Why the ownership registry never replaced the bank’s own file

The week

On December 28, 2020, the House voted to override the president’s veto of the National Defense Authorization Act for Fiscal Year 2021. The Senate followed on January 1, 2021, and the act became law. As its name suggests, it is mostly about the military, and some of the most consequential financial laws arrive this way, folded into bills about something else entirely.

The veto had come on December 23, the last day the president had to act. His objections had nothing to do with money laundering. He wanted a repeal of Section 230, the liability shield for online platforms, and he opposed provisions to rename military bases named after Confederate leaders. The House override passed 322 to 87 and the Senate’s 81 to 13. It was the first time Congress overrode one of his vetoes. A compliance officer following that week’s news could easily have missed that a major financial crime statute was riding along.

Folded into the defense bill was the Anti-Money Laundering Act of 2020, the largest update to the Bank Secrecy Act framework in decades. The Bank Secrecy Act is the backbone of US anti-money laundering (AML) rules: it is why banks verify who their customers are, watch for suspicious transactions and report them to the government. Money laundering is the process of making criminal proceeds look legitimate, often by passing them through layers of companies and accounts until the trail goes cold.

The anti-money laundering title had a long history of its own. Bills to make companies disclose their real owners had circulated in Congress for more than a decade. The House passed a Corporate Transparency Act in October 2019, and the Senate Banking Committee had worked on its own package. The defense bill offered a vehicle that almost always passes. Congress had enacted a defense authorization every year for roughly six decades, so attaching the AML package to it was a way to get a long-stalled reform over the line.

The new law’s best-known part, the Corporate Transparency Act, went after one of the most common hiding places: the anonymous company. It required many small companies to report their beneficial owners, the real people who own or control them at the end of the chain, to FinCEN, the Treasury bureau that collects financial intelligence. A shell company can be registered in someone else’s name, or owned by another company that is owned by a third. The beneficial owner is the person at the end of that chain.

The statute set out the details. A beneficial owner is an individual who exercises substantial control over the company, or who owns or controls at least 25 percent of its ownership interests. Reporting would fall on corporations, limited liability companies and similar entities created by filing with a state, or registered to do business in one. Twenty-three categories were exempt, mostly entities already visible to regulators. They included banks, credit unions, public companies, and larger operating businesses with more than 20 full-time US employees and over $5 million in gross receipts. What remained was the population banks found hardest to see through: small, closely held companies, many with no employees at all. Willful violations could bring civil penalties of $500 a day and criminal penalties of up to two years in prison.

FinCEN would keep a non-public database that law enforcement could use, and that financial institutions could access with the customer’s consent. For banks, which already had to collect this ownership information themselves, the database looked like a welcome shortcut: a single government source for a fact that was laborious to establish.

The statute also anticipated that the database would change the banks’ own rule. It told FinCEN to revise the 2016 customer due diligence rule within a year of the reporting rule taking effect. The revision was meant to account for the new database and to remove requirements that had become unnecessary or duplicative. Banks read that as a signal that their own collection work might shrink.

The act did more. It directed FinCEN to set national AML priorities, telling banks what the government most wanted them to focus on. It expanded the AML whistleblower program, which rewards people who report violations. And it brought dealers in antiquities within the Bank Secrecy Act, with the details left to FinCEN rulemaking.

Other provisions were less visible but touched daily operations. The act wrote into statute that the Bank Secrecy Act reaches businesses that exchange or transmit value that substitutes for currency, which settled lingering doubt about crypto exchanges and transmitters. It ordered reviews of the dollar thresholds for currency transaction reports and suspicious activity reports. It expanded the government’s power to subpoena records from foreign banks with correspondent accounts in the United States. It also told the Treasury to study the trade in works of art, a market the antiquities provision stopped short of covering.

On January 1, 2021, it looked as though banks were about to get a powerful new tool. What happened instead is a useful story about relying on data you do not control.

For bank compliance teams, the end of 2020 brought a law that seemed to promise relief. Collecting and verifying the beneficial owners of business customers had been required since the 2016 customer due diligence rule, and it was laborious. A federal registry looked like a single authoritative source for that information.

