Business Account Opening After the CTA Rollback: The 2026 KYB and CDD Playbook

What changed in 2026

Two FinCEN actions this year moved the weight of beneficial-ownership compliance off a federal database and onto the institution's own onboarding.

The plain-language reading. Before August, a company's ownership could in principle exist in two places: your file and FinCEN's registry. Now there is one. The certification your new-accounts desk collects under 31 CFR 1010.230 is the domestic record.

The February relief is the other half. It lets you stop re-collecting a full certification on every new account for an existing legal-entity customer, provided your procedures say when you verify (onboarding), when you re-verify (red flags, risk-based triggers) and what you accept in between (customer certification). It is optional. A bank that has not updated its written BSA/AML procedures has not taken the relief, whatever staff do at the counter.

The revision is the open item. FinCEN has committed to changing the CDD Rule and has not said when or how. The practical response is a process you can adjust by changing rules and disclosure versions rather than reprinting forms and retraining tellers. Credit unions with business programs are covered financial institutions under the same rule and sit in the same position.

Why this is a growth moment as much as a compliance task

The onboarding session that carries your BSA exposure also carries your small-business deposit target, and most of the market has left the second half unbuilt.

Only 17% of financial institutions offer digital business account opening at all, and those that do open just under 25% of their business accounts online (Alkami and Cornerstone Advisors, 2026 Digital Banking Performance Metrics, May 2026). Where it exists, completion averages 11 to 13 minutes (ProSight, July 2026). Everywhere else, Cornerstone Advisors measures four-plus hours and $250 to $2,000 of cost per business application, with 80% of institutions rating business account-opening speed a pain point.

Demand is not the constraint. 75% of financial institution CEOs say they are expanding small-business services (Jack Henry 2026 Strategy Benchmark, April 2026). 48% of businesses are at least somewhat likely to switch their primary banking provider (Cornerstone Advisors via CU Times, August 2026), about 28% may seek a new relationship within six months, and among firms over $1M in revenue more than 60% would switch for better digital (ProSight, July 2026).

Two more ProSight figures explain why the session matters more than the rate sheet. The primary bank captures more than two-thirds of a business's deposits, and 87% of business owners use the same institution for personal and business banking. Whoever opens the business account in one sitting tends to hold both relationships. Whoever asks the owner to come back Thursday with a printed certification form tends to hold neither.

Step 1 — Make CDD the system of record

If the account-opening record is the record, it has to be built like one. Three properties matter to an examiner and to your BSA officer.

Complete on both prongs. 31 CFR 1010.230 asks for each individual who owns 25% or more of the legal entity (the ownership prong) and one individual with significant responsibility to control, manage or direct it (the control prong). Digital collection should structure these as data, not free text: legal name, date of birth, address and identification number for each owner; role and identifying information for the control person; ownership percentages that reconcile against the entity's stated structure. A form that lets a customer skip an owner or type "N/A" is one you will re-collect later.

Certified in session. The customer certifies the accuracy of the beneficial-ownership information at opening. In a digital flow that is a versioned disclosure with an e-signature captured in the same session, tied to a verified identity. Cotribute presents versioned disclosures and captures e-signature inside the application, so the certification, the disclosure version the customer saw and the identity that signed are stored together.

Retained and reconstructable. The record needs to show what the customer attested and when, years later. Cotribute's audit trail keeps seven years of history with PII masked by default, so a BSA officer or examiner can pull the record as it stood on the opening date without exposing personal data to everyone who runs the report. And because the certification is captured in the application that creates the core account, it matches that account by construction; one imaged and filed separately has to be proven to match later.

Step 2 — Encode your re-verification policy

The February relief lets you set the moments when you verify beneficial owners: initial onboarding, red flags, and your own risk-based procedures. That is a policy statement until it becomes rules the flow actually runs. Encoded, it looks like this.

Initial onboarding. Every new legal-entity customer's owners and control person are identity-verified and screened before the first account funds. No exceptions by channel; branch, call center and online run the same rules.

Subsequent accounts. An existing legal-entity customer opening an additional account is recognized, its certification on file is presented to confirm or amend, and full re-verification is skipped unless a trigger fires. Cotribute's existing-customer recognition pre-fills, applies skip logic and avoids re-verifying people the bank has already verified, which is the mechanism the relief lets your procedures extend to legal-entity customers.

