement Network, 13 February 2026.
• Customer due diligence rule, consolidated frequently asked questions, Financial Crimes Enforcement Network, May 2026.
• Beneficial Ownership Information Reporting Requirement Revision, final rule, 91 FR 52508, Federal Register, 14 August 2026.
• Federal Register document record 2026-16576, Federal Register.
• Beneficial Ownership Information Reporting, Financial Crimes Enforcement Network, page updated 11 August 2026.
• Treasury Department announces publication of interim final rule removing reporting requirements for US companies and US persons, US Department of the Treasury, 26 March 2025.
• The FATF Recommendations, consolidated text 2012-2026, Financial Action Task Force, as hosted by the Eurasian Group, Recommendation 10 and its interpretive note.