Cash business CDD requirements do not automatically apply to every company that handles large amounts of cash. FinCEN's Customer Due Diligence framework directly applies to specified covered financial institutions, including banks, broker-dealers, mutual funds, futures commission merchants, and introducing brokers in commodities. FinCEN's CDD Final Rule sets out four core requirements for those institutions.
A restaurant, convenience store, dealership, car wash, retailer, or similar cash-intensive business is therefore usually the customer being subjected to CDD by its financial institution, rather than a business that must implement FinCEN's four-part CDD Rule itself simply because it accepts cash.
This distinction matters because some cash-heavy businesses are also separately regulated under the Bank Secrecy Act. Money services businesses have obligations under 31 CFR Part 1022, while casinos and card clubs operate under Part 1021. An ordinary trade or business can also have separate cash-reporting obligations, such as Form 8300, without becoming subject to the financial-institution CDD Rule.
Banks still need to assess cash-intensive customers on a risk-sensitive basis. FFIEC guidance notes that the nature and volume of currency activity can make unusual transactions harder to distinguish from legitimate business revenue, so banks should understand expected transaction volumes, business operations, geographic activity, and account use.
For teams that need broader practical training in transaction monitoring, suspicious-activity escalation, fraud risk, and AML controls, the Anti-Money Laundering (AML) and Fraud Prevention course provides a structured foundation without replacing an institution's own legal or compliance procedures.
FinCEN identifies four core customer due diligence requirements for covered financial institutions:
For a cash-intensive commercial account, that expected profile may include the purpose of the account, normal cash-deposit volume, frequency of deposits, geographic operating area, products and services used, and the nature of the customer's business.
Those expectations create a baseline. A deviation from that baseline does not automatically prove money laundering, but it can provide a reason for further review.
A Customer Identification Program, or CIP, provides the identity-verification foundation for CDD.
For banks, 31 CFR § 1020.220 requires a written, risk-based CIP. At minimum, a bank generally obtains a customer's name, date of birth for an individual, address, and identification number and uses documentary, non-documentary, or combined verification methods.
The FFIEC Customer Identification Program guidance also requires procedures for situations in which the bank cannot form a reasonable belief that it knows the customer's true identity.
For a cash-intensive business customer, identity verification may involve both the legal entity and the individuals acting on its behalf. The bank's procedures should reflect the risks presented by the account rather than relying on an assumption that every cash-heavy customer requires identical treatment.
For banks, identifying information obtained for CIP purposes is generally retained for five years after the account closes. Descriptions of documents relied upon, non-documentary verification methods, verification results, and resolutions of substantive discrepancies generally must be kept five years after the record is made.
The CIP rule does not generally require a bank to keep a photocopy of every identification document used for verification.
Beneficial ownership is one of the most important areas to update in a 2026 CDD program because two separate federal frameworks are frequently confused: the CDD beneficial-ownership requirement for financial institutions and the Corporate Transparency Act's BOI reporting system.
They are not the same obligation.
Under the CDD Rule, covered financial institutions generally identify and verify applicable beneficial owners of legal entity customers. The ownership prong generally reaches each individual who directly or indirectly owns 25% or more of the entity, while the control prong identifies one individual with significant responsibility for controlling, managing, or directing the entity.
The same person can satisfy both prongs in an appropriate case.
FinCEN issued major CDD account-opening exceptive relief in 2026.
A covered institution choosing to use that relief no longer has to identify and verify the same legal entity customer's beneficial owners every time that customer opens an additional account.
Instead, identification and verification may generally be limited to:
Use of the relief is discretionary. An institution can continue its existing account-opening process if it chooses.
The CTA changed even more dramatically.
FinCEN's current Beneficial Ownership Information reporting rule permanently exempts U.S.-created companies and U.S. persons from federal BOI reporting requirements.
As of August 2026, federal BOI reporting generally applies only to certain foreign entities registered to do business in the United States, and those reporting companies do not report U.S. persons as beneficial owners or company applicants.
A domestic LLC, therefore, should not rely on older guidance stating that it still has to file or update a CTA BOI report with FinCEN.
That CTA exemption does not eliminate a covered financial institution's separate CDD obligations when the institution establishes or maintains a legal entity customer relationship.
No. Cash-intensive customers do not automatically require the same enhanced due diligence simply because they handle substantial physical currency.
Cash activity can create additional money-laundering risk, but federal regulators have emphasized that no customer category has one uniform risk profile. Banks should evaluate the specific facts and circumstances of the relationship. The interagency risk-based CDD statement specifically warns against treating entire customer categories as automatically presenting the same level of risk.
FFIEC's cash-intensive business guidance identifies factors banks can consider when evaluating these customers, including:
Where a customer presents a higher risk profile, additional due diligence may be appropriate. That can include source-of-funds information, financial statements, information about suppliers or major customers, business locations, expected transaction volumes, ownership information, or closer review of transactional activity.
That additional review is commonly described as enhanced due diligence, or EDD.
However, there is no universal federal rule saying that every restaurant, car wash, dealership, pawn shop, cannabis business, MSB, or other cash-heavy customer must automatically receive identical EDD or senior-management approval.
No universal federal CDD rule says that every customer must be refreshed once a year, nor does FinCEN require institutions to adopt a system marketed as “perpetual KYC.”
The regulatory requirement is ongoing monitoring and risk-based updating.