The act had another main thread, the push to judge AML programs by their usefulness. The ownership thread has three parts: the registry as an external data source, the due diligence duty that stayed with the bank, and the whistleblower channel that changed who can report a weak program.

Who is behind the company

When a bank opens an account for a person, it checks who that person is. This is the familiar “know your customer” process: an ID, an address, a check against lists of sanctioned people. When a bank opens an account for a company, the question is harder. A company is a legal entity and cannot commit a crime on its own; someone behind it decides what it does.

Hence regulators’ interest in beneficial ownership. Suppose a small trading company opens an account at a regional bank. On paper it is owned by another company, which is owned by a trust, which names a lawyer as trustee. The person who actually controls the money may not appear anywhere on the account opening forms. If that person is under sanctions, or is moving the proceeds of fraud, the bank could be helping without knowing it.

How ownership gets hidden

Concealment rarely needs anything exotic. The usual tools are ordinary legal structures used in an unusual order. A company formed in one state can be owned by a company formed in another, which can be owned by a company formed abroad. Each layer has its own registered agent, its own filings and often its own bank.

States historically asked for very little when a company was formed. A typical filing named an organizer and a registered agent, the person or firm that accepts legal papers on the company’s behalf. Owners often did not appear at all. Formation agents can register many companies at the same address, and that address tells a bank nothing about who decides how the money moves.

Nominees add another layer. A nominee director or shareholder appears on the record in place of the real owner, usually for a fee. Trusts add a third, because the trustee holds legal title while others benefit. The bank sees a name on each form, and each name is technically correct.

Thresholds create a fourth gap. Ownership rules typically name anyone who owns 25 percent or more. Split ownership among five relatives or associates at 20 percent each and, on the ownership test alone, nobody qualifies. The control test exists to close that gap. It asks for only one person, though, and the person named is often a manager rather than whoever gives the instructions.

Each technique is legal on its own. Most companies with layered structures have ordinary reasons for them: tax planning, liability separation, estate planning, joint ventures. The difficulty for the bank follows from that. It has to tell the routine structure from the deliberate maze, usually from documents the customer supplies.

Customer due diligence, often shortened to CDD, is the bank’s duty to understand who it is dealing with and what the relationship is for. The 2016 rule made one part of that explicit: for legal entity customers, covered financial institutions must identify and verify the beneficial owners. In practice that has meant forms, certifications signed by the customer, identity checks on each owner, and staff time.

The rule became enforceable in May 2018. It applies to what FinCEN calls covered financial institutions: banks, including credit unions and savings associations, broker-dealers in securities, mutual funds, futures commission merchants and introducing brokers in commodities. Money services businesses, casinos and insurers fall outside the beneficial ownership requirement, although each has AML duties of its own.

The rule asks for two kinds of beneficial owner. The ownership prong covers each individual who owns 25 percent or more of the equity. The control prong covers one individual with significant responsibility to manage the company, such as a chief executive, finance chief or managing member. Customers whose owners are already visible elsewhere, such as listed companies and regulated financial institutions, are excluded.

The same rule added what practitioners call the fifth pillar of an AML program. Institutions must understand the nature and purpose of each customer relationship, build a customer risk profile, and monitor on an ongoing basis. That ongoing duty turns an ownership certification at account opening into a living file.

A government registry promised to shortcut some of that work. Instead of the bank asking the customer and trying to verify the answer, the bank could look the company up. That is a familiar pattern in business: when a reliable external source exists, firms rebuild their processes around it. The registry tested what happens when such a source proves less reliable than expected, because the law that created it keeps changing rather than because its data is wrong.

The registry: an external source that kept changing shape

The Corporate Transparency Act required FinCEN to build the database and write three rules. One covered reporting, one covered access, and one would revise the customer due diligence rule to fit the new regime. The reporting rule was finalized in 2022, and reporting began on January 1, 2024.

