Frequently Asked Questions Regarding Customer Due Diligence Requirements for Financial Institutions

FIN-2018-G001
Issued: April 3, 2018
Subject: Frequently Asked Questions Regarding Customer Due Diligence Requirements for Financial Institutions The Financial Crimes Enforcement Network (FinCEN) is issuing these Frequently Asked Questions to assist covered financial institutions in understanding the scope of the Customer Due Diligence Requirements for Financial Institutions, published on May 11, 2016, as amended on September 29, 2017 (“CDD Rule” or “Rule”), available at https://www.fincen.gov/resources/statutes-regulations/ federal-register-notices/customer-due-diligence-requirements. On July19, 2016, FinCEN published FAQs, available at https://www.fincen.gov/resources/statutes￾regulations/guidance/frequently-asked-questions-regarding-customer-due￾diligence. FinCEN may issue additional FAQs, guidance, or grant exceptive relief as appropriate. A covered financial institution with notice of or a reasonable suspicion that a customer is evading or attempting to evade beneficial ownership or other customer due diligence requirements should consider whether it should not open an account, close an account, or file a suspicious activity report, regardless of any interpretations below. Frequently Asked Questions (FAQs) Question 1: Beneficial ownership threshold Can a covered financial institution adopt and implement more stringent written internal policies and procedures for the collection of beneficial ownership information than the obligations prescribed by the Beneficial Ownership Requirements for Legal Entity Customers (31 CFR 1010.230)? A. Yes. Covered financial institutions may choose to implement stricter written internal policies and procedures for the collection and verification of beneficial ownership information than the requirements prescribed by the Rule.

Question 2: Interaction of the beneficial ownership threshold with other AML program obligations Are there circumstances where covered financial institutions should consider collecting beneficial ownership information at a lower equity interest threshold under the anti-money laundering (AML) program rules with regard to certain customers? A. There may be circumstances where a financial institution may determine that collection and verification of beneficial ownership information at a lower threshold may be warranted, based on the financial institution’s own assessment of its risk relating to its customer. Transparency in beneficial ownership, however, is only one aspect of a covered financial institution’s customer due diligence obligations. A financial institution may reasonably conclude that collecting beneficial ownership information at a lower equity interest than 25 percent would not help mitigate the specific risk posed by the customer or provide information useful to the financial institution in analyzing the risk. Rather, any additional heightened risk could be mitigated by other reasonable means, such as enhanced monitoring or collecting other information, including expected account activity, in connection with the particular legal entity customer. In all cases, however, it is important that covered financial institutions establish and maintain written procedures that are reasonably designed to identify and verify the identity of beneficial owners of legal entity customers and to include such procedures in their AML compliance program.1

1. See 31 U.S.C. § 5318(h); 31 CFR 1010.230(a).

Question 3: Collection of beneficial ownership information for direct and indirect owners: Legal entity customers with complex ownership structures When a legal entity is identified as owning 25 percent or more of a legal entity customer that is opening an account, is it necessary for a covered financial institution to request beneficial ownership information on the legal entity identified as an owner? A. Under the Rule’s beneficial ownership identification requirement, a covered institution must collect, from its legal entity customers, information about any individual(s) that are the beneficial owner(s) (unless the entity is excluded or the account is exempted). Therefore, covered financial institutions must obtain from their legal entity customers the identities of individuals who satisfy the definition, either directly or indirectly through multiple corporate structures, as illustrated in the following example. For purposes of the Rule, Allan is a beneficial owner of Customer because he owns indirectly 30 percent of its equity interests through his direct ownership of Company A. Betty is also a beneficial owner of Customer because she owns indirectly 20 percent of its equity interests through her direct ownership of Company A plus 16⅔ percent through Company B for a total of indirect ownership interest of 36⅔ percent. Neither Carl nor Diane is a beneficial owner because each owns indirectly only 16⅔ percent of Customer’s equity interests through their direct ownership of Company B. covered financial institutions must obtain from their legal entity customers the identities of individuals who satisfy the definition, either directly or indirectly through multiple corporate structures, as illustrated in the following example. For purposes of the Rule, Allan is a beneficial owner of Customer because he owns indirectly 30 percent of its equity interests through his direct ownership of Company A. Betty is also a beneficial owner of Customer because she owns indirectly 20 percent of its equity interests through her direct ownership of Company A plus 16⅔ percent through Company B for a total of indirect ownership interest of 36⅔ percent. Neither Carl nor Diane is a beneficial owner because each owns indirectly only 16⅔ percent of Customer’s equity interests through their direct ownership of Company B. A covered financial institution need not independently investigate the legal entity customer’s ownership structure and may accept and reasonably rely on the information regarding the status of beneficial owners presented to the financial institution by the legal entity customer’s representative, provided that the institution has no knowledge of facts that would reasonably call into question the reliability of the information. Question 4: Identification and Verification: Methods of verifying beneficial ownership information What means of identity verification are sufficient to reliably confirm beneficial ownership under the CDD Rule? A. Covered financial
institutions must verify the identity of each beneficial owner according to risk-based procedures that contain, at a minimum, the same elements financial institutions are required to use to verify the identity of individual customers under applicable Customer Identification Program (“CIP”) requirements. This includes the requirement to address situations in which the financial institution cannot form a reasonable belief that it knows the Customer Company A owns 50% Allan owns 60% Betty owns 40% Company B owns 50% Betty owns 33⅓% Carl owns 33⅓% Diane owns 33⅓%

