Know Your Customer and customer due diligence

Know Your Customer (KYC) is how a financial institution establishes who its customer is and, for a company, who owns or controls it. Customer due diligence (CDD) also establishes what the relationship is for and keeps the customer record current as risk changes. For a bank’s monitoring analysts, that record connects transactions across accounts to the right legal entity and gives them a baseline for judging whether activity fits the business. 31 CFR § 1020.210(a)(2)(v) · FinCEN CDD Rule FAQs

The customer is Cedar Gauge. Under its Customer Identification Program (CIP), the bank collects the company’s legal name, physical business address and taxpayer identification number before opening the account in this case. It can use certified articles of incorporation to help verify the company’s identity. The CIP calls for risk-based verification within a reasonable time after opening. 31 CFR § 1020.100(a), (c) · 31 CFR § 1020.220(a)(2)

The equity owners and the control individual go in the beneficial ownership record. For an in-scope customer and account, the U.S. CDD rule’s ownership prong covers each individual, if any, with at least 25% of the company’s equity, directly or indirectly. Its control prong covers one individual with significant responsibility for managing or directing the company. The same person can satisfy both prongs. The control prong still applies if every individual holds less than 25%. 31 CFR § 1010.230(b), (d)

Cedar Gauge’s direct shareholders are Harbor Holdings (50%), Iris (25%), Don (15%) and Lee (10%). Dev, Kira and Lee own 50%, 30% and 20% of Harbor, respectively. With proportional equity and no other ownership arrangements, Dev’s indirect beneficial ownership is $50\% \times 50\% = 25\%$. Lee’s direct and indirect stakes add to $10\% + 20\% \times 50\% = 20\%$. Iris and Dev each meet the threshold exactly. Kira and Don each have 15%. The bank records Rowan, the CEO who runs the company and owns no equity, under the control prong. FinCEN CDD Rule FAQs, B.5 and B.13

The company certifies who qualifies. The bank verifies each person’s identity. Taylor certifies the beneficial ownership information to the best of their knowledge, using the rule’s form or an equivalent process. The bank obtains each person’s name, date of birth, address and identifying number, and uses risk-based procedures to verify the identities of Iris, Dev and Rowan. A valid passport can help establish who Dev is. The certified ownership information tells the bank why Dev is in the file. The bank can rely on the company’s account of who owns or controls it when it has no facts that reasonably call the information’s reliability into question. 31 CFR § 1010.230(b), (i) and Appendix A · FinCEN CDD Rule FAQs, B.6–B.7 and B.13–B.16

Scope matters. Certain issuers with SEC-registered securities are excluded from this beneficial ownership rule. A qualifying nonprofit is subject to the control prong only, and certain equipment financing accounts qualify for a limited exemption. Cedar Gauge’s ordinary operating account falls within the rule. Separately, as a U.S.-formed company, Cedar Gauge is exempt from filing a beneficial ownership information (BOI) report with FinCEN under the Corporate Transparency Act rules in effect since 14 August 2026. The bank’s duties under § 1010.230 still apply. 31 CFR § 1010.230(e), (h) · FinCEN BOI reporting final rule

The bank uses Cedar Gauge’s account purpose and expected receipts and payments to build a customer risk profile. It monitors activity and updates the profile and customer information on a risk basis. If a relationship involves a politically exposed person, such as a senior foreign official, the bank assesses the specific risk and may seek more detail, such as the source of funds. Under the U.S. bank CDD rule, the extra steps depend on the risk of the relationship. Separate requirements apply to certain private banking accounts involving senior foreign political figures. 31 CFR § 1020.210(a)(2)(v) · U.S. banking agencies’ joint statement on politically exposed persons

A second account. The text of § 1010.230 ties beneficial-owner identification and verification to each new account. FinCEN’s 13 February 2026 order, FIN-2026-R001, gives covered institutions the option to limit those checks to the customer’s first account at that institution, later facts that reasonably call the ownership information’s reliability into question, and needs identified by risk-based ongoing CDD procedures. If Cedar Gauge opens a payroll account at the same bank and neither later trigger applies, a bank using the relief can skip another beneficial ownership check at that opening. The bank can also choose to keep its per-account checks. FIN-2026-R001, pp. 7–9 · FinCEN CDD Rule FAQs, B.1.b and D.3

A change in ownership. Suppose the bank later receives a signed transfer notice showing that Dev sold the entire Harbor stake to Kira. The ownership information on file is now in doubt, even if Cedar Gauge opens no account that day. Once the transfer is confirmed, Kira’s 80% of Harbor gives her 40% of Cedar Gauge. The bank identifies and verifies the beneficial owners under § 1010.230, collecting certified information for Kira and verifying her identity. The updated ownership roster is Iris and Kira. Rowan still satisfies the control prong if Rowan’s role is unchanged. When an update is needed under ongoing CDD procedures and the existing information remains reliable, the order allows the bank to use that information if the customer confirms it is current and accurate and the bank records the confirmation. If the customer cannot confirm, the bank must identify and verify the beneficial owners under the rule. A routine review on its own does not trigger a beneficial ownership refresh. FIN-2026-R001, pp. 8–9 · FinCEN CDD Rule FAQs, B.18–B.20 and D.3

An ownership update changes who is in the customer record. A suspicious activity report is a separate decision based on the facts and the bank’s reporting rule. Sanctions screening uses some of the same identity information to assess whether a person, entity or dealing is subject to sanctions restrictions. 31 CFR § 1020.320 · OFAC FAQ 5