Why the ownership registry never replaced the bank’s own file

The week

In the last days of 2020, Congress overrode a presidential veto of the National Defense Authorization Act for Fiscal Year 2021. The House voted on December 28 and the Senate on January 1, 2021, and the act became law.

Folded into the defense bill was the Anti-Money Laundering Act of 2020, the largest update to the Bank Secrecy Act framework in decades. Its best-known part, the Corporate Transparency Act, required many small companies to report their beneficial owners to FinCEN. FinCEN would keep a non-public database that law enforcement could use, and that financial institutions could access with the customer’s consent. The act also directed FinCEN to set national AML priorities, expanded the AML whistleblower program, and extended Bank Secrecy Act duties to dealers in antiquities.

For bank compliance teams, the end of 2020 brought a law that seemed to promise relief. Collecting and verifying the beneficial owners of business customers had been required since the 2016 customer due diligence rule, and it was laborious. A federal registry looked like a single authoritative source for that information. Earlier in this series we covered the act’s other main thread, the push to judge AML programs by their usefulness. Here we follow the ownership thread. It has three parts: the registry as an external data source, the due diligence duty that stayed with the bank, and the whistleblower channel that changed who can report a weak program.

The registry: an external source that kept changing shape

The Corporate Transparency Act required FinCEN to build the database and write three rules. One covered reporting, one covered access, and one would revise the customer due diligence rule to fit the new regime. The reporting rule was finalized in 2022, and reporting began on January 1, 2024.

Then the ground moved repeatedly. A federal court in Alabama held the act unconstitutional as applied to the plaintiffs in March 2024. A Texas court issued a nationwide injunction in December 2024, which was stayed, reinstated and stayed again over the following weeks. In March 2025 Treasury said it would not enforce the requirement against U.S. companies and their owners. FinCEN then issued an interim final rule limiting reporting to certain foreign companies registered to do business in the United States.

Access would never have been free, either. The access rule, finalized at the end of 2023, let banks query the database only with the customer’s consent, for customer due diligence purposes, and under security and training requirements of their own. Using the registry would have meant new consent capture, access controls and audit records before a single lookup.

For banks, the registry never became the dependable source many had planned around. Banks that designed onboarding flows on the expectation of registry access carried the act’s legal risk into their own systems. A data source created by a contested statute can be narrowed, delayed or switched off by a court, and the bank’s obligations do not pause while that happens.

Banks that coped best had treated the registry as a possible extra input, never as a replacement for their own collection. Their systems stored each ownership attribute with its source and verification date. Adding, reweighting or removing a source was then a configuration change and a documented decision.

The duty that stayed with the bank

The registry’s retreat left the 2016 rule in place. Covered financial institutions still had to identify and verify the beneficial owners of legal entity customers. The planned revision to align the two regimes was never completed in the form the act envisaged.

That made the bank’s own ownership file the system of record. Its quality depends on a few unglamorous controls.

• Collection at onboarding. Ownership and control information is captured in a structured form that downstream screening can use, rather than as a scanned certification.
• Verification evidence. Each owner’s identity is verified and the evidence is linked to the record, with the method used.
• Refresh triggers. Information is reviewed when facts suggest it may be wrong, such as a change in signers, unusual activity or an adverse media hit, and on the schedule set by the customer’s risk rating.
• Linkage. Owners who appear across several business customers are recognized as the same person. That linkage is what lets an investigator see a network instead of a set of unrelated accounts.

Each control involves a trade-off. Structured collection adds friction to business account opening, which relationship managers feel first. Refresh triggers create review work that has to be staffed. Entity resolution across customers needs data engineering that competes with other projects. The case for funding them is that they work whatever happens to an external registry.

The whistleblower channel

The act expanded the AML whistleblower program, with awards tied to sanctions collected, and protections against retaliation. Congress strengthened it again at the end of 2022, extending it to sanctions violations and creating a dedicated fund for awards. The act also gave Treasury and the Justice Department broader subpoena power over records held by foreign banks with U.S. correspondent accounts.

For compliance officers, the whistleblower provisions mattered more than the registry. They changed the internal economics of known weaknesses. An employee who sees monitoring alerts closed without review, or ownership files left stale on high-risk customers, now has a financial reason to report externally. Problems that once stayed inside the institution can reach regulators without passing through management.

The practical response is an internal reporting channel that staff trust more than the external one. That means a route outside the business line, a documented response to every report within a set time, and visible fixes. Program weaknesses already known internally belong on a dated remediation plan, because an undocumented known issue looks worst when someone else reports it.

With hindsight

The Anti-Money Laundering Act of 2020 remains the framework banks work within, but its headline feature is much smaller than it looked on January 1, 2021. Domestic companies were exempted from beneficial ownership reporting in 2025, after years of litigation and of filing work by businesses that had already complied.

The bank’s own file stayed central. In February 2026 FinCEN granted relief from re-identifying beneficial owners each time an existing legal entity customer opens a new account. Banks now verify at the first account and when facts call the information into question. In April 2026 FinCEN proposed a new AML program rule, replacing its 2024 proposal, which had not been finalized by this writing. Through all of it, banks that stored ownership data with its source and verification date adjusted by configuration. Banks that had built around a single expected source had to rework their onboarding.