FinCEN sends a customer due diligence rule proposal to the White House

FinCEN sent a proposed customer due diligence rule to the White House budget office on 17 September 2026. The Corporate Transparency Act orders paragraphs (b) through (j) of 31 CFR 1010.230 rescinded when a revised rule takes effect, though FinCEN has not confirmed this filing is that rulemaking. Banks keep the duty to identify beneficial owners. The method changes.

• The Office of Information and Regulatory Affairs logged RIN 1506-AB78, "Customer Due Diligence Requirements for Covered Financial Institutions", as received from Treasury and FinCEN on 17 September 2026, at proposed rule stage and still pending review.
• The text of the customer due diligence rule is not public. OIRA discloses the title, the date and the stage, and nothing about the substance.
• The Corporate Transparency Act directs Treasury to rescind paragraphs (b) through (j) of 31 CFR 1010.230 when the revised rule promulgated under section 6403(d) takes effect, which is the entire operative machinery of the 2016 regime.
• The same statute withholds the authority to repeal paragraph (a), the underlying duty to identify and verify beneficial owners, so the obligation outlives the method.
• Congress assumed banks would corroborate ownership against a federal database that has collected nothing from domestic companies since March 2025.

What did FinCEN send to the White House?

FinCEN submitted a proposed customer due diligence rule to the Office of Information and Regulatory Affairs on 17 September 2026. As of 28 September 2026 the record shows a regulatory identification number, 1506-AB78, the title "Customer Due Diligence Requirements for Covered Financial Institutions", a proposed rule stage and a pending review status. It shows nothing else.

That absence matters. OIRA review under Executive Order 12866 is the last stop before an agency may publish a significant proposal in the Federal Register, and the record stays thin by design while it runs. Compliance teams know a proposal touching the customer due diligence regime is moving, and nothing about its content.

FinCEN had signalled the sequence five weeks earlier. In the August 2026 final rule, at 91 FR 52508, it wrote that it is "still legally required to modify the CDD Rule in light of the Reporting Rule", and that having finished there it could refocus on this one. The September filing is that refocus becoming visible.

Two fields sit oddly against the statute: the record shows no legal deadline and marks the action not economically significant, a narrower label than the significance that triggers review.

What does the statute require the rewrite to do?

Section 6403(d) of the Corporate Transparency Act, in Public Law 116-283, tells Treasury what this rulemaking must accomplish. It also carried a date: the revision was due one year after the beneficial ownership reporting regulations took effect, fixing the deadline at 1 January 2025.

That deadline passed 20 months before this filing, which makes its absence from the OIRA record notable.

Treasury must bring the 2016 customer due diligence rule into conformance with the Act, account for institutions gaining access to beneficial ownership information filed by reporting companies, and reduce burdens the Act has made unnecessary or duplicative. Then comes the instruction that decides the result: section 6403(d)(2)(A) directs Treasury to "rescind paragraphs (b) through (j) of section 1010.230 of title 31" once the revised rule takes effect.

Read against the current regulation, that is close to a demolition order. Paragraph (b) carries the identification and verification duty, (d) the definition of a beneficial owner including the 25 percent equity test and the control prong, (i) the record keeping rules, and (j) reliance on another institution's work.

The certification at Appendix A is invoked from paragraph (b)(1), where it is one of two permitted ways to collect the information rather than a mandatory form, so its fate follows that paragraph.

One paragraph is protected, though not in the way a casual reading suggests. The statute adds a rule of construction: nothing in the section may be construed to authorise Treasury to repeal the paragraph (a) requirement that institutions identify and verify beneficial owners. Congress withheld the authority to remove the duty while ordering the method deleted.

Section 6403(d)(3) tells Treasury what to weigh: risk-based principles for requiring reports of beneficial ownership information, how far institutions rely on information FinCEN provides, and ways to improve its accuracy, completeness and timeliness.

What does the customer due diligence rule require today?

Until a revised text takes effect, the customer due diligence rule at 31 CFR 1010.230 applies unchanged. Covered institutions must maintain written procedures "reasonably designed to identify and verify beneficial owners of legal entity customers" and fold them into the anti-money laundering programme required by 31 U.S.C. 5318(h).

The rule reaches four categories, defined at paragraph (f) by reference to 31 CFR 1010.605(e)(1): banks with an anti-money laundering programme duty, mutual funds, and brokers or dealers in securities and futures commission merchants or introducing brokers, registered or required to be registered with the SEC and CFTC respectively. The operative tests are the 25 percent equity prong and the control prong, both at paragraph (d). Verification must carry the elements used for individual customers under the sectoral identification rules, on a risk basis to the extent reasonable and practicable.

One thing did change this year, and it was permissive rather than mandatory. On 13 February 2026 FinCEN issued exceptive relief, FIN-2026-R001, under 31 U.S.C. 5318(a)(7). Institutions may now limit identification and verification to three circumstances: a customer's first account opening, any time the institution learns facts that call earlier information into question, and as risk-based ongoing procedures require. Collecting at every account opening breaches nothing.

What changes for your obligations?

Nothing changes today. A proposal at OIRA has no legal effect, the current customer due diligence rule still binds, and relaxing collection beyond what FIN-2026-R001 permits is a breach of a rule in force. The work is preparation, and it falls unevenly across the duties below.

Two rows are easy to get backwards. Beneficial ownership record keeping is not untouched: the five-year retention rules sit at paragraph (i), so retention becomes a programme call. The same applies to reliance, at paragraph (j), so programmes built on introduced business lose their named regulatory basis.

