Beneficial Ownership Disclosure Rules for Cross-Border Payment Accounts

Beneficial ownership compliance is not a single rule to satisfy. If you run a foreign-formed business with cross-border payment accounts, all three layers apply at once, from different regulators, and none of them substitutes for another.

What the U.S. Corporate Transparency Act now requires after the August 2026 final rule

This is not what the U.S. entity transparency regime looked like when it began. Yellen, produced a string of enforcement suspensions and injunctions that ran through 2024 and into 2025, and the regime that survived that litigation is narrower than the one Congress wrote. FinCEN's final rule, effective August 14, 2026, permanently exempts every entity created in the United States from any BOI filing obligation, whether initial, updated, or corrected. That final rule goes further than the March 2025 interim final rule that preceded it: foreign reporting companies no longer need to identify U.S.-person company applicants, U.S. persons who already obtained FinCEN identifiers need not update that information, and foreign pooled investment vehicles registered in the U.S. need not report any U.S. person who exercises substantial control over them.

What remains is a targeted obligation. Only entities formed under foreign law still count as reporting companies if they have registered to do business in a U.S. state or tribal jurisdiction, and they must disclose their non-U.S.-person beneficial owners. If you run a foreign reporting company, don't assume you have to file, because several exemption categories still apply, so check them first. If your company registered before March 26, 2025, you had to file an initial BOI report by April 25, 2025 under the interim rule; for everything going forward, the IFR deadlines and the final rule's permanent exemptions now govern. FinCEN has also indicated it intends to modify the CDD Rule to address questions left open now that the BOI reporting changes are complete, without committing to a timeline or a direction, so financial institutions have reason to watch for further rulemaking.

How the CDD Rule Fills the Gap Left by the CTA Rollback

Domestic companies no longer file BOI reports with FinCEN at all, and that absence has pushed a different rule to the center of the system. The 2016 CDD Rule requires financial institutions to verify the beneficial owners of their legal entity customers at account opening, so it has become the primary source of domestic ownership information for the financial system and for law enforcement. FinCEN's final rule states explicitly that the CDD Rule remains in effect and is unaffected by the entity-transparency rollback. The obligation to verify ownership sits with the covered financial institution, not with the entity itself, and that distinction is the one most likely to get lost when people describe the CTA changes as the end of beneficial ownership compliance in the United States.

The CDD Rule requires covered financial institutions to identify and verify the beneficial owners of their legal entity customers at account opening, and this applies regardless of whether the customer is domestic or foreign, and regardless of what the CTA now exempts. On February 13, 2026, FinCEN granted exceptive relief from the requirement to re-identify and re-verify beneficial owners every time an existing customer opens a new account, so covered institutions can now limit what they must do when the same legal entity customer opens a subsequent account. That relief reduces friction for corporate clients juggling multiple accounts, but it leaves the initial account-opening verification obligation untouched, and institutions should update their onboarding procedures to reflect precisely what has changed and what has not.

The practical consequence for businesses is straightforward: a U.S.-formed company has no FinCEN filing obligation under the CTA, but its bank or payment service provider will still collect and verify beneficial ownership information when the account opens under the CDD Rule. With the federal BOI database being hollowed out for U.S. persons, financial institutions and counterparties cannot rely on FinCEN records to resolve ownership questions about U.S.-formed entities, which makes cross-source ownership verification more operationally important than it was when the registry held that information centrally.

New York's LLC Transparency Act as a state-level overlay for foreign LLCs operating in the U.S.

The federal rollback left foreign entities with more to track, because states can still run their own entity transparency regimes no matter what FinCEN requires. New York's LLC Transparency Act, modeled on the federal CTA, took effect January 1, 2026, and it shows how a sub-federal obligation can survive a federal retreat. Governor Kathy Hochul vetoed clarifying legislation on December 19, 2025, and that veto narrowed the law's effective scope to a single category of entity: LLCs formed outside the United States and authorized to do business in New York State. The law exempts LLCs incorporated in New York because they are U.S.-formed.

Non-U.S. LLCs authorized to do business in New York before January 1, 2026 face a December 31, 2026 deadline to file beneficial ownership information with the New York Department of State. Failure to file brings escalating penalties, up to and including suspension of the LLC's authority to conduct business in the state, so foreign LLCs with New York exposure need the December 31, 2026 date on their compliance calendar now.