Question 4: Identification and Verification: Methods of verifying beneficial ownership information What means of identity verification are sufficient to reliably confirm beneficial ownership under the CDD Rule? A. Covered financial institutions must verify the identity of each beneficial owner according to risk-based procedures that contain, at a minimum, the same elements financial institutions are required to use to verify the identity of individual customers under applicable Customer Identification Program (“CIP”) requirements. This includes the requirement to address situations in which the financial institution cannot form a reasonable belief that it knows the true identity of the legal entity customer’s beneficial owners.2
2. Under the CIP rules, a financial institution’s CIP must include procedures for responding to
circumstances in which the financial institution cannot form a reasonable belief that it knows the true identity of a customer. These procedures should describe: (1) when the institution should not open an account; (2) the terms under which a customer may use an account while the institution attempts to verify the customer’s identity; (3) when it should close an account, after attempts to verify a customer’s identity have failed; and (4) when it should file a Suspicious Activity Report in accordance with applicable laws and regulations. See, e.g., 31 CFR 1020.220(a)(2)(iii). Although the CDD Rule’s beneficial ownership verification procedures must contain the same elements as existing CIP procedures, they are not required to be identical to them.3
3. See 31 CFR 1020.220(a)(2); 31 CFR 1023.220(a)(2); 31 CFR 1024.220(a)(2); or 31 CFR 1026.220(a)(2).
For example, a covered financial institution’s policies and procedures may state that the institution will accept photocopies of a driver’s license from the legal entity customer to verify the beneficial owner(s)’ identity if the beneficial owner is not present, which is not permissible in the CIP rules. (See Question 6.) A financial institution’s CIP must contain procedures for verifying customer identification, including describing when the institution will use documentary, non-documentary, or a combination of both methods for identity verification.4

4. See 31 CFR 1020.220 (a)(2)(ii).
   Covered financial institutions may use the same methods to verify the identity of the beneficial owner of a legal entity customer. In addition, in contrast to the CIP rule, the CDD Rule expressly authorizes covered financial institutions to use photocopies or other reproduction documents for documentary verification.5

5. See 31 CFR 1010.230(b)(2).

6. See 31 CFR 1020.220 (a)(2)(ii)(A).
   Non-documentary methods of verification may include contacting a beneficial owner; independently verifying the beneficial owner’s identity through the comparison of information provided by the legal entity customer (or the beneficial owner, as appropriate) with information obtained from other sources; checking references with other financial institutions; and obtaining a financial statement.7

7. See 31 CFR 1020.220 (a)(2)(ii)(B).
   Question 5: Collection of beneficial ownership information:
   Required addresses
   What address should be obtained for a legal entity customer’s beneficial owner(s) to comply with the certification requirement – residential or business? A. The address requirements for certification under the CDD Rule are the same as those outlined in the CIP rule. For an individual beneficial owner, covered financial institutions must obtain either a residential or a business street address. If neither is available, acceptable substitutes may include an Army Post Office (APO) or Fleet Post Office (FPO) box number, or the residential or business street address of next of kin or of another contact individual.8

8. See 31 CFR 1020.220(a)(2)(i)(3); 31 CFR 1023.220(a)(2)(i)(3); 31 CFR 1024.220(a)(2(i)(3)); 31 CFR
   1026.220(a)(2)(i)(3).
   Question 6: Identification and verification: Legal entity customer representative What process should a covered financial institution use to identify and verify the identity of a beneficial owner of a legal entity customer when the beneficial owner is unavailable to appear in person during the opening of a new account and chooses to provide to the legal entity’s representative a copy of a driver’s license? A. A covered financial institution may identify the beneficial owner(s) of a legal entity customer either by obtaining a completed Certification Form or equivalent information from the legal entity customer’s representative and may rely on such information, provided that it has no knowledge of facts that would reasonably call

into question the reliability of such information.9

9. See 31 CFR 1010.230(b)(1).
   Furthermore, covered financial institutions may verify the identity of a beneficial owner who does not appear in person, through a photocopy or other reproduction of a valid identity document, or by non-documentary means described in response to Question 4 above. Question 7: Identification and verification: Existing customers as beneficial owners of new legal entity customer accounts If an individual named as a beneficial owner of a new legal entity account is an existing customer of the covered financial institution subject to the financial institution’s CIP, is a covered financial institution still required to identify and verify the identity of this individual, or may it rely on the CIP identification and verification of the individual that it previously performed? A. In general, covered financial institutions must identify and verify the identity of the beneficial owner(s) of legal entity customers at the time each new account is opened. However, if the individual identified as the beneficial owner is an existing customer of the financial institution and is subject to the financial institution’s CIP, a financial institution may rely on information in its possession to fulfill the identification and verification requirements, provided the existing information is up-to-date, accurate, and the legal entity customer’s representative certifies or confirms (verbally or in writing) the accuracy of the pre-existing CIP information. For example, a representative of X Corp opens a new account for the company at a covered financial institution and identifies John Doe, who has a personal account at the institution, as a 25 percent equity owner of X Corp. As required under the CIP rule, the institution identified and verified John Doe’s identity at the time the personal account was established. In this situation, a covered financial institution may rely on the pre-existing CIP identification and verification information it maintains for John Doe, provided that X Corp’s representative certifies or confirms (verbally or in writing) the accuracy of the pre-existing information on John Doe in order to comply with the Rule. The covered financial institution’s records of beneficial ownership for the new account could cross-reference the relevant CIP records and the verification of information would not need to be repeated. Question 8: Location of Certification Form or Appendix A to the final rule Are covered financial institutions required to use the beneficial ownership Certification Form (Appendix A to the Rule) and if so, how can they obtain a copy of the Form?

