The US KYC landscape just shifted. Here’s what banks need to understand

Three regulatory events between February and May 2026 have redrawn the compliance map.

This means less procedural duplication, higher substantive standards, and hard government deadlines. Together, they demand a fundamentally different approach to Know Your Customer (KYC) identity verification.

Three overlapping regulatory actions; a FinCEN exemptive order, a proposed rule on Anti-Money Laundering (AML) program reform, and a pair of executive orders, have created a coherent and demanding new framework for US KYC compliance. For compliance officers, and their technology partners, the arc is clear: the era of process-based, box-ticking KYC is ending.

Here’s a breakdown of what changed, what it demands of banks, and what it means for institutions evaluating their data infrastructure.

Three live deadlines compliance teams need on their radar

The May executive orders embedded concrete, non-negotiable mandates with specific timeframes. These are not guidance. Instead, they are enforceable deadlines.

What “verified” is coming to mean

The April Notice of Proposed Rulemaking (NPRM) represents the most significant reframing of what compliance actually means. Morrison Foerster described it as a shift from “largely technical compliance” to a “more effectiveness-based, risk-driven framework” that elevates enterprise risk assessment. Gibson Dunn notes FinCEN is introducing a two-pronged framework: has an AML/CFT program been established at all, and is it being properly maintained, with the standards for each prong being defined for the first time.

Regulators will no longer ask whether you had a policy. They will ask whether your program actually detected financial crime. That is a fundamentally different evidentiary burden.

Alongside this, the Corporate Transparency Act’s FinCEN BOI database means banks are now expected to cross-reference Ultimate Beneficial Owners (UBO) claims against official registries, and not simply accept client self-certification. This new relief aligns with FinCEN’s mandate to modernize the Customer Due Diligence (CDD) rule pursuant to the Corporate Transparency Act (CTA) while maintaining core AML obligations.

In practice, “verified” is migrating toward a definition that encompasses three things:

• confirmed against an authoritative issuing source
• ownership claims cross-referenced to official registries
• and a chain of evidence that is demonstrable and audit-ready

What this demands of banks – and their technology

These three regulatory events do not simply add new tasks to existing workflows. They reshape the underlying logic of what good KYC infrastructure must do.

The compliance review conversations that are now overdue

The specific areas of review have become more defined than they were six months ago.

Compliance teams should be asking:

• Does our first-touch onboarding meet the substantive standard the CDD rule changes will require?
• Do our AML typology libraries reflect the updated red flags the FinCEN advisory will introduce?
• Are our CIP policies already reviewing the document types likely to be flagged?
• Have we assessed the existing accounts opened on those documents?

On the technology side, the question is equally pointed:

• Can our KYC data infrastructure demonstrate its own effectiveness to an examiner?
• Not just that it collected documents, but that it produced reliable, traceable identity intelligence with a complete audit trail?

EC360 and the new regulatory standard

The executive order’s explicit requirement to identify nominal and beneficial owners against authoritative sources is precisely what EC360 automates. The effectiveness-based standard introduced by the April NPRM means the quality of the evidence chain, not just the existence of a process, is what regulators will examine.

EC360’s Corporate Digital Identity (CDI) profiles include full data provenance and original source documents. Additionally pKYC/continuous monitoring capability to detect ownership changes and trigger refresh. Furthermore, there is a complete audit trail demonstrating when and why re-verification was or was not triggered. This enables the institution to demonstrate effectiveness under examination.

If you would like to discuss how these changes interact with your current onboarding infrastructure, please get in touch with our team.