Customer due diligence and beneficial ownership

Customer due diligence connects identity with the expected relationship. Record the nature and purpose of the account, relevant business activity, expected transaction behavior, and supporting evidence. Expected activity is a hypothesis to compare with later behavior, not a promise that every deviation is suspicious.

Keep customer-provided claims distinct from verified facts and analyst conclusions. A free-text business description alone is difficult to monitor. Translate it into useful fields while retaining context. For example, a seasonal ticket seller should not be compared blindly with a local repair shop. The profile needs enough detail to support meaningful review.

A usable profile contains enough context to interpret later activity. A monthly volume estimate alone says little about whether many small receipts and a few large supplier payments fit the customer’s business. Product, customer types, counterparties, geography, expected transaction patterns, and the source of relevant information can help distinguish ordinary variation from a meaningful change.

Expected activity should not become a rigid accusation threshold. A successful merchant may grow faster than forecast, and a legitimate business may enter a new market. A material difference prompts an evidence-based review of the current story. Record whether the difference reflects growth, a stale profile, a product change, or an unresolved concern. The outcome then informs the profile and the next control decision.

Build a usable customer profile — the flow

1. 01IdentifyEstablish customer facts
2. 02UnderstandDocument purpose and expected activity
3. 03CompareReview material changes over time

Build a usable customer profile — the distinction

Claim

• Information the customer supplied

Verified fact

• Information supported by the stated check

Customer profile

Fictional educational excerpt / Not for execution

Customer profile

Illustrative data; not a real customer record or a prescribed policy.

1. 1

   Purposeseasonal ticket sales

   Stated relationship

2. 2

   Expected volumeseasonal peaks

   Context for monitoring

3. 3

   Verified evidencevenue agreement

   Supports part of the story

Their evidentiary strength differs

Build a usable customer profile — control and failure modes

Control design

Separate claims facts and conclusions. Their evidentiary strength differs.

Failure mode 1avoid

Treat every expected value as a hard legal limit. Profiles guide review rather than define every duty.

Failure mode 2avoid

Use only a broad industry label. It may miss the business pattern.

Failure mode 3avoid

Never update the profile. Relationships change.

For covered financial institutions, FinCEN’s CDD framework includes identifying and verifying relevant beneficial owners. Its public summary describes a 25 percent ownership prong and a control prong, subject to scope and exceptions. These are not the same test as OFAC’s blocked-ownership rule.

Model ownership percentages and management authority as different relationship types. A chief executive may control a company without owning a quarter of it. An owner may hold a substantial stake without managing daily operations. Preserve the source and date of each relationship so changes can be assessed and the applicable rule can be applied accurately.

Ownership evidence needs a date and a clear unit of analysis. A person may own an intermediate company that owns the customer, while another person manages the customer without the same ownership interest. Represent those relationships separately. A diagram can explain a complex structure, but the underlying records should still identify the source for each edge, the percentage where relevant, and unresolved gaps. The collection duty depends on the applicable rule and relief; a convenient ownership graph should not silently replace that legal analysis.

Distinguish ownership from control — the flow

1. 01OwnershipRecord economic stakes
2. 02ControlRecord relevant management authority
3. 03Apply scopeUse the applicable CDD rule and exceptions

Distinguish ownership from control — the distinction

Ownership prong

• Specified equity interest

Control prong

• Relevant responsibility for managing the entity

Entity relationship record

Fictional educational excerpt / Not for execution

Entity relationship record

Illustrative data; not a real customer record or a prescribed policy.

1. 1

   Person A30 percent owner

   Ownership relationship

2. 2

   Person Bchief executive

   Control relationship

3. 3

   RuleCDD scope

   Separate from sanctions ownership

They answer different rule questions

Distinguish ownership from control — control and failure modes

Control design

Store ownership and control separately. They answer different rule questions.

Failure mode 1avoid

Use the OFAC threshold for all CDD. The frameworks have different tests.

Failure mode 2avoid

Assume a CEO must own shares. Control can exist without the stake.

Failure mode 3avoid

Ignore dated evidence. Ownership and authority can change.

FinCEN’s February 2026 exceptive relief changes when covered institutions must identify and verify beneficial owners for additional accounts. The order permits an approach centered on the first account, facts that call prior information into question, and risk-based ongoing CDD needs. The exact conditions and scope remain in the order.

An engineering implementation should model the legal-entity relationship and prior verification evidence rather than treat every account as an unrelated customer. Reuse only evidence that remains eligible and reliable under the approved policy. A change in ownership still needs a route for review. Relief from repetition is not relief from understanding the customer.