A. There is no requirement that covered financial institutions use the Certification Form. Rather, the form is optional and provided for the convenience of covered financial institutions as one possible method to obtain the required beneficial ownership information. Financial institutions may choose to comply with the requirements of the Rule by using another method, such as through the institutions’ own forms, or any other means that comply with the substantive requirements of this obligation. Covered financial institutions should retain the form and not file it with FinCEN. Covered financial institutions may obtain a fillable and non-fillable copy of the optional Certification Form in Appendix A of the CDD Rule at https://www.fincen.gov/resources/filing-information. Question 9: Retention of beneficial ownership information: Multiple sets of beneficial ownership certification documents If a covered financial institution has updated the beneficial ownership information on the account(s) of a legal entity customer, and subsequently a new account is opened on behalf of the same legal entity customer, is the institution required to retain all sets of beneficial ownership documentation, thereby retaining up to three sets of information: the original set collected at account opening, the updated set, and a third, a duplicate of the second (updated) set for the new account? A. Yes. Covered financial institutions are required to retain all beneficial ownership information collected about a legal entity customer. Identifying information, including the Certification Form or its equivalent, must be maintained for a period of five years after the legal entity’s account is closed.10
10. See 31 CFR 1010.230(i)(2).
However, all verification records must be retained for a period of five years after the record is made.11
11. Id.
Therefore, whether a financial institution must retain a set of identification or verification records is dependent upon the date an account is opened and closed, or the date a record is made. For example, if a covered financial institution relies on pre-existing beneficial ownership information in its possession as true and accurate identification information when opening a new account for a legal entity customer, the financial institution should maintain the original records, and any updated information, including a record of any verbal or written confirmation of pre-existing information (for example, as described in Questions 7 and 10), until five years after the closing of the new account in order to comply with the recordkeeping requirements in the regulation. Covered financial institutions must also retain a description of every document relied on for verification, any non-

documentary methods and results of measures undertaken for verification, as well as the resolution of any substantive discrepancies discovered in identifying and verifying the identification information for five years after the record is made. Question 10: Identification and verification: Certification when a single legal entity customer opens multiple accounts If a legal entity customer opens multiple accounts at a covered financial institution (whether or not simultaneously), must the financial institution identify and verify the customer’s beneficial ownership for each account? A. Generally, covered financial institutions must identify and verify the legal entity customer’s beneficial ownership information for each new account opening, regardless of the number of accounts opened or over a specific period of time. However, an institution that has already obtained a Certification Form (or its equivalent) for the beneficial owner(s) of the legal entity customer may rely on that information to fulfill the beneficial ownership requirement for subsequent accounts, provided the customer certifies or confirms (verbally or in writing) that such information is up-to-date and accurate at the time each subsequent account is opened and the financial institution has no knowledge of facts that would reasonably call into question the reliability of such information. The institution would also need to maintain a record of such certification or confirmation, including for both verbal and written confirmations by the customer. Question 11: Identification and verification: Accounts for internal recordkeeping or operational purposes FinCEN understands that after a covered financial institution (particularly in the securities and futures industries) opens a new account for a legal entity customer and identifies its beneficial ownership, the financial institution may subsequently open one or more additional accounts or subaccounts for that customer – for the institution’s own recordkeeping or operational purposes and not at the customer’s specific request – so that the customer may, for example invest in particular products or implement particular trading strategies. Would such accounts fall within the definition of “new accounts” for purposes of the beneficial ownership requirement? A. The beneficial ownership requirement applies to a “new account,” which is defined to mean “each account opened … by a legal entity customer”12
12. See 31 CFR 1010.230(g). In addition, the term “account” is defined by reference to the definition in
the CIP rules. 31 CFR 1010.230(c).
[emphasis added]. An account (or subaccount) relating to a legal entity customer will not be considered a “new account” or an “account” for purposes of the Rule when a financial institution creates such an account (or subaccount) for its own

administrative or operational purposes and not at the customer’s request—such as to accommodate a specific trading strategy—and the financial institution has already collected beneficial ownership information on such legal entity customer. The distinction between such accounts opened by customers and those opened solely by the financial institution is consistent with the Rule’s purpose to mitigate the risks related to the obfuscation of beneficial ownership when a legal entity tries to access the financial system through the opening of a new account.13
13. See 68 FR at 25093 (The preamble to the CIP rules provides that “Treasury and the Agencies note
that the [USA PATRIOT] Act provides that the regulations shall require reasonable procedures for ‘verifying the identity of any person seeking to open an account.’ Because these transfers are not initiated by customers, these accounts do not fall within the scope of section 326.”) This interpretation is limited to accounts (or subaccounts) created solely to accommodate the business of an existing legal entity customer that has previously identified its beneficial ownership. Thus, the following accounts (or subaccounts) would not fall within this interpretation:
o accounts (or subaccounts) created to accommodate a trading strategy being carried out by a separate legal entity, including a subsidiary of the existing legal entity customer; and, o accounts (or subaccounts) through which the customer of a financial institution’s existing legal entity customer carries out trading activity directly through the financial institution without intermediation from the existing legal entity customer. Question 12: Collection of beneficial ownership information:
Product or service renewals
Are financial institutions required to have their legal entity customers certify the beneficial owners for existing customers during the course of a financial product renewal (e.g., a loan renewal or certificate of deposit)? A. Yes. Consistent with the definition of “account” in the CIP rules and subsequent interagency guidance,14
14. See “Interagency Interpretive Guidance on Customer Identification Program Requirements under
Section 326 of the USA PATRIOT Act, FAQs: Final CIP Rule,” p. 8 (April 28, 2005).
each time a loan is renewed or a certificate of deposit is rolled over, the bank establishes another formal banking relationship and a new account is established. Covered financial institutions are required to obtain information on the beneficial owners of a legal entity that opens a new account, meaning (in the case of a bank) for each new formal banking relationship established, even if the legal entity is an existing customer. For financial services or products established before May 11, 2018, covered financial institutions must obtain certified beneficial ownership information of the legal entity customers of

