September 21, 2026

Beneficial Ownership Verification: A Practical Guide

Axle Team

Key takeaways

The CDD Rule (31 CFR 1010.230) has two prongs: every individual with 25% or more direct or indirect equity, plus one individual under the control prong. You verify their identities — not their status as owners.
You may reasonably rely on the customer's certification unless you have knowledge of facts that call it into question.
FinCEN's March 2025 interim final rule exempted all U.S.-created entities from BOI reporting — there is no registry backstop for domestic customers, so collection and verification stay on your onboarding workflow.
Indirect ownership aggregation across layered entities is where most programs actually break, not screening.
Dropping below the 25% threshold is a risk-based option, not an obligation — FinCEN's FAQ says lower thresholds should follow your own risk assessment.

Beneficial ownership verification means identifying each individual who directly or indirectly owns 25 percent or more of a legal entity customer, plus one individual who controls it, then verifying those individuals' identities using risk-based documentary or non-documentary procedures. Under FinCEN's CDD Rule, you verify identity — not ownership status — and may rely on the customer's certification absent red flags.

That distinction — verify the identity, rely on the certification — is the piece programs most often get wrong in both directions: some teams over-engineer ownership forensics on low-risk LLCs, others rubber-stamp certifications that contradict documents already in the file. This guide covers the two prongs, the verification methods FinCEN actually expects, and what the 2025 BOI reversal means for your workflow.

What beneficial ownership verification requires under the CDD Rule

The rule defines beneficial owners through two prongs. The ownership prong covers:

"Each individual, if any, who, directly or indirectly, through any contract, arrangement, understanding, relationship or otherwise, owns 25 percent or more of the equity interests of a legal entity customer"
— 31 CFR 1010.230(d)(1)

The control prong adds a single individual with significant responsibility to control, manage, or direct the entity — an executive officer, senior manager, general partner, or anyone who regularly performs similar functions. Up to four individuals can surface under the ownership prong; exactly one is always required under control.

On verification itself, FinCEN's 2018 FAQ guidance (FIN-2018-G001) is the operative text:

"Covered financial institutions must verify the identity of each beneficial owner according to risk-based procedures that contain, at a minimum, the same elements financial institutions are required to use to verify the identity of individual customers under applicable Customer Identification Program (“CIP”) requirements."
— FinCEN, FIN-2018-G001, Question 4

Two differences from CIP matter in practice. First, the CDD Rule expressly permits photocopies or other reproductions for documentary verification. Second, you verify the person's identity — you do not independently prove they are in fact an owner. Per the same FAQ, an institution may accept and reasonably rely on the customer representative's statement of who the beneficial owners are, provided it has no knowledge of facts that would reasonably call that information into question.

The 2025 BOI reversal puts the burden back on your workflow

Many teams expected the Corporate Transparency Act's beneficial ownership registry to eventually give financial institutions a government source to check certifications against. That is off the table for domestic entities. In March 2025, FinCEN issued an interim final rule:

"Thus, through this interim final rule, all entities created in the United States — including those previously known as “domestic reporting companies” — and their beneficial owners will be exempt from the requirement to report BOI to FinCEN."
— FinCEN news release, March 21, 2025

Only foreign entities registered to do business in the U.S. still report, and they do not report U.S. persons as owners. The practical consequence: for the overwhelming majority of your legal entity customers, the certification you collect at account opening — and whatever corroboration your program builds around it — is the record. There is no registry backstop, and your CDD Rule obligations are unchanged.

A working beneficial ownership verification workflow

Collect the certification at account opening. FinCEN's Certification Form (Appendix A) is optional — equivalent information gathered in your onboarding flow works. For individuals already verified under your CIP, you can rely on information on file once the representative confirms it is current.
Build the ownership graph before verifying anyone. Map every intermediate entity, then compute effective look-through percentages to natural persons. Who you must verify falls out of the math, not the first layer of the org chart.
Verify identities with CIP-grade methods. Documentary or non-documentary, per the list below, under written risk-based procedures.
Screen every identified owner. Sanctions, PEP, and adverse media on each beneficial owner — not just the entity and its signers.
Apply lower thresholds only where risk justifies it. FinCEN's FAQ frames lower-threshold collection as warranted "based on the financial institution's own assessment of its risk relating to its customer" — a documented judgment call, not a default.
Refresh on triggers. Update ownership information when monitoring or periodic review surfaces a change — an acquisition, a new control person, or a certification that no longer matches observed account activity.

Verification methods FinCEN recognizes

Documentary: an unexpired government-issued ID with a photograph — driver's license or passport. Photocopies or reproductions of identity documents are expressly permitted under the CDD Rule, unlike CIP, and your institution's own risk-based analysis determines which documents to accept.
Non-documentary: contacting the beneficial owner directly; comparing information provided by the customer or owner against other reliable sources; references with other financial institutions; obtaining a financial statement.

Where programs actually break: the aggregation problem

The failure mode we see most is not a missed sanctions hit on a named owner — it is indirect ownership math. FinCEN's own FAQ example makes the point: an individual holding 40% of one intermediate company and a third of another can hold over 36% of the customer indirectly and qualify as a beneficial owner, while individuals more visible on the same cap table do not. Analysts working from the first ownership layer capture whoever is listed and stop.

The fix is procedural, not heroic: require the effective-ownership computation as a documented artifact in the case file before identity verification starts, and QA that artifact the way you QA dispositions. In files we review, the certification, the operating agreement, and the org chart frequently disagree with each other — and the discrepancy sits unremarked in the same folder. A reviewer who reconciles the three documents catches more beneficial ownership problems than any additional database check.

FAQ

Do we have to verify that someone actually is a beneficial owner?

No. The obligation is to verify the identity of the individuals the customer identifies, and you may reasonably rely on the certification absent knowledge of contradicting facts. If you suspect a customer is evading beneficial ownership requirements, FinCEN's guidance says to consider declining or closing the account — and filing a SAR.

Is a threshold below 25% ever required?

The rule sets 25%. Lower thresholds are a risk-based choice — some programs use 10% for higher-risk customer types — and FinCEN notes you can also mitigate heightened risk through enhanced monitoring or collecting expected-activity information instead. Whatever you choose, document the rationale.

Did the Corporate Transparency Act change beneficial ownership verification for banks?

Not in the direction most expected. The CDD Rule's collection and verification obligations stand unchanged, and the March 2025 interim final rule removed BOI reporting for U.S.-created entities — so there is no FinCEN registry to consult for domestic customers.

If your team is spending hours per case assembling ownership structures and corroborating owners, see how Justin, Axle's diligence agent, handles document collection and ownership analysis — and Baley for screening the owners you identify. For the build-vs-buy math on your own volumes, run the ROI calculator.

Beneficial Ownership Verification: A Practical Guide

More from the blog