Then the ground moved repeatedly. A federal court in Alabama held the act unconstitutional as applied to the plaintiffs in March 2024. A Texas court issued a nationwide injunction in December 2024, which was stayed, reinstated and stayed again over the following weeks. In March 2025 Treasury said it would not enforce the requirement against U.S. companies and their owners. FinCEN then issued an interim final rule limiting reporting to certain foreign companies registered to do business in the United States.

For a non-lawyer, the sequence is dizzying, and so it was for banks. A bank planning its systems in 2023 could not know whether the registry would be full, half-full or nearly empty a year later. An injunction is a court order stopping something from happening; a stay pauses that order. Each turn changed which companies had to report, and therefore what a bank could expect to find if it looked.

Access would never have been free, either. The access rule, finalized at the end of 2023, let banks query the database only with the customer’s consent, for customer due diligence purposes, and under security and training requirements of their own. Using the registry would have meant new consent capture, access controls and audit records before a single lookup.

The registry, then, was closer to a locked records room than a public phone book. A bank would need the customer’s written permission, a trained and authorized employee, and a log of every visit. Each of those requirements means new screens in the onboarding system, new procedures and new records to keep.

Consent alone would have been a sizeable build. The bank would need to capture it in a form it could later prove, tie it to the specific customer and lookup, and handle customers who declined. Each lookup would need a permitted purpose, a trained and authorized user, and a log the bank’s supervisors could inspect. The retrieved data would need its own administrative, technical and physical safeguards. All of that would have been built for a source whose contents the bank could not control.

What the registry would and would not have told a bank

Even a complete registry would have held what companies said about themselves. FinCEN collected the reports but was not set up to check them independently. A match between a customer’s certification and the registry would have shown that the customer told the government the same thing it told the bank. That has value, because false statements to FinCEN carry criminal penalties. The data would still have been self-reported.

The registry would also have lagged. Companies had 30 days to report changes, so a lookup on a fast-moving customer could show last month’s structure. A mismatch would have created work rather than ending it. Some countries require banks to report discrepancies between what customers say and what the register shows. Each discrepancy then becomes a case with an owner, a deadline and a record.

Europe offered an early warning that registries move with policy. Several EU registers were built to be open to the public, until the Court of Justice of the European Union ruled in November 2022 that general public access breached privacy rights. Several member states closed or restricted their registers within days. Banks there kept their own duty to identify owners throughout. A register is a policy instrument, and policy changes.

For banks, the registry never became the dependable source many had planned around. Banks that designed onboarding flows on the expectation of registry access carried the act’s legal risk into their own systems. A data source created by a contested statute can be narrowed, delayed or switched off by a court, and the bank’s obligations do not pause while that happens.

Banks that coped best had treated the registry as a possible extra input, never as a replacement for their own collection. Their systems stored each ownership attribute with its source and verification date. Adding, reweighting or removing a source was then a configuration change and a documented decision.

That last idea deserves a moment, because it applies far beyond AML. Storing a fact “with its source and verification date” means the system records both that a given person owns 30 percent of a customer company and where the bank learned it (the customer’s certification, a registry lookup, a corporate filing) and when it was last checked. If one source disappears, the bank can see exactly which records relied on it and what else supports them. A setting changes; the system does not need rebuilding.

Who planned around it, and why

Banks did not all face the same choice. Large banks with their own onboarding platforms could treat the registry as a future data feed to evaluate on their own schedule. Community banks and credit unions often run onboarding on a vendor’s platform. Whether a registry lookup appeared there, and how it was built, was partly the vendor’s decision. A bank on that platform could inherit design assumptions it had never examined.

Fintech partner banks faced a further twist. In banking-as-a-service arrangements, the fintech often runs the onboarding screens while the bank holds the account and the legal duty. Any change to how ownership is collected has to flow through a contract, a program manager and sometimes another vendor beneath it. A change that one bank could make by configuration could take a partner bank months of negotiation.

The duty that stayed with the bank

The registry’s retreat left the 2016 rule in place. Covered financial institutions still had to identify and verify the beneficial owners of legal entity customers. The planned revision to align the two regimes was never completed in the form the act envisaged.