such products and services at the time of the first renewal following that date. At the time of each subsequent renewal, to the extent that the legal entity customer and the financial service or product (e.g., loan or CD) remains the same, the customer certifies or confirms that the beneficial ownership information previously obtained is accurate and up-to-date, and the institution has no knowledge of facts that would reasonably call into question the reliability of the information, the financial institution would not be required to collect the beneficial ownership information again. In the case of a loan renewal or CD rollover, because we understand that these products are not generally treated as new accounts by the industry and the risk of money laundering is very low, if at the time the customer certifies its beneficial ownership information, it also agrees to notify the financial institution of any change in such information, such agreement can be considered the certification or confirmation from the customer and should be documented and maintained as such, so long as the loan or CD is outstanding. Question 13: Collection of beneficial ownership information:
Existing accounts
Are covered financial institutions required to collect or update beneficial ownership information on customers with accounts opened prior to May 11, 2018, the Rule’s applicability date? A. Financial institutions are not required to conduct retroactive reviews to obtain beneficial ownership information from customers with accounts opened prior to May 11, 2018. The obligation to obtain or update beneficial ownership information on legal entity customers with accounts established before May 11, 2018, is triggered when a financial institution becomes aware of information about the customer during the course of normal monitoring relevant to assessing or reassessing the risk posed by the customer, and such information indicates a possible change of beneficial ownership.15
15. See 81 FR at 29421.
Question 14: Obligation to solicit or update beneficial ownership information absent specific risk-based concerns Are covered financial institutions required to obtain or update beneficial ownership information during routine periodic reviews of existing accounts, absent risk￾based concerns; that is, are such reviews a trigger for the application of the Rule’s beneficial ownership requirements? A. No. Covered financial institutions do not have an obligation to solicit or update beneficial ownership information as a matter of course during regular or periodic reviews, absent specific risk-based concerns. Financial institutions are required to

develop and implement risk-based procedures for conducting ongoing customer due diligence, including regular monitoring to identify and report suspicious activity and, on a risk basis, to maintain and update customer information. Thus, periodic reviews are not by themselves a trigger to obtain or update beneficial ownership information. As stated in response to Questions 13 and 16, the obligation to obtain or update information is triggered when, in the course of normal monitoring, a financial institution becomes aware of information about a customer or an account, including a possible change of beneficial ownership information, relevant to assessing or reassessing the customer’s overall risk profile. Absent such a risk-related trigger or event, collecting or updating of beneficial ownership information is at the discretion of the covered financial institution. Financial institutions may exercise this discretion to collect or update beneficial ownership information on customers as often as they deem appropriate. Question 15: Processes for monitoring and updating customer information Are covered financial institutions required to implement different processes than currently established to comply with the Rule’s ongoing monitoring and updating requirement? A. To the extent that a covered financial institution has monitoring processes in place that allow the institution to meet the Rule’s requirements, such institution may use its existing monitoring processes to comply with customer due diligence monitoring and updating obligations. As the preamble to the Rule states, “current industry practice to comply with existing expectations for SAR reporting should already satisfy this proposed requirement.”16
16. 81 FR 29420.
Question 16: Updating beneficial ownership information If an update to beneficial ownership information is required, can the change(s) be made in a covered financial institution’s databases without physically obtaining and re-certifying the information? A. It depends. A covered financial institution must develop written internal policies, procedures, and internal controls with respect to collecting, maintaining, and updating a legal entity’s beneficial ownership information. The Rule requires that covered financial institutions monitor and, on a risk￾basis, update the customer information, including the beneficial ownership information, and does not require re-certification when the information is up-

to-date and accurate.17
17. See e.g., 31 CFR 1020.210(b)(5)(ii) (for banks); 1023.210(b)(5)(ii) (for brokers or dealers in securities),
1024.210 (b)(5)(ii) (for mutual funds), 1026.210(b)(5)(ii) (for futures commission merchants and
introducing brokers in commodities).
Covered financial institutions may therefore update their records to reflect a change of information for an existing beneficial owner using the same or similar processes the institution implemented to record account information it obtains from customers in connection with the institution’s account opening processes. For example, if the update were only to a change of address for an existing beneficial owner whose identity information has already been collected and verified, then full re-certification would likely not be required. In this circumstance, it may be reasonable for the covered financial institution to communicate verbally with the legal entity customer to confirm the accuracy of the change of address and reflect such information in its databases. If, however, the updated information were a change of beneficial ownership, then the new beneficial owner’s identity would need to be collected, certified, and verified. Question 17: Beneficial ownership information: Identifying and verifying at account opening compared to updating after a risk￾related trigger Does FinCEN distinguish between the requirements for identifying and verifying beneficial owner information at the time of a new account opening and at the time of a triggering event? A. No. Whether a covered financial institution identifies and verifies the identity of the beneficial owner at the time a legal entity initially opens a new account or at the time of a triggering event, the fundamental elements of identification and verification are the same. That is, covered financial institutions must identify each beneficial owner by obtaining their name, date of birth, address, and identifying number (such as a social security number or other identifying number permissible under the CIP rule), and verify their identities. However, financial institutions’ written policies, procedures, and processes, as well as the sum of information, may differ with respect to the collection of information at the time a legal entity customer initially opens a new account or at the time an existing account is updated after a triggering event. On or after May 11, 2018, when a legal entity customer initially opens a new account or an existing account is updated to incorporate beneficial ownership information for the first time in response to a triggering event, covered financial institutions must identify and verify the identity of beneficial owners as set forth in section 1010.230(b).