The overlap with the federal regime is direct. New York is currently the only state to have enacted a beneficial ownership law modeled on the federal CTA, but the fact that one state has built this kind of regime signals that others could follow, and it means the federal rollback tells only part of the story for any foreign entity assessing its U.S.-facing compliance risk.

The EU's CESOP Regime and Payment-Chain Transparency Obligations

Where the United States pulled back on entity transparency, the EU moved in the opposite direction on payment-chain data. Since January 1, 2024, payment service providers operating within the EU have had to record and report cross-border payment data to their local tax authorities, who pass it along to CESOP, a central EU database built to detect and prevent VAT evasion.

Through 2025 and into 2026, CESOP shifted from initial implementation to full operation. The system is narrow by design: it collects data through a harmonized standard form and limits what it gathers to what identifies the seller, with no data captured on the buyer beyond an estimated Member State of origin, and seller data collected only once a seller receives a substantial volume of cross-border payments.

The obligation falls on payment service providers, meaning banks, card schemes, electronic money institutions, and similar entities processing qualifying EU cross-border payments, rather than on the businesses making or receiving the payments directly. Those businesses still have to cooperate, because they must supply accurate identifying information even though the PSP carries the filing duty itself. DAC8, formally Council Directive 2023/2226, entered into force in 2023, with Member States required to transpose it by December 31, 2025 and reporting obligations applying from January 1, 2026, extending this same transaction-reporting logic to crypto-assets and other digital assets, a category of cross-border payment that earlier transparency regimes largely left unaddressed.

FATF Recommendation 16 and the 2025 revision that extended Travel Rule obligations to peer-to-peer transfers and virtual assets

Beneath both the U.S. and EU regimes sits a global standard, and it shapes what domestic rules require even when no one cites it directly. FATF Recommendation 16 requires that providers of cross-border payment services include complete originator and beneficiary information in wire transfers, so that illicit money movement can be detected as it happens rather than reconstructed afterward from fragmentary records. FATF revised Recommendation 16 in 2025 to modernize payment transparency and laid out a compliance path running toward 2030, and the gap analysis that path calls for, covering payment-party data requirements, screening logic, exception handling, and audit records, needs to happen now, before the deadline arrives.

A FATF Recommendation updated in June 2025 requires originator and beneficiary data, meaning name, address, and date of birth, to accompany all peer-to-peer cross-border transfers above 1,000 EUR or its USD equivalent, whether a bank, a virtual asset service provider, or a token-transfer protocol processes the transfer. So businesses and VASPs now have to carry the same data across borders on digital rails that traditional wire transfers above the threshold have carried for years.

FATF recommendations are not self-executing law. Jurisdictions implement them through domestic legislation, and the EU's CESOP and CDD frameworks along with the U.S. CDD Rule all reflect FATF standards in their design. Recommendation 16 is a floor beneath both regimes already discussed, and if a jurisdiction fails to implement it convincingly, correspondent banking friction and reduced market access for entities operating there follow.

The Philippines' Revised Beneficial Ownership Rules and the Tightening Trend in Non-Western Jurisdictions

The tightening trend in beneficial ownership regulation is not a phenomenon confined to a handful of major Western regulators. The Philippines overhauled its beneficial ownership rules in early 2026, and the scope of that overhaul shows regulators outside the U.S. and EU moving in the same direction, sometimes with stricter thresholds and faster deadlines than their Western counterparts. SEC Memorandum Circular No. 15-25 took effect January 1, 2026, and it applies to all domestic and foreign corporations, partnerships, and other entities under the Philippines SEC's jurisdiction, including regional operating headquarters, branch offices, and every foreign entity licensed to do business in the country.

Two changes stand out for their practical bite. The ownership threshold for a natural person to qualify as a beneficial owner was lowered to 20%, pulling a wider pool of individuals into disclosure requirements than the prior rule reached. The deadline for reporting changes to beneficial ownership information was shortened to seven days, a materially tighter window than most global counterparts give reporting entities to update their records. Starting January 30, 2026, reporting entities must submit beneficial ownership data exclusively through HARBOR, a new web-based registry; the old General Information Sheet beneficial ownership declaration page was retired, replaced by a new 2026 GIS version issued under MC No. 9-2026.