That made the bank’s own ownership file the system of record. A “system of record” is the place an organization treats as the official, authoritative version of a piece of information. Its quality depends on a few unglamorous controls.

• Collection at onboarding. Ownership and control information is captured in a structured form that downstream screening can use, rather than as a scanned certification. A scanned form is a picture a person can read; structured data is a set of fields a computer can check against sanctions lists automatically.
• Verification evidence. Each owner’s identity is verified and the evidence is linked to the record, with the method used.
• Refresh triggers. Information is reviewed when facts suggest it may be wrong, such as a change in signers, unusual activity or an adverse media hit, and on the schedule set by the customer’s risk rating. An adverse media hit is a negative news story about the customer or its owners turned up by screening.
• Linkage. Owners who appear across several business customers are recognized as the same person. That linkage is what lets an investigator see a network instead of a set of unrelated accounts.

Linkage is the most technical of the four and often the most valuable. The technique behind it is called entity resolution: working out that three slightly different spellings of a name, at slightly different addresses, belong to the same person. Suppose a bank finds that one individual is to be the beneficial owner of seven small companies, each with its own account and each moving money modestly. Viewed one account at a time, nothing looks unusual. Viewed as a network, the pattern can be very different.

Each control involves a trade-off. Structured collection adds friction to business account opening, which relationship managers feel first. Refresh triggers create review work that has to be staffed. Entity resolution across customers needs data engineering that competes with other projects. The case for funding them is that they work whatever happens to an external registry.

Computing ownership through layers

Indirect ownership is arithmetic, and the arithmetic is where files often go wrong. A person who owns 50 percent of a holding company that owns 60 percent of the customer indirectly owns 30 percent of the customer. That clears the 25 percent line. A form that lists only the holding company as owner misses that person entirely.

Storing ownership as a graph rather than a list makes the calculation repeatable. Each entity and person is a node, and each ownership link carries a percentage, a source and a date. The system multiplies along each path, adds up paths that lead to the same person, and flags anyone at or above the bank’s chosen threshold. When one link changes, every affected calculation updates.

The rule lets institutions apply a lower threshold to higher-risk customers, and many use 10 percent for those. A graph makes that a parameter rather than a second form. It also shows where a chain ends in a trust, a foundation or a foreign entity, which is often the point to ask more questions.

Who carries the duty, and how it differs

The beneficial ownership requirement uses the same text for every covered institution, but it lands differently. A community bank’s business customers are mostly local companies, and its main problem is consistency: the same certification handled the same way at every branch. A regional bank with commercial lending adds real estate entities, complex holding structures and borrowers that are families of related companies.

Credit unions face a narrower version. Field-of-membership rules limit who can join, yet business members still need beneficial ownership files, and NCUA examiners test them. Broker-dealers apply the rule to entity accounts, often investment vehicles and family office structures, and FINRA examines their programs alongside the SEC. Investment advisers that are neither banks nor broker-dealers stayed outside it. A separate FinCEN AML program rule for advisers was adopted in 2024 and later postponed.

For each type, examiners ask for similar evidence: the certification or equivalent record, verification of each individual named, the risk rating, and proof of updates when facts changed. They typically test a sample of files. A sample that shows structured data, consistent verification and dated refreshes tells them more about the program than any policy document.

Measuring the file

A system of record needs measures that tell management whether it is holding up. Useful ones are simple. One is the share of legal entity customers with structured ownership data rather than an attached form. Another is the share of named owners with linked verification evidence. A third is the number of high-risk files past their review date, and by how long. A fourth is the number of owners linked across several customers who have never been reviewed as a network.

Each measure needs an owner and a trend line. Reported quarterly to the BSA officer and annually to the board, they turn an abstract duty into a list of fixable gaps. They also give the institution a baseline, so it can see whether a change in sources, such as a registry arriving or shrinking, moved the numbers.

One business customer, start to finish

Follow a single business customer through a well-run process. Say the same small trading company applies for an operating account at a regional bank.