Question 18: Collection of beneficial ownership information: Pooled Investment Vehicles whose operators or advisers are not excluded from the definition of legal entity customer Are covered financial institutions required to identify and verify the identity of the beneficial owners that own 25 percent or more of the ownership interests of a pooled investment vehicle whose operators or advisers are not excluded from the definition of legal entity customer? A. No. Although the Rule requires covered financial institutions to collect and verify the identity of beneficial owners who own 25 percent or more of the equity interests of a legal entity customer, in general, institutions are not required to look through a pooled investment vehicle to identify and verify the identity of any individuals who own 25 percent or more of its equity interests. Because of the way in which ownership of a pooled investment vehicle fluctuates, it would be impractical for covered financial institutions to collect and verify ownership identity for this type of entity. Therefore, there is no requirement that the financial institution should request the customer to look through the pooled investment vehicle to determine and report any individual’s equity interest. However, covered financial institutions must collect beneficial ownership information for the pooled investment vehicle under the control prong to comply with the Rule (i.e., an individual with significant responsibility to control, manage, or direct the vehicle; such individuals could be, e.g., a portfolio manager, commodity pool operator, commodity trading advisor, or general partner of the vehicle).18
18. In cases where such manager, operator or advisor is itself an entity, then it would be necessary to
identify an individual with responsibility to control, manage or direct the manager, operator, advisor or general partner. See 31 CFR 1010.230(e)(3)(i), 81 FR at 29415. Question 19: Collection of beneficial ownership information: Trusts with multiple trustees When 25 percent or more of the equity interests of a legal entity customer are owned by a trust that is overseen by co-trustees (multiple trustees), are covered financial institutions required to identify and verify the identity of all co-trustees?

A. No. If a trust owns directly or indirectly, through any contract, arrangement, understanding, relationship or otherwise, 25 percent or more of the equity interests of a legal entity customer, the beneficial owner under the ownership/ equity prong is the trustee. Where there are multiple trustees or co-trustees, financial institutions are expected to collect and verify the identity of, at a minimum, one co-trustee of a multi-trustee trust who owns 25 percent or more of the equity interests of a legal entity customer that is not subject to an exclusion. A covered financial institution may choose to identify additional co-trustees as part of its customer due diligence, based on its risk assessment and the customer risk profile and in accordance with the institution’s account opening procedures. Question 20: Collection of beneficial ownership information: Trustee entity as a beneficial owner If a legal entity is the trustee (e.g., law firm, bank trust department, etc.) of a trust that owns 25 percent or more of the equity interests of a legal entity customer, can that entity be identified as a beneficial owner under the ownership/equity prong or does a natural person need to be so identified? A. If a trust owns directly or indirectly, through any contract, arrangement, understanding, relationship, or otherwise, 25 percent or more of the equity interests of a legal entity customer, the beneficial owner for purposes of the ownership/equity prong is the trustee, regardless of whether the trustee is a natural person or a legal entity.19
19. See 31 CFR 1010.230(d)(3).
In circumstances where a natural person does not exist for purposes of the ownership/equity prong, a natural person would not be identified. However, a covered institution should collect identification information on the legal entity trustee as part of its CIP, consistent with the covered institution’s risk assessment and the customer risk profile. In addition to the ownership/equity prong, covered financial institutions are also required to identify and verify a natural person as the beneficial owner of the legal entity customer under the control prong to comply with the Rule.20
20. See 31 CFR 1010.230(d)(2).
The ownership/equity and control prongs, although related, are independent requirements. Thus, satisfaction of, or exclusion from, regulatory obligations under one prong does not mean a covered financial institution’s obligations under the other prong are also satisfied or excluded.

