The passage of the Coronavirus Aid, Relief and Economic Security Act (“CARES Act”) and the creation of the Paycheck Protection Program (“PPP”) have generated both interest and confusion as financial institutions consider how to disburse loans available under the PPP while complying with their Bank Secrecy Act (“BSA”) obligations. Recent guidance from the U.S. Small Business Administration, in consultation with the United States Department of the Treasury, the Financial Crimes Enforcement Network and the Office of the Comptroller of the Currency clarifies that although BSA requirements still apply to PPP loans, financial institutions do not need to collect or re-verify beneficial ownership information from existing customers, unless indicated by the financial institution’s risk-based approach to BSA compliance. For new customers, financial institutions are instructed to collect certain information from holders of a 20% or greater ownership interest in prospective customer and verify that information pursuant to the institution’s risk-based approach to BSA compliance.