Red flags. The rule set names them: a change in ownership percentages against the certification on file; a new control person; a Secretary of State status moved from active to inactive or revoked; a TIN mismatch on an entity that previously matched; a new owner who fails watchlist screening or returns a low-confidence identity result. Each trigger maps to an action: refer to BSA, hold funding, request documents.

Risk-based triggers. Your BSA risk assessment already ranks entity types, industries and geographies. Those rankings become thresholds: a high-risk industry code or money-services-business indicator forces full verification on every account; a low-risk single-member LLC in your footprint relies on certification.

Two design rules keep this examinable. First, the rules are deterministic: the same application data produces the same verification path every time. Second, every change to a rule is logged with what changed, who changed it and when, so the rule set can be reconstructed as it stood on any date. If an examiner asks why a customer opened a second account in March without re-verification, you show the March rule set and the March certification.

Where a third-party score feeds a rule, such as a business fraud or synthetic-identity score, the score is the vendor's model. The rule that consumes it and its threshold are yours, and they are what the log records.

Step 3 — Verify entity and people in one session

Collection and policy set up the record; verification makes it credible, and one session turns it from a queue into a growth workflow. Cotribute runs account origination for institutions from $100M credit unions to a Fortune 500 company, and the business sequence is the same at every size:

1. Entity. Legal name, entity type, formation state, TIN. The TIN is matched. Secretary of State standing is checked in the formation state and reconciled against what the applicant entered.
2. KYB. Know-your-business checks on the entity itself, including business fraud signals from BusinessGuard+, which covers business fraud across all 50 states. The score is an input to your rules; the threshold is yours.
3. People. Every beneficial owner and every authorized signer goes through identity verification and watchlist screening, including OFAC. The control person is verified whether or not they own a share. Additional owners verify inside the same session, not by follow-up email.
4. Certification. With entity and people verified, the applicant reviews the beneficial-ownership certification as structured data, confirms, and e-signs the versioned disclosure.
5. Funding and core write. The account funds in session with a one-time passcode on money movement, and the account, its owners and signers write to the core in real time. The core stays the system of record.

Cotribute requires no core conversion, no LOS replacement and no digital banking replacement to run this. The platform is integrated with 13 core platforms, real-time on 11, and 36+ direct API integrations carry the verification vendors. Where your bank already contracts with a KYB, identity or fraud provider, that vendor runs on your contract and pricing; Cotribute charges no connector fees.

One session also leaves the business owner at the keyboard when the account is open. Consumer and business run on the same platform, so the owner who has just opened business checking can be offered a personal account, or recognized as an existing personal customer and pre-filled rather than asked to start over. That is ProSight's 87% turned into a workflow.

Business lending runs in front of your LOS on the same platform; the detail is at /platform-business-lending.

The shell-company pattern to watch

In May 2026 the Oklahoma Bankers Association alerted members to a scheme in which consumers are recruited to open shell "merchant" accounts for entities with names containing "MARKETING", "DIGITAL" or "ECOM STORE", then used to launder high-risk merchant activity (Oklahoma Bankers Association, May 2026). The entity is often genuinely formed. The applicant is often a real person with clean identity documents. Nothing about the paperwork, taken one piece at a time, is false.

That is why this pattern tests whether your CDD collection is a record or a ritual. The signals that catch it are by-products of a one-session verification:

• Formation-to-application gap. A Secretary of State record showing the entity was formed days before the application, or a formation address that recurs across unrelated applicants.
• Ownership that does not fit the story. A sole owner and control person with no plausible connection to the stated business, or a control person who is not the applicant and is not present in the session.
• Name pattern plus industry. Generic marketing or e-commerce naming combined with a high-risk merchant category, which your risk-based rules route to full verification and BSA review before funding.
• Device and velocity. The same device, IP range or geolocation across several "unrelated" business applications in a short window, or expected volume inconsistent with a days-old entity.

Cotribute's 70+ configurable fraud and decisioning rules cover device and geolocation, synthetic-identity scoring, document verification, OFAC and watchlist screening and velocity. The thresholds are yours. The shell pattern is visible at the front door, before the first deposit, but only if the entity, the people and the device are examined together in one pass.

About 40% of banks reported higher fraud losses in 2025 (Cornerstone Advisors, What's Going On in Banking 2026, February 2026), and synthetic identity is the most tracked fraud type, at 44% of institutions (Alloy 2026 State of Fraud, December 2025). Business onboarding is where a synthetic person and a real entity meet. Catching it there is cheaper than SAR review.

Frequently asked questions