Question 21: Verification of claims of exclusion from the definition of “legal entity customer” What methods should covered financial institutions use to verify eligibility for exclusion from the definition of a “legal entity customer”? A. Several types of legal entity customers are excluded from the collection and verification requirements of the Rule, under section 1010.230(e)(2), because, for example, their regulators require the reporting of beneficial ownership information or such information is publicly available. A financial institution may rely on information provided by the legal entity customer to determine whether the legal entity is excluded from the definition of a legal entity customer, provided that it has no knowledge of facts that would reasonably call into question the reliability of such information. Whether a financial institution has such knowledge would depend on the facts and circumstances at the time an account is opened. Covered financial institutions must establish and maintain written risk-based procedures reasonably designed to identify and verify the identity of the beneficial owners of all legal entity customers at the time a new account is opened, unless the customer is otherwise excluded from the definition of legal entity customer. Covered financial institutions are expected to address and specify, in their risk-based written policies and procedures, the type of information they will obtain and reasonably rely upon to determine eligibility for exclusions. Question 22: Definition of legal entity customer: Sole proprietorship and unincorporated associations Are sole proprietorships formed by spouses or other unincorporated associations considered legal entity customers under the Rule? A. No. Sole proprietorships—individual or spousal—and unincorporated associations are not legal entity customers as defined by the Rule, even though such businesses may file with the Secretary of State in order to register a trade name or establish a tax account. This is because neither a sole proprietorship nor an unincorporated association is a separate legal entity from the associated individual(s), and therefore beneficial ownership is not inherently obscured.21
21. See 81 FR, 29398, 29412 (May 11, 2016).
Question 23: Definition of charities, non-profits or similar entities Are covered financial institutions limited to the Internal Revenue Code (IRC) definitions of charities, non-profits, or similar entities when assessing their eligibility for exclusion from the definition of legal entity customer?

A. No. The exclusion from the definition of legal entity customer for charities and non-profit entities is not limited to those entities that meet the definition or description of charitable, nonprofit, or similar entities under the IRC. The Rule does not rely on the tax-exempt status of an entity as described in the IRC. All nonprofit entities—whether or not tax-exempt—that are established as a nonprofit, or nonstock corporation, or similar entity that has been validly organized with the proper State authority are excluded from the ownership/equity prong of the requirement because nonprofit entities generally do not have ownership interests.22
22. See 81 FR at 29412.
Financial institutions, however, are required to collect beneficial ownership information under the control prong from any such entity.23
23. Id.
Question 24: Definition of legal entity customer: Publicly traded companies and entities listed on foreign exchanges. Are companies publicly traded in the United States and entities listed on foreign exchanges excluded from the definition of legal entity customer and, therefore, excluded by the Rule? A. Companies traded publicly in the United States are excluded from the definition of legal entity customer. Specifically, the Rule excludes from the definition of legal entity customer certain entities that are considered “exempt persons” under 31 CFR 1020.315(b). This includes any company (other than a bank) whose common stock or analogous equity interests are listed on the New York Stock Exchange, the American Stock Exchange (currently known as NYSE American), or NASDAQ stock exchange.24
24. See 31 CFR 1020.315 (b)(4).
The Rule also excludes a U.S. entity when at least 51 percent of its common stock or analogous equity interest is held by a listed entity.25
25. See 31 CFR 1020.315 (b)(5).
These
U.S. companies are excluded from the Rule because they are subject to public disclosure and reporting requirements that provide information similar to what would otherwise be collected under the Rule. Companies listed on foreign exchanges are not excluded from the definition of legal entity customer. Such companies may not be subject to the same or similar public disclosure and reporting requirements as companies publicly traded in the United States and, therefore, collecting beneficial ownership information for them is required.

Question 25: Collection of beneficial ownership information: Legal entities listed on foreign exchanges May covered financial institutions take a risk-based approach for collecting beneficial ownership information from legal entity customers listed on foreign exchanges? A. No. Financial institutions may not take a “risk-based approach” to collecting the required beneficial ownership information from legal entity customers that are listed on foreign exchanges, because such institutions are not excluded from the definition of legal entity customer. However, as they may with regard to other legal entity customers, whether listed or not, covered institutions may rely on the public disclosures of such entities, absent any reason to believe such information is inaccurate or not up-to-date. Question 26: Foreign financial institutions Does the exclusion for foreign financial institutions from the Rule’s definition of “legal entity customer” depend on whether the beneficial ownership requirements applied by such institution’s foreign regulator match U.S. requirements? A. No. For purposes of beneficial ownership identification, the Rule excludes from the definition of “legal entity customer” a foreign financial institution created in a non-U.S. jurisdiction when the foreign regulator for that financial institution collects and maintains information on the beneficial owner(s) of the regulated institution.26
26. See 31 CFR 1010.230(e)(1)(xiv).
The rule does not require covered financial institutions to research the specific transparency requirements imposed on a foreign financial institution by its regulator and compare them with those imposed on U.S. financial institutions by U.S. Federal functional regulators. However, if the foreign regulator does not collect and maintain beneficial ownership information on the foreign financial institution it regulates, then U.S. financial institutions will have to collect and maintain beneficial ownership information on accounts opened by foreign financial institutions in compliance with the Rule. As with any exclusion, covered financial institutions may rely on the representations of its legal entity customer as to whether an exclusion applies, provided that they have no knowledge of facts that would reasonably call into question the reliability of such representation. (See Question 21.) For purposes of existing customer due diligence requirements, covered financial institutions that maintain correspondent accounts for foreign financial institutions are already required to establish and maintain specific risk-based due diligence procedures and controls for such accounts that include consideration of all