Account for the 2026 relief — the flow

1. 01First relationshipEstablish required ownership evidence
2. 02Additional accountAssess eligible reuse under the order
3. 03Changed factsRefresh when the relevant conditions arise

Account for the 2026 relief — the distinction

Eligible reuse

• Prior evidence remains usable under policy

Blind reuse

• Old information copied without checking conditions

Additional-account review

Fictional educational excerpt / Not for execution

Additional-account review

Illustrative data; not a real customer record or a prescribed policy.

1. 1

   Prior verificationon file

   Existing evidence

2. 2

   Ownership changereported

   Reliability trigger

3. 3

   Actionrefresh relevant facts

   Do not reuse blindly

The order changes repetition rather than removing CDD

Account for the 2026 relief — control and failure modes

Control design

Apply the relief with its conditions. The order changes repetition rather than removing CDD.

Failure mode 1avoid

Collect everything again without considering scope. That can add unnecessary duplication.

Failure mode 2avoid

Never refresh after the first account. Changed facts can require action.

Failure mode 3avoid

Confuse CDD with corporate BOI filing. They are separate frameworks.

Enhanced due diligence means obtaining and evaluating more evidence where the risk and applicable requirements call for it. The work should address the reason for concern: ownership opacity, unusual source of funds, a complex route, or another documented factor.

A large document request can be less useful than one well-chosen source. Distinguish source of funds for a transaction from source of wealth accumulated over time. Record how the evidence supports the explanation and what remains unresolved. Avoid treating a customer’s occupation, nationality, or a broad label as sufficient proof of misconduct.

Use enhanced review for the specific concern — the flow

1. 01ConcernName the unresolved risk factor
2. 02EvidenceSeek information that tests it
3. 03ConclusionDocument support and remaining gaps

Use enhanced review for the specific concern — the distinction

Source of funds

• Origin of money in a specific flow

Source of wealth

• How broader wealth was accumulated

Enhanced review

Fictional educational excerpt / Not for execution

Enhanced review

Illustrative data; not a real customer record or a prescribed policy.

1. 1

   Transactionlarge business sale proceeds

   Claimed funds source

2. 2

   Evidenceexecuted sale documents

   Supports the transaction story

3. 3

   Gapreceipt not reconciled

   Still needs cash-flow evidence

Enhanced review should improve understanding

Use enhanced review for the specific concern — control and failure modes

Control design

Match additional evidence to the concern. Enhanced review should improve understanding.

Failure mode 1avoid

Ask for every document available. Volume is not relevance.

Failure mode 2avoid

Treat source of wealth as the same as this transfer. The questions differ.

Failure mode 3avoid

Infer misconduct from nationality alone. That exceeds the evidence.

Customer information can be updated through scheduled reviews and event-driven triggers. The appropriate approach depends on the institution, customer, product, and applicable requirements. A material business change can matter before the next calendar review.

Define triggers such as new ownership, changed business activity, unusual transaction patterns, or evidence that contradicts prior records. Route the review to the right owner and preserve the previous profile. This history explains why earlier decisions differed. A current snapshot alone cannot show whether monitoring used the information available at the time.

Refresh through events and risk — the flow

1. 01TriggerDetect a relevant change
2. 02ReviewUpdate the affected customer facts
3. 03VersionPreserve prior and current profiles

Refresh through events and risk — the distinction

Current profile

• Best present view

Profile history

• Evidence used in past decisions

Refresh event

Fictional educational excerpt / Not for execution

Refresh event

Illustrative data; not a real customer record or a prescribed policy.

1. 1

   Old activitylocal retail

   Prior profile

2. 2

   New activityinternational wholesale

   Material change

3. 3

   Reviewbusiness and route update

   Targeted refresh scope

Calendar reviews alone can miss new exposure

Refresh through events and risk — control and failure modes

Control design

Version profiles and act on material change. Calendar reviews alone can miss new exposure.

Failure mode 1avoid

Overwrite the old profile silently. Past decisions become hard to explain.

Failure mode 2avoid

Refresh unrelated fields only. The material change remains unresolved.

Failure mode 3avoid

Wait despite contradictory evidence. The prior information may no longer be reliable.

This chapter builds on AML programs and the risk-based approach. Continue with Entity resolution and financial networks to follow the next part of the system. Use the glossary for terminology and risk mathematics for formulas and worked calculations.