The FinCEN final rule ending Corporate Transparency Act reporting places the responsibility of detecting shell companies directly on your institution. While the CDD rule (31 CFR § 1010.230) remains unchanged, your reliance on centralized beneficial ownership registries is no longer an option. If your process relies solely on customers self-certifying their ownership structures, you're at risk.
This checklist provides actionable steps to enhance beneficial ownership verification and spot shell company indicators before they lead to enforcement actions.
Prerequisites
Before using this checklist, ensure:
- Your institution is subject to the CDD rule (banks, broker-dealers, mutual funds, futures commission merchants, and introducing brokers in commodities).
- You have documented procedures for collecting beneficial ownership information under 31 CFR § 1010.230(b).
- Your team understands the four core CDD requirements: identity verification, beneficial ownership identification, understanding the nature and purpose of customer relationships, and ongoing monitoring.
- You maintain SAR backup documentation protocols, as beneficial ownership data must support your Suspicious Activity Reports.
Beneficial Ownership Verification Checklist
1. Document Formation and Registration Details
Action: Request and verify the customer's articles of incorporation, operating agreement, or equivalent formation documents.
Requirement: 31 CFR § 1010.230(b)(1) requires identifying and verifying beneficial owners.
What good looks like: You have copies of state-filed formation documents showing filing dates, registered agent information, and jurisdiction. Verify these against the Secretary of State database. If the registered agent is a formation mill with no operational connection, escalate for enhanced due diligence.
2. Validate Business Presence and Operations
Action: Confirm the entity maintains a verifiable business presence beyond a registered agent address.
Requirement: Understanding the nature and purpose of the customer relationship per 31 CFR § 1010.230(b)(3).
What good looks like: Document the principal place of business. Verify the company has an online presence consistent with its stated activities. If there's no digital footprint or public-facing operations, document this discrepancy and apply enhanced monitoring.
3. Verify Revenue Sources and Business Model
Action: Obtain and document the entity's revenue sources, customer base, and operational model.
Requirement: Risk-based approach to CDD under 31 CFR § 1010.230(b).
What good looks like: The customer provides a coherent explanation of revenue generation. Verify claimed business relationships where possible. If revenue is inconsistent with the stated business model, escalate for review.
4. Cross-Reference Beneficial Owners Across Entities
Action: Screen beneficial owners against your institution's customer base to identify common ownership patterns.
Requirement: Ongoing monitoring obligation under 31 CFR § 1010.230(b)(4).
What good looks like: Maintain a database of beneficial owners across all legal entity customers. Identify instances where the same individuals control multiple entities and assess whether this suggests legitimate business structures or layering. Document your risk assessment for customers whose beneficial owners appear across five or more unrelated entities.
5. Assess Control Person Expertise and Involvement
Action: Verify that individuals identified as control persons have relevant expertise or operational involvement in the business.
Requirement: Identifying beneficial owners who exercise significant control per 31 CFR § 1010.230(d)(3).
What good looks like: Control persons have relevant professional backgrounds, credentials, or experience. They can articulate the business model and strategic direction. If a control person has no apparent connection to the industry, apply enhanced due diligence.
6. Document Ultimate Beneficial Ownership Chains
Action: Map ownership structures through all intermediary entities to natural persons who own 25% or more.
Requirement: 31 CFR § 1010.230(d)(2) defines beneficial owners as individuals owning 25% or more equity.
What good looks like: Create an ownership diagram showing all layers of ownership. Verify beneficial owners at each level. If ownership chains extend through multiple jurisdictions or involve entities in secrecy havens, document the business rationale and apply risk-based controls.
7. Validate Certification Against Independent Sources
Action: Compare the Certification Regarding Beneficial Owners (Appendix A to 31 CFR § 1010.230) against independent documentation.
Requirement: The certification is required but not sufficient for verification.
What good looks like: Test the certification against formation documents, shareholder agreements, and public filings. Discrepancies trigger immediate follow-up. Don't accept the certification as conclusive evidence without corroborating documentation.
8. Include Beneficial Ownership in SAR Backup
Action: Attach beneficial ownership documentation to every SAR involving a legal entity customer.
Requirement: FinCEN guidance specifies that beneficial ownership data belongs in SAR backup documentation.
What good looks like: Your Suspicious Activity Report procedures include attaching the beneficial ownership certification, supporting documents, and any enhanced due diligence findings. Law enforcement reviewing your SARs can immediately identify who controls the entity without requesting additional information.
Common Mistakes
- Accepting formation mill addresses without question. If your customer lists a registered agent that appears on hundreds of entities with no operational connection, it's a red flag.
- Treating the certification as verification. The Certification Regarding Beneficial Owners is a starting point. You must verify the information through independent sources.
- Ignoring entities with no online presence. Legitimate businesses maintain some digital footprint. A complete absence suggests the entity exists only on paper.
- Failing to escalate unexplained revenue. When a customer reports substantial income but can't articulate their customer base or business model, investigate further.
- Separating beneficial ownership from SAR processes. If you're filing a SAR on an entity customer and beneficial ownership information isn't in the backup documentation, you're creating gaps for law enforcement and regulatory examiners.
Next Steps
Review your last 20 legal entity account openings against this checklist. Identify gaps in documentation or verification. For existing customers, incorporate these checks into your next periodic review cycle.
If you find shell company indicators in your portfolio, act immediately. The ongoing monitoring requirement means you address risks as they arise, not just during scheduled reviews.
Document your process. When examiners review your CDD program, they'll look for evidence that you're not just collecting beneficial ownership certifications but actually verifying and using that information to manage risk.