relevant factors,27
27. See 31 CFR 1010.610(a)(2)(iv).
and are required to identify beneficial ownership for certain high-risk foreign banks.28
28. See 31 CFR 1010.610(b)(3).
These correspondent accounts will continue to be subject to these existing requirements rather than the requirements set forth in the AML Program requirements contained in the Rule. Question 27: Exclusion from the definition of legal entity customer:
U.S. Government list of foreign regulators that maintain beneficial ownership information Will the U.S. Government maintain a list of non-U.S. jurisdictions where the regulator of financial institutions within that jurisdiction maintains beneficial ownership information regarding the financial institutions they regulate or supervise? A. No. Covered financial institutions should contact the relevant foreign regulator or use other reliable means to ascertain whether the foreign regulator maintains beneficial ownership information for the financial institutions that it regulates or supervises. Question 28: Exclusion from the definition of legal entity customer:
Non-U.S. governmental department, agency, or political subdivision engaged only in governmental activities What types of entities would be considered a “non-U.S. governmental department, agency or political subdivision that engages only in governmental rather than commercial activities”29
29. 31 CFR 1010.230(e)(2)(xv).
such that they would qualify for exclusion from the definition of a legal entity customer? A. Examples of legal entity customers that would be considered non-U.S. governmental entities engaged in only governmental and not commercial activities include entities that are owned and operated by a non-U.S. government agency or political subdivision, such as embassies or consulates, as well as entities that are instrumentalities of a foreign government, such as government-owned enterprises engaging in activities that are exclusively governmental in nature, that is, activities involving the direct exercise of legislative, executive, or judicial authority and which do not involve taking profits from the endeavor. Those State-owned enterprises engaged in profit-seeking activities, including, among others, sovereign wealth funds, airlines, or oil companies, would not qualify for the legal entity customer exclusion. Generally, many State-owned enterprises may not have an individual that owns at least a 25 percent equity interest because a governmental department, agency, or political subdivision holds such interest.

In these circumstances, a covered financial institution would only be required to identify an individual under the control prong. Similarly, with respect to a State-owned enterprise that is a pooled investment vehicle not subject to another exclusion, financial institutions would be required to obtain beneficial ownership information under the control prong but not under the ownership/equity prong of the definition of beneficial owner. Furthermore, similar to other instances of identification and verification within the Rule’s context, a covered financial institution may reasonably rely upon the representations of the legal entity customer, absent knowledge of facts that would call into question the reliability of the beneficial ownership information provided to the financial institution. Question 29: Private label retail credit accounts established at the point of sale Does the point of sale exception only apply to accounts opened at the cash register or does it refer to all applications for credit accounts that are for use at the private label retailer only? A. The Rule provides an exemption from the requirements for a covered financial institution that “opens an account for a legal entity customer that is: [a]t the point￾of-sale to provide credit products, including commercial private label credit cards, solely for the purchase of retail goods and/or services at these retailers, up to a limit of $50,000.” The point of sale exemption is provided for retail credit accounts opened to facilitate purchases made at the retailer because of the very low risk posed by opening such accounts at the brick and mortar store. Question 30: Equipment Finance and Lease Exemption: Definition of equipment What kind of businesses and equipment are covered under the equipment finance exemption? A. The Rule reflects FinCEN’s understanding that businesses require financing to obtain equipment to conduct ongoing business operations. Many such businesses, including both large and small businesses, open accounts solely for the purpose of financing the purchase or lease of that equipment. Subject to certain limitations, the Rule provides an exemption from the requirement to identify and verify the identity of a legal entity customer’s beneficial owners for equipment finance and lease accounts established at a covered financial institution because of the low risk for money laundering posed by these accounts.30
30. See 31 CFR 1010.230(h)(1)(iv).
The exemption is intended

to cover business equipment such as farm equipment, construction machinery, aircraft, computers, printers, photocopiers, and automobiles that a business purchases or leases. The Rule does not limit the exemption to small businesses. Regardless of the application of the exemption, a covered financial must comply with all other applicable BSA/AML obligations, which may include the obligation to file SARs where there is a suspicion that the equipment may be used to facilitate criminal activity. Question 31: Equipment Finance and Leasing Exemption: Accounts opened to finance the purchase or leasing of equipment Does the equipment lease and purchase exemption apply when the customer leases directly from the covered institution? A. Yes, consider the following. Aviation LLC, which operates several flight training schools, visits Aircraft Vendor to acquire five aircraft for its flight training schools. Aviation LLC selects the aircraft and contacts the Lessor Covered Financial Institution to obtain the necessary equipment finance to acquire the aircraft. After a review of the aircraft and Aviation LLC’s business, the Lessor Covered Financial Institution agrees to purchase the aircraft from Aircraft Vendor and then lease them to Aviation LLC for a specified rent amount and duration. The Lessor Covered Financial Institution purchases the aircraft, pays the purchase price directly to Aircraft Vendor, and obtains title to the aircraft as collateral. The Lessor Covered Financial Institution then enters into a lease agreement with Aviation LLC, which opens an account at the financial institution solely for the purpose of obtaining the aircraft and making periodic rent payments. There is no possibility of a cash refund to Aviation LLC under the lease terms. The equipment lease and purchase exemption would apply because the account established at the covered financial institution meets all of the requirements of the exemption, which are that (1) the account’s purpose is to finance the purchase or leasing of equipment, (2) payments are remitted directly by the financial institution to the vendor or lessor, and (3) there is no possibility of a cash refund on the account activity. First, Covered Financial Institution remit full payment directly to the vendor and obtained title to the equipment in order to lease the equipment to the legal entity customer. Second, Aviation LLC opened the account solely for the purpose of financing an equipment lease to acquire aircraft for its training schools. Finally, there is no possibility of a cash refund to Aviation LLC. As noted in the final rule, accounts created to provide financing for equipment lease or purchase, subject to certain conditions, are exempt from the beneficial ownership requirement because they present a low risk for money laundering and terrorist financing.31
31. Id.