SEC MC 15-25 defines beneficial owner as more than just direct ownership above a percentage threshold. The circular says outright that it aligns with international standards, so it positions the Philippine framework as convergent with FATF guidance, and if entities operating there don't comply, they face local regulatory risk alongside correspondent banking relationship risk. The circular gives specific treatment to cross-border ownership structures and tiered ownership chains, so businesses with layered holding structures must trace through each tier to identify the qualifying natural persons at every applicable category.

Where the Three Layers Intersect for a Foreign-Formed Entity

A foreign-formed entity running cross-border payment accounts faces the fullest version of this stack, because it can trigger obligations under all three layers across multiple jurisdictions at the same time, and each layer's obligations stand independent of the others. If it is authorized to do business in New York, it separately faces the December 31, 2026 deadline to file with the New York Department of State under the LLC Transparency Act, a distinct obligation owed to a different registrar. If it is licensed to do business in the Philippines, it must comply with SEC MC 15-25's 20% threshold, its seven-day change-reporting deadline, and its HARBOR submission requirement.

Layered on top of those entity-level filings sits the payment-chain data obligation. Cross-border transfers above the FATF threshold trigger data-carry obligations at the transaction level regardless of whether the entity or its PSP has filed anything with any registry. And every financial institution where the entity holds a payment account applies CDD obligations at opening and on an ongoing basis, whether under the U.S. CDD Rule, EU AML directives, or an equivalent local standard, entirely independent of what the entity has filed anywhere else.

The UK limited company registered in Delaware and authorized to do business in New York illustrates how these obligations stack. Filing a BOI report with FinCEN does not satisfy a bank's CDD obligation. None of these obligations substitutes for a jurisdiction's own entity filing requirement, and an entity that assumes compliance in one layer covers another is likely to discover the gap at the worst possible moment, typically when a bank or regulator asks a question the entity assumed it had already answered. Clear, well-organized documentation of an entity's compliance posture across all three layers can keep it from getting caught up in that kind of indiscriminate account closure.

What businesses with cross-border payment accounts should audit and maintain to stay compliant across all three layers

The three layers impose distinct obligations on different actors at different moments, so staying compliant calls for a structured audit across entity registrations, payment-chain procedures, and financial institution relationships, not a single point-in-time filing.

If you're a foreign entity registered in the U.S., check whether the August 2026 final rule's reporting obligation applies to you, see if any exemption category is available, then verify that your non-U.S.-person beneficial owners are correctly on file with FinCEN. If you're licensed in the Philippines, confirm HARBOR registration, check that every beneficial owner who meets the 20% threshold or falls under any of the eight control categories has been disclosed, and build a process that can meet the seven-day change-reporting deadline. Compliance teams should also watch for FinCEN's flagged modification to the CDD Rule, a future rulemaking priority following the CTA changes that has no committed timeline yet.

On the payment-chain side, entities should map which of their payment service providers are EU-based and therefore subject to CESOP, and make sure they can supply and maintain the seller-identifying information those PSPs are required to report. The 2030 compliance path the 2025 FATF revision set out calls for gap analysis of payment-party data, screening logic, exception handling, and audit records now, not in the months before the deadline arrives.

On the account-level CDD side, you should keep a current beneficial ownership package, with identifying documentation for every natural person who qualifies as a beneficial owner under the applicable definition, ready to present at account opening or on request. FinCEN's February 2026 exceptive relief lets financial institutions limit re-verification at subsequent account openings for existing customers, but the initial account-opening verification requirement has not changed, and entities should not assume the relief extends further than it does. Clear documentation of beneficial ownership structures, especially for tiered or cross-border ownership chains, matters to financial institution counterparties, and it lowers the risk that your accounts get swept up in indiscriminate de-risking decisions.

None of this is settled ground. The U.S. CDD Rule modification FinCEN has flagged, FATF's 2030 compliance pathway, DAC8's digital-asset implementation cycle, and the chance that state-level transparency laws spread beyond New York are all near-term changes, so a compliance program built today needs to keep tracking them tomorrow.