At onboarding, the relationship manager or an online form collects the names, dates of birth, addresses and identification numbers of the people who own or control the company, in fields rather than as an attached document. The customer certifies that the information is accurate. The system records that the source is “customer certification” and stamps the date.

Next comes verification. Each owner’s identity is checked, perhaps against identity documents or trusted databases, and the result and method are attached to that person’s record. At the same time, the names are screened against sanctions lists and for adverse media. If one of the company’s owners already appears as an owner of two other business customers, the linkage step flags it, so the analyst sees all three relationships together.

The customer is then given a risk rating, which sets how often the file will be reviewed. A low-risk local business might be reviewed every few years; a higher-risk one much more often. Between scheduled reviews, events trigger a fresh look: the company adds a new authorized signer, its transaction patterns change sharply, or a news story names one of its owners.

What is absent from this flow is any dependence on a single outside source. A registry lookup, had it been available, would simply have been another source attached to the same record, with its own date. If the registry later disappeared, the bank could find every record where it was the only source and go back to the customer. Nothing else in the process would need to change.

Record retention closes the loop. The due diligence rule requires identifying information on beneficial owners to be kept for five years after the account closes. Records of how each owner was verified have their own five-year clock, starting when the record is made. A file that stores each fact with its source and date makes retention mechanical, because the system knows what each record is and when its clock started.

Now follow the same customer three years later, when it is sold. The buyer is a holding vehicle controlled by an investment fund. A well-run process catches the change through a trigger, perhaps a new signer or a change in the company’s stated business. The analyst updates the graph, verifies the new individuals behind the vehicle, screens them and re-rates the customer. The old ownership stays in the history with its dates, so an investigator can later see who owned the company when.

The weak version of the same story is easy to describe. The sale happens, nobody at the bank notices, and the file still shows the old owners at the next scheduled review two years later. If a new owner turns out to be sanctioned, the bank’s exposure runs for the whole gap.

Compliance professionals call such a program “resilient.” Things still go wrong, but when an input changes, the effect is contained, visible and fixable.

The whistleblower channel

The act expanded the AML whistleblower program, with awards tied to sanctions collected, and protections against retaliation. Congress strengthened it again at the end of 2022, extending it to sanctions violations and creating a dedicated fund for awards. The act also gave Treasury and the Justice Department broader subpoena power over records held by foreign banks with U.S. correspondent accounts. A correspondent account is one a foreign bank keeps at a US bank so it can move dollars for its own customers.

The award mechanics changed in two steps. Under the 2020 act, a whistleblower whose original information led to an enforcement action with sanctions above $1 million could receive up to 30 percent of the amount collected. The act set no floor, unlike the SEC’s program, which guarantees at least 10 percent. The 2022 amendments added that 10 percent minimum, brought in sanctions violations, and created a fund of up to $300 million to pay awards without waiting for appropriations.

The act also barred retaliation. An employee who believes they were fired or demoted for reporting can file a complaint with the Department of Labor and, if it is not resolved in time, take the case to federal court. Remedies include reinstatement and back pay. The protection covers reports made inside the employer as well as reports to the government, which shapes how a bank should handle concerns raised internally.

For compliance officers, the whistleblower provisions mattered more than the registry. They changed the internal economics of known weaknesses. An employee who sees monitoring alerts closed without review, or ownership files left stale on high-risk customers, now has a financial reason to report externally. Problems that once stayed inside the institution can reach regulators without passing through management.

Say an analyst in the financial crimes unit of a regional bank notices that her team is closing transaction alerts in bulk at the end of each month to meet a backlog target. She raises it with her manager, who tells her it is a known issue and a fix is coming. Months pass. Before the act, her choices were to keep raising it internally or to let it go. After the act, she has a third option, with a potential award attached. Whether she uses it depends heavily on whether she believes the internal route works.

The practical response is an internal reporting channel that staff trust more than the external one. That means a route outside the business line, a documented response to every report within a set time, and visible fixes. Program weaknesses already known internally belong on a dated remediation plan, because an undocumented known issue looks worst when someone else reports it.

