Does Narrower BOI Reporting Create a Verification Gap for Banks?
Understand how narrower federal BOI reporting affects ownership information, what banks still need to verify and where identity intelligence adds context.
A business no longer needs to report its owners to FinCEN. Does that change what its bank needs to know about the people behind it?
For financial institutions reviewing business customers, that question has become more pressing as federal beneficial ownership reporting narrows. The answer requires separating company reporting requirements from the institution’s own due diligence obligations.
Key takeaways
Federal beneficial ownership information (BOI) reporting has narrowed substantially. FinCEN’s August 2026 final rule makes the exemption for U.S. companies permanent, while covered financial institutions retain customer due diligence (CDD) obligations. The potential gap is in federal ownership coverage and opportunities to corroborate customer declarations. Banks should review how they assess the people behind business accounts when available evidence is incomplete, inconsistent or outdated.
What changed in federal beneficial ownership reporting?
On August 11, 2026, FinCEN announced a final rule making permanent the BOI reporting exemptions introduced in March 2025. The final rule became effective on August 14.
Under FinCEN’s BOI requirements (opens in a new tab), U.S. companies are exempt from reporting BOI under the Corporate Transparency Act. Reporting companies also do not need to report U.S. person beneficial owners or U.S. person company applicants. Certain foreign entities registered to do business in the United States remain subject to reporting requirements, unless exempt.
FinCEN also announced that it will delete previously reported information (opens in a new tab) by U.S. persons who are now exempt.
For financial institutions, this changes the scope of a federal information source intended to improve ownership transparency. A company’s exemption from reporting to FinCEN does not determine what a bank must collect when establishing a customer relationship.
Do financial institutions still have CDD and beneficial ownership obligations?
Yes. Covered financial institutions still have obligations under FinCEN’s CDD framework (opens in a new tab), subject to applicable exclusions, exemptions and relief.
For legal entity customers within scope, the rule generally requires identifying and verifying the identity of individuals who own at least 25% of the entity, and one individual with significant responsibility for controlling, managing or directing it.
The framework also requires understanding customer relationships, developing risk profiles and conducting ongoing monitoring, with customer information maintained and updated on a risk basis.
There has, however, been a separate change to when beneficial owner identification and verification must occur.
February 2026 exceptive relief (opens in a new tab) allows covered institutions to limit these checks to the customer’s first account opening, subsequent situations where known facts reasonably call existing information into question, and circumstances identified through risk-based ongoing due diligence. Institutions may choose whether to use this relief.
The operational implication is that institutions need clear processes for recognizing when information deserves another look.
Does this create a beneficial ownership verification gap?
It may create a gap in available corroboration, but that requires careful framing.
The BOI database was not a public corporate registry or a universal ownership verification service. It would be misleading to suggest every institution previously used it to independently validate every business customer.
The narrower reporting regime nevertheless means federal collection no longer covers the broad domestic company population originally envisioned.
Our assessment is that this limits a potential source of ownership corroboration. It does not, by itself, establish that fraud has increased or that existing bank controls are inadequate.
The practical question is more specific: when a customer’s declaration raises doubts, what evidence can the institution use to investigate and resolve them?
That question matters where ownership structures are complex, records are limited or the identities presented do not align with the surrounding business information.
Is verifying a beneficial owner’s identity the same as proving ownership?
No. These are related but distinct tasks.
Identity verification asks whether the named individual is who they claim to be. Ownership assessment asks whether that individual actually holds the declared interest or control.
FinCEN’s CDD guidance (opens in a new tab) permits institutions to reasonably rely on customer-provided ownership information when they have no knowledge of facts that would reasonably call its reliability into question. The CDD rule does not impose a universal requirement to independently investigate every customer’s ownership structure.
Consider a hypothetical business applicant that supplies incorporation documents, an ownership declaration and identification for its named owner.
The identification may support the person’s identity. The incorporation documents may establish the entity’s existence. Neither necessarily resolves an inconsistency between the declared owner and other credible information about who runs the business.
A sound review keeps those questions separate and records what each piece of evidence actually supports.
What should trigger a closer review of a business customer?
Institutions can define review triggers around specific contradictions and unresolved questions. Examples might include:
- Conflicting information about owners or senior management across credible sources.
- Contact details that do not align with the stated business relationship.
- A material change in ownership or control.
- Business activity that differs substantially from the customer’s stated purpose.
- Evidence that an identity or contact channel may be compromised.
These are potential investigation leads, not automatic evidence of misconduct.
A shared address may be a registered agent’s office. A new business may have little online history. An owner may keep a low public profile. A professional biography may simply be outdated.
Missing information and contradictory information may warrant different responses, depending on the customer’s risk and the strength of the evidence.
How can Heka’s identity intelligence support business customer reviews?
Identity intelligence can add context about the individuals presented behind a business. Depending on availability and relevance, digital, professional, social and breach-related information may help analysts assess consistency and identify questions worth investigating.
FinCEN’s consolidated FAQs (opens in a new tab) recognize non-documentary verification methods, including comparing customer-provided identity information with other sources, within risk-based procedures.
Heka brings together digital, social and darknet intelligence to help financial institutions assess identity consistency and uncover risk signals that traditional checks may miss. That approach is relevant to questions arising in business customer reviews: do the identity details align across sources? Is there contradictory information worth investigating? Are the supplied details exposed in breached datasets?
These signals do not establish legal ownership. A professional profile does not prove equity ownership, and a breach record does not establish fraud. Supplementary intelligence can inform an analyst’s assessment of the identity presented and identify questions requiring further evidence.
As federal BOI reporting narrows, the opportunity is to strengthen the evidence surrounding customer declarations. Heka’s perspective is that understanding the people behind financial relationships should be part of that discussion.
What should financial institutions review now?
Start by keeping the two regulatory changes separate in procedures and staff guidance. BOI reporting exemptions and CDD account-opening relief address different obligations.
Then review the evidence available when a customer declaration needs clarification. Identify which sources establish entity existence, which support identity and which can substantiate ownership or control.
Finally, define escalation and refresh triggers. Analysts should know what contradiction prompted a review, what evidence resolved it and what uncertainty remains.
How well do you understand the people behind your business customers? Talk to Heka about how web, social and darknet identity intelligence could complement your existing customer verification and risk assessment processes.
