FinCEN Stopped Collecting Beneficial Ownership. Your Onboarding File Still Has to Ask.

Since 14 August 2026, a U.S.-formed business applying for a merchant account has had no federal obligation to report who owns it to FinCEN. That is a real and permanent change, and merchants have read the headlines. If your underwriting team reads the same headlines as permission to stop asking for ownership, it has merged two rules that were never the same rule.

One of them ended. The other is now carrying more weight than it was a month ago. Here is what each does, as of September 2026, and where the difference shows up in an onboarding queue.

What Actually Ended on 14 August

FinCEN announced a final rule on 11 August 2026 that permanently removes the requirement for U.S. companies and U.S. persons to report beneficial ownership information under the Corporate Transparency Act. It took effect on publication in the Federal Register on 14 August 2026, making permanent an exemption that had previously been granted on an interim basis.

In its current form the reporting regime works out to this:

• Entities formed in the United States are exempt. There is no domestic filing obligation and no deadline to miss.
• A "reporting company" now means an entity formed under foreign law that has registered to do business in a U.S. state or tribal jurisdiction.
• Those foreign reporting companies do not report U.S. person beneficial owners or U.S. person company applicants — only foreign individuals.
• A newly registered foreign entity has 30 calendar days to file after receiving notice that its registration is effective.
• FinCEN says it will delete information from the database that it reasonably believes relates to a U.S. person, identified from documents such as a U.S. passport or driver's licence.
• U.S. persons who already hold a FinCEN ID are not required to update or correct what they previously submitted.

Treasury framed it as deregulation for small business, with Secretary Scott Bessent calling the action "a victory for common sense and American small businesses." The residual population is small — law-firm analyses of the rule put it in the tens of thousands of foreign-registered entities, but their estimates differ from one another, so treat any single figure you find quoted online as unverified.

What matters for onboarding is the second-order effect, which nobody put in a press release: the federal database that was supposed to become a shared reference point for who owns a U.S. business is not going to be one. It is being emptied of domestic records rather than filled with them.

What Did Not Change: The CDD Rule

FinCEN's Customer Due Diligence Rule is a separate 2016 regulation with a separate purpose. The Corporate Transparency Act told companies to report ownership to the government. The CDD Rule tells financial institutions to collect ownership from their customers. Ending the first does nothing to the second, and the August final rule left it in force.

The CDD Rule covers U.S. banks, mutual funds, brokers and dealers in securities, futures commission merchants and introducing brokers in commodities. For each legal entity customer, a covered institution must identify and verify every individual who owns 25 percent or more of the entity, plus one individual who controls it — the control prong — regardless of how much of it that person owns.

With domestic CTA reporting gone, that rule is now the primary route by which beneficial ownership of U.S. companies reaches the financial system at all. FinCEN has said it is required to modify the CDD Rule and intends to return to that rulemaking, but it has committed to no timeline. Until it does, the existing text is what applies, and planning around a revision that has not been proposed is not a plan.

The February Order That Did Change Something

There is one 2026 change to CDD practice, and it is easy to conflate with the August rule because it moved in the same direction. On 13 February 2026, FinCEN issued an exceptive relief order removing the requirement that a covered institution re-identify and re-verify a legal entity customer's beneficial owners every time that customer opens another account.

Under the order, identification and verification are required in three circumstances:

1. When the legal entity customer first opens an account with the institution.
2. When the institution has knowledge of facts that reasonably call into question the reliability of beneficial ownership information it obtained previously.
3. As otherwise required by the institution's own risk-based procedures for ongoing customer due diligence.

Read that carefully, because it is a cadence change and not a collection change. The first account still requires full identification and verification. Everything around it — the written AML program, ongoing monitoring, suspicious activity reporting, keeping customer information current on a risk basis — is untouched, and an institution remains free to hold itself to a stricter standard than the relief allows.

Why This Lands Differently on an ISO or PayFac

Neither rule names independent sales organisations, payment facilitators or software platforms. An ISO is not a covered financial institution under the CDD Rule, which is exactly why the question "has this been repealed for us?" has a confusing answer: the requirement you are following was probably never a regulation that applied to you in the first place.

It reaches you through the sponsor. The acquiring bank is covered, the sub-merchant portfolio is the bank's exposure, and the obligation arrives as a term in the sponsorship agreement — often at a threshold the bank set from its own risk assessment rather than the regulatory 25 percent. That contract did not change on 14 August, and it will not change because a merchant read that the Corporate Transparency Act no longer applies to it. The document that governs what you collect is the sponsorship agreement, not the Federal Register.

Sanctions screening is the other reason the ownership fields have to stay. OFAC obligations bind U.S. persons generally and rest on their own legal basis, entirely separate from either rule discussed here — and you cannot screen an owner you never collected. An onboarding flow that drops ownership capture does not just weaken diligence; it removes the input to a control that neither of these actions touched.

What to Change, and What to Leave Alone

The practical work here is smaller than the headline suggests, and most of it is deletion of steps that are now dead rather than redesign.

• Leave the ownership fields in place. Collection of 25-percent-or-more owners and a control person stays, at whatever threshold your sponsor sets.
• Retire any step that asks a U.S. merchant to confirm it filed a BOI report, or to supply a filing confirmation. That obligation no longer exists, the underlying domestic records are being deleted, and a step that cannot be satisfied will either stall files or be waved through — both worse than not asking.
• Do not treat a FinCEN ID or a past filing as verification. It was never a source an ISO could query, and for U.S. persons it is now a reference to a record scheduled for deletion.
• Brief the sales floor with one line, because the objection is coming: the government stopped collecting this; your bank did not stop requiring it.
• If you re-collect ownership every time an existing merchant opens an additional MID, that repeat step is what the February order relaxed — for the bank. Ask your sponsor whether it has adopted the relief before you remove the step on your own initiative.
• For foreign-registered merchants, the federal obligation is still live, and a foreign entity whose owners are all U.S. persons may have nothing to report. Nothing to report is not the same as nothing to verify.
• Keep the audit trail. The evidentiary standard for how you established ownership was not relaxed by either action.

The One-Line Version

The reporting requirement ended; the diligence requirement did not. What actually changed for a merchant services team is that a federal dataset which might one day have corroborated a merchant's ownership claims is being emptied instead of built — which makes the ownership data you collect at onboarding more load-bearing than it was, not less. The rule that told your merchant to tell the government went away. The rule that tells your bank to ask is still there, and it is now the only one asking.