Designing a channel staff trust

Trust in an internal channel comes from a few design choices. The intake route should bypass both the business line and the financial crimes managers being reported on, often through an ethics line that reports to compliance leadership or the audit committee. Every report gets a case number, an acknowledgment, a named investigator and a target date. Reporters hear what happened, within the limits of confidentiality.

Independence matters most when the concern is about the BSA officer’s own function. A bank should decide in advance who investigates those reports, typically internal audit or outside counsel, and how the board hears about them. Smaller institutions need this decision more than large ones. The BSA officer there may also be the compliance officer and the risk officer, so the obvious internal route leads back to the same person.

The design carries a cost. Strong protections and visible follow-up can surface many low-value reports, and each takes time to investigate. The alternative is worse: a concern the bank dismissed, filed with the government with documents attached. Retaliation claims add a separate legal exposure, so managers need clear guidance on how to treat someone who has raised a concern. Employment decisions about that person deserve review by counsel.

What registry changes cost customers and budgets

Each change to the registry carried a price in project budgets, customer patience and examiner questions.

Customers. Business owners opening accounts experience due diligence as forms, questions and delays. A bank that redesigns onboarding around a registry, then has to redesign it again when the registry shrinks, puts customers through that churn twice.

Cost. Systems built around a single external source have to be reworked when that source changes. Systems that store sources and dates adjust by configuration. The difference shows up in project budgets for years.

Regulators. The duty to identify and verify beneficial owners never left the bank. An examiner will ask how the bank knows who owns its business customers, regardless of what happened in court.

Policies and training. Every change in the registry’s status raised the question of whether written procedures needed updating. A procedure that referred to registry lookups had to be amended when lookups became unavailable or irrelevant. Front-line staff had to be retrained each time. Customers who had already filed with FinCEN could reasonably ask why the bank needed the same information again, and staff needed an answer. Banks that had never written the registry into procedures had less to undo.

Staff and reputation. The whistleblower program means the people closest to the work are also potential witnesses. A culture where problems are raised, logged and fixed is now a risk control in its own right, and a bank that ignores its own staff’s warnings may read about them later.

The case for having planned around the registry

A fair objection is that banks were right to plan for the registry. Congress had passed it, FinCEN was building it, and the statute told FinCEN to cut duplicative burden. A bank that ignored it would have missed a real chance to shorten onboarding. Design work started late is design work done in a hurry.

The objection holds for planning and fails for dependence. Exploring how a registry lookup would fit, and budgeting for it, was sensible. Dropping the bank’s own collection in anticipation, or building screens that could not work without a registry response, was not. The distinction is between an option and a commitment. Options cost some design time; commitments cost a rebuild when the source changes.

A second objection is that tagging every fact with a source is overhead a small institution can ill afford. It does add fields and discipline. Many onboarding and case management platforms can already hold a source and a date per attribute, so the cost is mostly configuration and training. The larger cost falls later, on institutions that skip it and then cannot tell which records depended on a source that went away.

Banks that came through intact

Banks that came through the registry’s twists in good shape tended to share these traits.

• They treated any government registry as one input among several, never as a replacement for their own collection.
• They recorded every ownership fact with its source, method and date.
• They invested in linking people across business customers, so investigators could see networks.
• They built internal reporting that staff actually used, with a visible response.
• They kept a dated list of known weaknesses and worked it down.

The banks that struggled did the reverse.

• Designing onboarding around registry access before the registry was stable.
• Storing ownership as scanned forms that no system could check automatically.
• Reviewing ownership only at account opening, and never again unless a regulator asked.
• Treating whistleblower reports as an HR matter rather than a signal about the program.
• Knowing about a weakness, discussing it in meetings, and never writing it down with a date to fix it.

These traits did not track size closely. Some small institutions had clean, structured files because volumes were manageable and one experienced person owned the process. Some large ones had fragmented data because acquisitions had left several onboarding systems running side by side. Mergers deserve specific attention. An acquired bank’s ownership files should be mapped into the acquirer’s data model with their original sources and dates, rather than re-collected from scratch or loaded as attachments.

