TL;DR: A KYB API pointed at a U.S. secretary of state confirms a formation filing. The final rule effective August 14, 2026, revising 31 CFR 1010.380, permanently removed the requirement for U.S. companies and U.S. persons to report beneficial ownership to FinCEN, and FinCEN will delete previously reported U.S. person information. Covered institutions still identify and verify any individual who owns 25 percent or more and one individual who controls the entity, because that duty sits in the CDD rule, not in the reporting rule that changed.
A registry hit proves a filing, not an owner
A secretary of state API answers a narrow question: did this jurisdiction accept a public filing that created or maintained a legal entity, and what status does that filing carry. The FFIEC BSA/AML Examination Manual describes a legal entity customer as one created by filing a public document with a Secretary of State or similar office, the category covered by 31 CFR 1010.230. A successful call is evidence that this filing event happened. The call is not evidence of who owns the company.
The payload worth testing is the public record of that filing. Useful fields are the ones the filing itself creates: the legal name as filed, a file or entity number, the jurisdiction, a formation or registration date, a status such as active, dissolved, or revoked, and a registered agent. A good-standing indicator, when that office publishes one, is a separate status flag about fees and periodic filings. None of those fields calculates equity, and none of them names the individual who controls the entity.
Legal existence means the registry shows a filing that brought the entity into being and has not marked that filing dissolved, cancelled, or revoked. Check the call against the legal name and the file number, not against the brand on the application. A KYB review that stops at "the name came back" has confirmed a string, not an entity and not an owner.
Registered agent is the field that gets copied into the wrong place. The agent is the person or company designated to receive service of process. That role can belong to a commercial agent service with no ownership stake and no authority over the customer's accounts. Writing the agent into an owner field, or into the control-person field, puts a false identity in the onboarding file. The registry reported the filing. The mapping invented a person the filing did not certify.
The federal ownership file is gone for U.S. companies
A second API call cannot fetch the owners of a U.S. company from a federal file. On August 11, 2026, FinCEN announced that a final rule permanently removes the requirement for U.S. companies and U.S. persons to report beneficial ownership to FinCEN under the CTA. FinCEN will delete previously reported U.S. person information. An integration built to pull that file has nothing authoritative left to pull, and a copy retrieved before the change is not a live federal record.
The rule took effect on August 14, 2026. The Federal Register publication revises 31 CFR 1010.380. The revision addresses the reporting duty. The CDD duty sits in a separate rule and did not move with this one.
Foreign entities that are reporting companies still report beneficial ownership information for foreign individuals. A workflow that treats every customer as "no federal file" misses that remaining duty. A workflow that treats every customer as "pull the federal file" fails on domestic companies. Formation jurisdiction, checked against the registry, is what tells the reviewer which side the customer is on. The registry call itself does not make that branch.
The international standard did not move with the U.S. reporting change. In March 2022, FATF revised Recommendation 24 to call for adequate, accurate, and up-to-date information on the true owners of companies. FATF guidance on that recommendation is dated March 10, 2023. Onboarding a domestic company cannot meet that standard by querying a federal ownership file FinCEN will no longer keep for U.S. persons. The information comes from the customer and from the documents the procedures name. A registry hit supports legal existence. The hit is not the ownership record Recommendation 24 describes.
The bank's CDD duty stayed put
The reporting rollback and the institution's identification duty are different rules, and only one of them changed. FinCEN's CDD rule still requires covered institutions to identify and verify any individual who owns 25 percent or more of a legal entity customer and one individual who controls the entity. A release note that says beneficial ownership reporting ended, so ownership collection can be switched off, is describing the wrong rule.
The 25 percent figure is a threshold the institution applies to information it collects. The secretary of state does not certify it. Where a formation document names an organizer, an incorporator, or an initial manager, that name is a lead. The name is not a determination that the person owns 25 percent or more, and the name is not a determination that no one else does. Percentage ownership can sit in a private operating agreement, a cap table, or a parent the state filing never lists. Identifying beneficial owners still means asking the customer, checking the answer against documents the procedures accept, and recording who was verified and on what evidence.
The control person is a separate seat from the 25 percent owners. The CDD rule asks for one individual who controls the entity. That person can have no ownership stake, and a 25 percent owner can have no role in directing the entity. Copying one list into both fields fails the rule even when every name is real. The ownership prong covers each individual at or above 25 percent, which can be no one. The control prong still asks for one individual. A pass on the entity has not verified either person. The file should show the registry status, the names collected from the customer, and the evidence on each person as separate conclusions.
What to test in a KYB API
Test the API against the questions it can answer, and write down the questions it cannot. An integration test that checks only for a successful status code and a non-empty body will pass on a payload that proves nothing about the customer. The pack should include a known active filing, a dissolved or revoked filing, a name that has never been filed in that jurisdiction, and a legal name that collides with a different entity in another state. Each case needs an expected result at the field level, not a single pass flag.
Treat the 25 percent row and the control-person row as negative tests. For a U.S. company, do not parse the response as a federal beneficial ownership file. If an empty ownership array is mapped to "no beneficial owners," the build invented a conclusion the registry did not state. Empty means the source did not answer. When the only individual in the payload is the registered agent, leave the control person blank and route the application to collection. The positive test for both fields sits on the customer form and on the documents used to verify those people.
Two quieter checks belong in the same pack. Jurisdiction first: a file number queried against the wrong state, or a name match returned from a state the customer did not form in, is not legal existence for the application in front of the reviewer. Freshness second: status and good standing change when the office updates its file. Store the retrieval timestamp beside the payload so a later reviewer can see which version of the registry the decision used. An API-first compliance setup still needs that timestamp. The call does not explain itself months later.
Map the response field by field. Legal name, file number, jurisdiction, status, good standing, and retrieval time land on the entity record. Owner names, percentages, and the control person land on the customer-supplied record, with the evidence used to verify each person. Mixing those columns stores a filing as an owner. The same failure shows up in AML and KYC integration with core banking systems: a successful payload and a wrong field map produce a file that looks complete and does not support the decision.
Where Sphinx fits
Sphinx does not sell a registry API. Agents collect the registry record, the customer-supplied ownership, and the control person inside the onboarding system the team already uses, and write the decision down. No integration project required.
Frequently Asked Questions
Does a secretary of state API return beneficial owners?
A secretary of state API returns the public formation record: that a filing exists, plus registry fields such as status and registered agent. That record is not a federal beneficial ownership file. For a U.S. company, FinCEN no longer collects that ownership report, and the registry result does not identify who owns 25 percent or more.
If FinCEN no longer collects U.S. company BOI, do banks still identify 25 percent owners?
Yes. The final rule effective August 14, 2026, revising 31 CFR 1010.380, removed the reporting duty for U.S. companies and U.S. persons. The CDD rule still requires covered institutions to identify and verify any individual who owns 25 percent or more of a legal entity customer and one individual who controls the entity.
What is the difference between good standing and ownership?
Good standing is the registry's statement that the entity has met the state's filing and fee conditions. Ownership is the separate question of which individuals own 25 percent or more and which individual controls the entity. A good-standing flag can be true while both ownership questions remain unanswered.
Which companies still have to file beneficial ownership with FinCEN?
Foreign entities that are reporting companies still report beneficial ownership information for foreign individuals. U.S. companies and U.S. persons no longer report beneficial ownership to FinCEN under the final rule announced on August 11, 2026. FinCEN will delete previously reported U.S. person information.
.png)