The sharpest consequence sits in a different rule. The anti-money laundering programme requirement at 31 CFR 1020.210(a)(2)(v) obliges banks to conduct ongoing customer due diligence, and paragraph (a)(2)(v)(B) states that customer information "shall include information regarding the beneficial owners of legal entity customers (as defined in § 1010.230 of this chapter)". Section 6403(d) does not reach 1020.210. That duty therefore survives, pointing at a definition the same statute orders deleted.

The same cross-reference sits in the programme rules for the other three sectors, at 31 CFR 1023.210(b)(5)(ii), 1024.210(b)(5)(ii) and 1026.210(b)(5)(ii), so the orphaned definition is sector-wide, not a banking quirk. Unless the revised rule repairs it, ongoing monitoring will cite a definition that no longer exists.

Reliance on federal data is where the ground has already moved. Congress drafted the mandate assuming institutions would corroborate ownership against the federal register. The August 2026 final rule, at 91 FR 52508, exempted domestic entities from any beneficial ownership information (BOI) reporting requirement, making permanent the March 2025 interim final rule (IFR) that removed them from the definition of a reporting company. It then exempted the remaining foreign reporting companies from reporting United States person beneficial owners and company applicants.

FinCEN says it expects to delete United States person records already filed in a single sweep and to post a notice when that is done, so those records are not gone yet. It now models roughly 28,000 foreign reporting companies expected to report, against the 32,556,929 total reporting companies the 2022 rule projected for 2024. For a domestic legal entity customer there is no federal record to check, pushing evidential weight onto registry and documentary work in KYB onboarding.

What is still uncertain?

The largest uncertainty is whether this proposal is the section 6403(d) rulemaking. The agenda entry for that mandate is RIN 1506-AB60, which ties itself expressly to section 6403(d), records the 1 January 2025 deadline, and targets a notice in March 2027. What arrived at OIRA is a different number, a different title and no recorded deadline.

The records also differ in what they concede. AB60 is flagged as requiring a regulatory flexibility analysis with small entities affected; the AB78 record leaves those fields empty and marks the action not economically significant. One word points the other way: "covered" in the new title tracks the defined term at paragraph (f), the population this mandate targets. A renumbering is the innocent reading. A narrower action taken first is the other.

Timing is the second unknown. OIRA review has no fixed length, and publication merely starts a comment period that must run and be analysed. The agenda's own timetable puts a notice in March 2027 and comments closing that May, which makes a binding final rule a 2028 proposition rather than a 2027 one.

The third is substantive. Deleting the numeric threshold without replacing it invites divergence, leaving examiners to compare programmes with no common yardstick. That usually resolves through examination findings, not rulemaking.

This is not only an industry worry. In the August 2026 final rule, among the points FinCEN said it is considering clarifying is "the possibility that the diminution of BOI collection under the IFR and this final rule might imply an actual increase in financial institutions' CDD obligations". Removing a prescribed method reduces paperwork only if something cheaper replaces it.

How should compliance teams respond?

Treat this as a planning signal, not a change event. Keep collecting to the current customer due diligence rule, because it remains in force and the relief granted so far has been narrow and specific, and the OIRA record gives no date on which that changes.

• Document why your programme uses the thresholds it uses, in risk terms rather than by citation, so the rationale survives deletion of the paragraph you cite today.
• Inventory every control, form, vendor configuration and system field hard-coding the 25 percent test or the certification.
• Check whether your programme depends on paragraph (j) reliance or paragraph (i) retention, both inside the rescission block.
• Confirm which customers are foreign reporting companies, since narrowed reporting did not empty that group.
• Assign an owner to watch the Federal Register and prepare a comment, the stage where industry input still shapes the text.

Zyphe helps with the part that does not change: proving who owns a customer without a central store of the evidence. Zyphe resolves ownership recursively across 240 or more corporate registries worldwide, with a 25 percent default threshold configurable per risk tier, so a shift in the baseline is a setting rather than a rebuild. Verification runs without a central Zyphe store of customers' personal data, with an exportable audit trail per decision. See AML software and KYC software, or book a demo.

The bottom line

A revision of the beneficial ownership regime is in the last stage before publication, and its direction is set by statute rather than by the unseen draft. Congress ordered the operative paragraphs deleted and withheld the authority to remove the underlying duty, converting a prescriptive requirement into one a firm must justify itself.

The database meant to make that easier stopped collecting from domestic entities eighteen months ago. Teams that can evidence ownership from registries and documents, and explain their thresholds in risk terms, will absorb it quietly. Teams whose programmes cite the regulation rather than reason from risk have work to do, and on the agenda's own timetable, well over a year to do it.

Cited sources

• OIRA regulatory review record, RIN 1506-AB78, received 17 September 2026
• Corporate Transparency Act, section 6403(d), Public Law 116-283, 134 Stat. 4624
• 31 CFR 1010.230, beneficial ownership requirements, current as of 23 September 2026
• 31 CFR 1020.210, anti-money laundering programme requirements for banks
• 31 CFR 1010.605, definitions including covered financial institution
• 31 CFR 1023.210, programme requirements for brokers or dealers in securities
• 31 CFR 1024.210, programme requirements for mutual funds
• 31 CFR 1026.210, programme requirements for futures commission merchants and introducing brokers
• Beneficial Ownership Information Reporting Requirement Revision and Deadline Extension, 90 FR 13688, 26 March 2025
• FinCEN exceptive relief order FIN-2026-R001, 13 February 2026
• Beneficial Ownership Information Reporting Requirement Revision, 91 FR 52508, 14 August 2026
• Customer Due Diligence Requirements for Financial Institutions, 81 FR 29398, 11 May 2016
• Unified Agenda entry, RIN 1506-AB60, Treasury and FinCEN