US financial crime data operations guide

Which source applies to which job?

FinCEN’s CDD Rule applies to covered US financial institutions. It is not a universal customer-checking rule for every business.

Assess 31 CFR 1010.230, applicable program rules and current relief. Spreadsheet validation cannot determine that scope.

OFAC technical guidance describes list formats. The compliance framework concerns program design. Neither makes normalized data a screening result.

Applicable sanctions laws, programs, ownership and transaction facts require a separate review beyond source preparation.

Worked example. Two inputs, separate decisions

Fictional example. A review team receives a remediation workbook and a new official OFAC file. Assign separate references and preserve both originals.

The KYC check finds a missing control-person field and an invalid review date. These become evidence tasks, not automatic account-closure decisions.

The normalizer preserves source identifiers and changes against a comparable earlier input. It does not compare customers against the list.

A reviewer resolves workbook issues and hands the official data to the separate screening process. Record those later decisions separately.

FinCEN’s February 13, 2026 order provides relief from repeated beneficial-owner checks at every new account. Review current relief before assigning remediation.

Keep source provenance

Record the official source, retrieval time, file name, format, hash and parser version. Do not combine unsupported formats silently.

Separate data quality from customer decisions

A remediation validator can identify missing, inconsistent or stale fields. It cannot decide customer risk, suspicious activity or sanctions status.

Make every correction traceable

Keep the original value, proposed correction, evidence, reviewer, decision and completion time. Preserve rejected corrections as part of the audit record.

Working checklist and fictional samples

Use this checklist as an operating aid, not an exhaustive legal assessment. Inspect the samples before entering your own facts.

• Keep original filenames, source locations, retrieval times and digests.
• Record jurisdiction, selected rule or schema and tool version.
• Preserve accepted and rejected records, warnings and unsupported inputs.
• Link proposed corrections to evidence and reviewer decisions.
• Handover explicitly to customer-risk or sanctions-screening staff.

• Fictional US KYC validation PDF. Inspect a data-quality report, not a customer-risk or acceptance decision.
• Fictional US sanctions change report PDF. Inspect provenance and changes. The sample is not a current sanctions list.