When FinCEN implemented its final rule on August 14, 2026, it permanently exempted US entities from beneficial ownership reporting under the Corporate Transparency Act. For you and your team managing third-party risks, this isn't just a filing change. It's a fundamental shift in verifying who controls the American companies in your portfolio.
This checklist will help you adapt your due diligence processes to maintain effective sanctions compliance and KYC controls now that federal beneficial ownership data is no longer available for US entities.
What This Checklist Covers
This checklist provides practical steps for identifying beneficial ownership and assessing sanctions risk when dealing with US companies that no longer report to FinCEN. It covers both your initial onboarding processes and ongoing monitoring obligations. The guidance assumes you're subject to AML regulations in your jurisdiction, such as the UK's Money Laundering Regulations 2017, or US sanctions requirements that continue regardless of CTA exemptions.
Prerequisites
Before using this checklist, confirm:
- Your organization has documented risk assessment procedures that consider customer and geographic risk factors.
- Your team understands OFAC's 50 Percent Rule, which treats entities as blocked when 50% or more is owned by blocked persons, directly or indirectly.
- You have access to sanctions screening tools that can handle both entity-level and individual-level searches.
- Your contract templates or engagement letters include provisions allowing you to request ownership documentation.
Due Diligence Checklist
1. Update your risk assessment framework to reflect reduced federal oversight
Don't assume that US incorporation means beneficial ownership has been verified by a federal authority. Your firm-wide risk assessment should explicitly note that US companies no longer report this information to FinCEN. Good practice looks like: Your written risk assessment procedures acknowledge the CTA exemption and explain how your firm will independently verify ownership for US entities based on risk factors.
2. Document your ownership verification approach for US entities
Define what constitutes "reasonable measures" to verify beneficial ownership when dealing with US companies. This should vary by risk level but can't simply default to "not available." Good practice looks like: A tiered approach where low-risk US entities require basic ownership attestation, while higher-risk structures trigger requests for operating agreements, shareholder registers, or corporate resolutions.
3. Screen beyond the entity name
Your sanctions screening can't stop at running the company name through your database. For US entities with complex structures or connections to higher-risk jurisdictions, identify and screen individuals and entities in the ownership chain. Good practice looks like: A documented process for when and how you escalate to multi-layer ownership screening, with clear triggers based on transaction value, jurisdiction, industry, or structure complexity.
4. Request ownership documentation directly from US counterparties
When your risk assessment warrants it, ask US companies for the same information they would have reported under the CTA: individuals who own or control 25% or more, plus any individual exercising substantial control. Good practice looks like: Standard information request templates that explain why you need the information (your regulatory obligations, not their reporting obligations) and what documents satisfy your requirements.
5. Identify indirect ownership that could trigger OFAC's 50 Percent Rule
Don't assume that because a US company isn't on the SDN List, it's clear. If blocked persons collectively own 50% or more through holding companies or other structures, the entity itself is treated as blocked. Good practice looks like: A documented procedure for tracing ownership through at least two layers when risk factors warrant it, with clear escalation criteria for legal review.
6. Distinguish between different "beneficial ownership" definitions
Your AML beneficial ownership analysis (often 25% threshold) and your OFAC 50 Percent Rule analysis serve different purposes and may produce different questions about the same structure. Don't treat these as interchangeable. Good practice looks like: Separate documentation showing both analyses were completed where applicable, with clear notes about which standard applies to which decision.
7. Establish triggers for ongoing ownership monitoring
The UK Money Laundering Regulations 2017 require ongoing due diligence appropriate to risk. Define what events trigger a fresh look at ownership: material transactions, structural changes, or information suggesting your original understanding was incomplete. Good practice looks like: Clear criteria in your monitoring procedures specifying when you re-verify ownership, not just "periodically" or "as needed."
8. Train your team on the practical implications
Your front-line staff need to understand that this isn't about US companies becoming "high risk" automatically. It's about recognizing when you don't have the information you need and knowing how to get it. Good practice looks like: Scenario-based training showing when to request additional documentation and how to explain the request to a US counterparty who may be confused about why you're asking.
Common Mistakes
Treating all US entities as higher risk. Geography is one risk factor among many. The FinCEN rule change doesn't automatically elevate every American company. What's changed is the availability of centralized federal data, not the underlying risk profile of well-established US businesses.
Assuming CDD obligations have also been relaxed. They haven't. If you're a UK firm subject to regulation 28 of the Money Laundering Regulations 2017, a US company's exemption from FinCEN reporting provides no exemption from your customer due diligence requirements.
Relying solely on automated entity screening. Screening the name of a Delaware LLC tells you nothing about whether a blocked person owns it through a holding company structure. Automated tools are necessary but insufficient when ownership matters to your compliance obligations.
Failing to document why you didn't pursue additional ownership information. If you decide the risk is low enough that basic attestation suffices, document that decision. "We didn't ask" is not a defensible position if ownership later becomes relevant to an enforcement action.
Next Steps
Review your current portfolio of US entity relationships and identify which warrant immediate ownership re-verification based on your risk criteria. This isn't about re-onboarding everyone; it's about ensuring your risk assessment reflects current information availability.
Update your onboarding templates and questionnaires to explicitly request beneficial ownership information from US entities, with clear explanations of your regulatory obligations.
Schedule a review of your sanctions screening procedures with your compliance and legal teams. Confirm that your process can identify indirect ownership that could trigger OFAC's 50 Percent Rule, and that your team knows when to escalate for multi-layer analysis.
The US has stepped back from centralized beneficial ownership collection. Your due diligence obligations have not stepped back with it.