What a board should ask about ownership data

1. For each business customer, can we show who the beneficial owners are, where we learned it and when we last checked?
2. If a government data source we rely on were switched off tomorrow, which records would be affected, and how quickly could we tell?
3. What events cause us to refresh a customer’s ownership information, apart from the calendar?
4. How do staff report a concern about the AML program outside their own line management, and how quickly do they hear back?
5. What known weaknesses are on our remediation plan, with dates, and does anyone know of one that is not on it?

The answers should come with evidence rather than assurances. A handful of business customer files, chosen by internal audit rather than by the business line, shows more than a slide. So does a report that counts ownership records by source. Boards of credit unions and community banks can ask for the same evidence in simpler form, because the questions do not depend on size.

Every question comes back to the same thing: the bank, not the government, is answerable for knowing its customers, and it needs data it controls to do so.

With hindsight

The Anti-Money Laundering Act of 2020 remains the framework banks work within, but its headline feature is much smaller than it looked on January 1, 2021. Domestic companies were exempted from beneficial ownership reporting by an interim rule in 2025, after years of litigation and of filing work by businesses that had already complied, and a final rule made the exemption permanent in August 2026. The registry that was meant to illuminate anonymous US companies now covers certain foreign companies registered to do business in the United States.

The last steps were the most telling for anyone who plans around data. The Supreme Court stayed the first nationwide injunction in January 2025, but a second injunction from another Texas court kept reporting suspended until mid-February. Treasury then announced in March 2025 that it would not enforce the act against domestic companies. The August 2026 final rule also said FinCEN would delete reports previously filed by domestic companies and US persons. Information many businesses had already filed is leaving the government’s hands.

The bank’s own file stayed central. In February 2026 FinCEN granted relief from re-identifying beneficial owners each time an existing legal entity customer opens a new account. Banks now verify at the first account and when facts call the information into question. The change is sensible, and it rewards banks whose records already show when and how each owner was verified.

For a bank’s onboarding team, the practical result in 2026 resembles 2018 with less repetition. The bank collects and verifies at the first account, refreshes on risk and on facts, and keeps its own evidence. The registry plays almost no part for domestic customers. Foreign companies registered to do business in a US state remain the one group where a lookup could, in principle, add something.

In April 2026 FinCEN proposed a new AML program rule, replacing its 2024 proposal, which had not been finalized by this writing. The rules are still moving, more than five years after the act became law.

Other parts of the act settled faster. FinCEN issued the first national AML/CFT priorities on June 30, 2021: corruption, cybercrime, terrorist financing, fraud, transnational criminal organizations, drug trafficking, human trafficking and smuggling, and proliferation financing. The banking agencies said at the time that banks did not need to change their programs until a final rule took effect, and the program rule has been proposed twice since.

The antiquities provision moved slowly. FinCEN sought comment on regulating antiquities dealers in September 2021. Its study of the wider art market, published in February 2022, found some money laundering risk but did not recommend immediate regulation. Separately, a 2024 FinCEN rule brought registered investment advisers into the AML framework, and its effective date was later pushed to January 2028.

Scored against its promises, the act did unevenly. The priorities, the whistleblower expansion and the statutory clarity on crypto have lasted. The registry, its centerpiece, has shrunk to a fraction of its intended scope. The promised revision of the due diligence rule arrived as targeted relief in 2026 rather than as the realignment the statute described.

Through all of it, banks that stored ownership data with its source and verification date adjusted by configuration. Banks that had built around a single expected source had to rework their onboarding. The contrast applies well beyond money laundering. Whenever a new external data source is promised, whether by a regulator, an industry utility or a vendor, ask what happens if it arrives late, arrives smaller, or is withdrawn. A design that records where each fact came from can absorb that. A design that assumes the source will always be there cannot.

The whistleblower provisions point the same way from the inside. They are a reason to make sure that the people who see a weakness first have a trusted place to raise it inside the bank.