Question 32: Currency Transaction Report (CTR) and aggregation of transactions Under what circumstances should the transactions of a legal entity customer and those of the beneficial owner(s) be aggregated for purposes of filing a CTR? Are financial institutions required to proactively cross-check beneficial ownership information to comply with the CTR aggregation requirement? A. As a general matter, financial institutions are required to aggregate multiple currency transactions “if the financial institution has knowledge that [the multiple transactions] are by or on behalf of any person and result in either cash in or cash out totaling more than $10,000 during any one business day.”32
32. 31 CFR 1010.313.
With respect to legal entity customers that may share a common owner, unless there is an affirmative reason to believe otherwise, covered financial institutions should presume that different businesses that share a common owner are operating separately and independently from each other and from the common owner. Thus, absent indications that the businesses are not operating independently (e.g., the businesses are staffed by the same employees and are located at the same address, the accounts of one business are repeatedly used to pay the expenses of another business or of the common owner), financial institutions should not aggregate transactions involving those businesses with those of each other or with those of the common owner for CTR filing.33
33. See FinCEN Ruling 2001–2, “Currency Transaction Reporting: Aggregation,” (Aug. 23, 2001) and
FinCEN Guidance 2012-G001, “Currency Transaction Report Aggregation for Businesses with Common Ownership,” (March 16, 2012), respectively. See also 81 FR at 29409. Question 33: Listing beneficiaries on CTRs When completing a CTR for a business (i.e., corporations, limited liability companies, and general partnerships) will beneficial owners now need to be listed as beneficiaries in such CTRs? If yes, would this also include trust and estate accounts? A. No. The Rule does not change the existing currency transaction reporting requirements or any guidance FinCEN published pursuant to this reporting requirement. Thus, a covered financial institution is not required to list the beneficial owners of a business, or trust or estate account, when completing a CTR as a matter of course. A financial institution must list a beneficial owner in Part 1 of the CTR only if the financial institution has knowledge that the transaction(s) requiring the filing is made on behalf of the beneficial owner and results in either cash in or cash out totaling more than $10,000 during any one business day.

Question 34: Impact of the Rule on the AML program Board of Directors or senior management review process Are covered financial institutions now required to follow specific procedures to approve changes to AML programs or require Boards of Directors or senior management to approve such changes? Can Federal functional regulators direct financial institutions within their jurisdiction to follow a specific approval process? A. Covered financial institutions may continue to follow their existing internal procedures for approving AML program changes, including changes that incorporate the Rule’s new program requirements. However, these procedures should be consistent with the requirements and expectations of the institution’s Federal functional regulator. Question 35: Documenting nature and purpose of customer relationship on a risk-basis The Rule requires financial institutions to understand “the nature and purpose of customer relationships to develop a customer risk profile.” What type of information should financial institutions collect to satisfy this requirement and may the documentation of the nature and purpose of a customer relationship be made on a risk-basis? A. Understanding the nature and purpose of a customer relationship in order to develop a customer risk profile is an important part of ongoing customer due diligence, and is required for all customers and accounts. An understanding based on category of customer means that for certain lower-risk customers, a financial institution’s understanding of the nature and purpose of a customer relationship can be developed by inherent or self-evident information, such as the type of customer or type of account, service, or product or other basic information about the customer including information obtained at account opening. The profile may, but need not, include a system of risk ratings or categories of customers. Accordingly, the documentation that is required to demonstrate an understanding of the nature and purpose of a customer relationship would vary with the type of customer, account, service, or product. Question 36: Use of information on customer risk profile Once the nature and purpose of a customer relationship has been established, what are FinCEN’s expectations concerning the use of this information?

A. Understanding the nature and purpose of a customer relationship—the information gathered about a customer at account opening—is essential to developing a customer risk profile. This information should be used to develop a baseline against which customer activity, such as the customer’s expected use of wires or typical number of deposits in a month, can be assessed for possible suspicious activity reporting. If account activity changes, particularly with regard to what should be anticipated based on the original nature and purpose of the account, risk-based monitoring may identify a need to update customer information, including, as appropriate, beneficial ownership. Question 37: The nature and purpose of customer relationship In understanding the nature and purpose of customer relationships, are financial institutions required to develop and document customer risk profiles for self￾evident products or customer type (e.g., a safe deposit box)? A. Financial institutions must implement risk-based procedures as part of their AML program to demonstrate an understanding of the nature and purpose of customer relationships to develop customer risk profiles. Customer risk profiles refer “to the information gathered about a customer at account opening used to develop a baseline against which customer activity can be assessed for suspicious activity reporting. This may include self-evident information such as the type of customer, or type of account, service or product.”34
34. 81 FR 29398, 29398 (May 11, 2016).
It is reasonable that in the case of certain products, such as safety deposit boxes, the nature and purpose are self-evident and therefore no additional documentation would be needed to demonstrate an understanding of their nature and purpose, beyond the documentation to establish the particular type of account. ### For Further Information Additional questions or comments regarding the contents of this Guidance should be addressed to the FinCEN Resource Center at FRC@fincen.gov, (800) 767-2825, or (703) 905-3591. Financial institutions wanting to report suspicious transactions that may relate to terrorist activity should call the Financial Institutions Toll-Free Hotline at (866) 556-3974 (7 days a week, 24 hours a day). The purpose of the hotline is to expedite the delivery of this information to law enforcement. Financial institutions should immediately report any imminent threat to local-area law enforcement officials.

FinCEN’s mission is to safeguard the financial system from illicit use and combat money laundering and promote national security through the collection, analysis, and dissemination of financial intelligence and strategic use of financial authorities.