A bank should maintain customer information when facts emerge that are relevant to assessing or reassessing the customer's risk. This makes trigger-based reviews useful for cash-intensive accounts because meaningful changes can occur between scheduled review dates.
Potential review triggers can include:
Institutions can use technology and automated monitoring to identify these changes, but FinCEN does not establish a universal percentage increase—such as 20%, 30%, or 50%—that automatically creates a CDD refresh requirement.
Thresholds should instead reflect the institution's products, customer base, risks, monitoring design, and documented procedures.
CDD helps a covered institution understand a customer's expected activity. CTR, Form 8300, and SAR requirements address different reporting events.
They should not be treated as interchangeable.
For a detailed comparison of the two cash-reporting systems, the US Compliance Institute guide to Form 8300 vs. CTR explains the filer, transaction, aggregation, and reporting differences.
A covered financial institution generally evaluates whether currency transactions exceed $10,000 during one business day. Multiple currency transactions may need to be aggregated when the institution knows they were conducted by or on behalf of the same person.
A person engaged in a trade or business generally must file Form 8300 when it receives more than $10,000 in qualifying cash in one transaction or related transactions.
The IRS Form 8300 Reference Guide explains that the report is generally due within 15 days after the business receives the payment that causes the reportable amount to exceed $10,000. Related payments can also require aggregation under the applicable rules.
SAR rules are different because the applicable dollar threshold varies by institution type.
For example, the bank SAR provision commonly discussed in this context uses a $5,000 threshold for qualifying suspicious transactions, while certain MSB transactions can trigger mandatory SAR reporting at $2,000.
A transaction is also not suspicious merely because it falls close to $10,000.
FinCEN's 2025 SAR clarification on potential structuring activity states that activity at or near the CTR threshold, standing alone, is not sufficient to require an SAR. The financial institution must know, suspect, or have reason to suspect that the transactions were designed to evade reporting requirements or otherwise meet the applicable SAR standard.
For practical examples of behaviors that can warrant closer review, USCI's guide to cash business red flags covers structuring indicators, unusual deposit behavior, documentation problems, and other cash-account patterns.
Training is an important component of an institution's broader BSA/AML compliance program.
For a bank serving cash-intensive customers, relevant personnel should understand not only the institution's policy but also what they are expected to do when the customer's activity changes.
Role-based CDD training can cover:
Training documentation should demonstrate that training required by the institution's program actually occurred. Institutions may also retain assessments, scenarios, completion records, or other evidence of effectiveness as part of their internal training controls.
Those assessment methods can strengthen documentation, but a scored quiz is not itself a universal FinCEN requirement for every CDD training session.
CDD becomes easier to understand once the regulatory category is separated from the fact that a business handles cash.
Restaurants, retailers, convenience stores, parking businesses, car washes, dealerships, and other merchants do not become subject to the four-element CDD Rule merely because cash represents a large share of their revenue.
Their banks may nevertheless perform more detailed risk-based CDD when the account's activity, business model, geography, ownership, or expected cash volume warrants it.
The business itself may also have Form 8300 obligations when it receives more than $10,000 in qualifying cash in a transaction or related transactions.
MSBs operate under separate BSA requirements in 31 CFR Part 1022.
Banks providing services to an MSB still perform risk-based CDD on that customer. The MSB itself may have registration, an AML program, transaction record-keeping, reporting, and agent-monitoring obligations depending on its activities.
For certain MSBs subject to mandatory SAR requirements, qualifying suspicious transactions of $2,000 or more may require reporting.
Casinos and card clubs operate under their own BSA rules in 31 CFR Part 1021 rather than the 2016 CDD Rule that applies to covered financial institutions.
Their obligations can include AML programs, currency transaction reporting, suspicious activity reporting, and specific transaction recordkeeping. Certain casino recordkeeping provisions use $3,000 thresholds, but that should not be described as a blanket rule requiring customer identification for every transaction above $3,000.
A practical cash-business CDD review for a covered financial institution can follow this sequence:
Several weaknesses can undermine an otherwise well-designed CDD program.
A small local restaurant and a large multi-location cash business may have very different transaction patterns and risk factors. Category labels should not replace a customer-specific assessment.
A profile based on expected activity is useful only while it continues to reflect the customer's business. Material changes should be investigated and incorporated into the risk assessment when appropriate.
The 2026 account-opening relief reduces repetitive collection, but it does not eliminate risk-based beneficial-ownership updates. New information that calls the existing data into question can still require review.
CDD and CIP are not simply document-collection exercises. Policies should explain how the institution forms a reasonable belief that it knows the customer's identity and how material discrepancies are resolved.
A $9,900 deposit is not automatically structuring, just as a $10,100 transaction is not automatically money laundering. Context, intent indicators, transaction patterns, and the applicable reporting rules matter.
Three developments are especially important.
First, FinCEN's February 2026 relief changed beneficial-ownership collection at subsequent account openings. Covered institutions using the relief do not have to re-identify and re-verify the same legal entity customer's beneficial owners every time another account is opened, subject to the conditions discussed above.
Second, FinCEN's August 2026 BOI final rule permanently removed CTA reporting requirements for U.S.-created companies and U.S. persons. Older articles telling domestic LLCs and corporations to file or update BOI reports are now outdated.
Third, FinCEN proposed broader AML/CFT program reforms in April 2026. As of September 2026, the agency continues to classify that action as a Notice of Proposed Rulemaking, not a final rule. Businesses should therefore distinguish the proposal from requirements already in effect.
News
News
News