The AML KYC client onboarding process is how a bank, credit union, or brokerage confirms who you are before it lets you open an account, and it runs in four stages: collecting your identity information, screening you against government watchlists, assigning you a risk rating, and setting a baseline for monitoring the account after it goes live. The framework comes from the Bank Secrecy Act and the USA PATRIOT Act, and it applies whether you are opening a personal checking account or a corporate treasury relationship.
What the Bank Must Collect From You
Federal regulation sets a minimum data set that every institution has to gather before opening an account for you. For an individual, that means your full legal name, date of birth, a residential or business street address, and a taxpayer identification number. If you are not a U.S. person, the identification number can be a passport number, alien identification card number, or the number from an equivalent government-issued document. For a legal entity, the address becomes the principal place of business.1eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
That is the federal floor. The underlying statute directs Treasury to set these minimum standards and requires institutions to keep records of the information used and check your name against government-provided lists of known or suspected terrorists before the account is active.2Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority
You will notice the regulation does not require a utility bill or proof of residency. Many banks ask for one as part of their own internal verification, and that request is common, but it is institutional policy rather than a federal mandate. Your government-issued photo ID handles the identity verification piece alongside the required data points.
The bank has flexibility in how it verifies what you provide. It can examine the documents you present, or it can use non-documentary methods like checking your details against consumer reporting agencies or public databases. That flexibility is why one bank might accept a photo of your license uploaded through an app while another wants you in a branch with the original.
Extra Requirements for Business Accounts
Opening an account for a legal entity adds a layer that personal accounts do not have. Under the Customer Due Diligence rule, the institution must identify two categories of people behind the entity: every individual who directly or indirectly owns 25 percent or more of the equity, and one individual who has significant responsibility for managing or directing the entity, such as a CEO, CFO, managing member, or general partner.3eCFR. 31 CFR 1010.230 – Beneficial Ownership Requirements for Legal Entity Customers
Up to four individuals may need to be listed under the ownership prong, and exactly one under the control prong, regardless of how many people sit in senior management. If no single person meets the 25 percent threshold, the institution still needs at least one control-prong individual. The bank typically hands you a certification form where you list the name, address, date of birth, and identification number for each qualifying person. Expect to submit formation documents as well: articles of incorporation, partnership agreements, or operating agreements. Refusing to disclose this information or providing incomplete details can result in immediate rejection of the application.
Indirect and Layered Ownership
When equity is held through parent companies or intermediate entities, the institution traces ownership through each layer to determine whether any individual ultimately clears 25 percent. Someone who owns 50 percent of a holding company that in turn owns 60 percent of the applicant entity is calculated at 30 percent of the applicant (50% × 60%), which exceeds the threshold. If your business has more than one tier of ownership, be ready to provide organizational charts or ownership diagrams.
A Note on FinCEN’s BOI Filing
The Corporate Transparency Act originally required most U.S. companies to file beneficial ownership information reports directly with FinCEN. That obligation was narrowed in March 2025. Under an interim final rule, all entities created in the United States and their beneficial owners are now exempt from filing. Only entities formed under foreign law that have registered to do business in a U.S. state or tribal jurisdiction must file, and U.S. persons who are beneficial owners of those foreign entities are also exempt from reporting.4FinCEN. Beneficial Ownership Information Reporting This change does not affect what the bank asks of you at onboarding. The CDD rule’s ownership collection at account opening still applies.
Watchlist and Sanctions Screening
Once your information is in, the institution runs it against several government-maintained watchlists. The most prominent is the Specially Designated Nationals and Blocked Persons list maintained by the Office of Foreign Assets Control. A match on that list means you are prohibited from transacting within the U.S. financial system, and the institution must block the account and report it.5U.S. Department of the Treasury. Sanctions List Search Tool OFAC’s search tool uses fuzzy-matching logic, so near-matches on names also get flagged for manual review.
Institutions also screen for politically exposed persons, meaning individuals who hold or have recently held prominent government positions, along with their close family and associates. Being flagged as a PEP does not bar you from opening an account. It does trigger additional scrutiny because the corruption and bribery risk is statistically higher for people in those roles. PEP screening is a widely adopted best practice driven by regulatory expectations, so its application varies somewhat from institution to institution.
Many institutions also run adverse media checks by searching news databases, court records, and regulatory notices for negative information about you or your business. These catch risks that do not appear on any official list, such as pending fraud charges or recent regulatory sanctions.
How the Bank Rates Your Risk
Everything gathered so far feeds into a risk assessment. Most institutions classify new customers as low, medium, or high risk based on a handful of factors:
- Geography. Living in or doing business with countries that have high corruption levels, weak regulatory oversight, or active sanctions programs raises your score.
- Business type. Cash-intensive industries like restaurants, convenience stores, and money services businesses draw more scrutiny than a software company would.
- Transaction profile. Expected volume, frequency of international wire transfers, and whether anticipated activity fits the stated purpose of the account.
- Customer type. PEP status, complex ownership structures, and accounts held by trusts or non-profit organizations can all push the rating higher.
The rating controls how much monitoring your account receives. A low-risk individual with a payroll deposit account gets periodic automated reviews. A high-risk entity with international wire activity gets significantly more attention, more frequent file reviews, and a lower threshold for a closer look at individual transactions.6FFIEC BSA/AML InfoBase. Customer Due Diligence
Enhanced Due Diligence for Higher-Risk Customers
If the assessment places you in the high-risk category, the institution shifts into enhanced due diligence. It is not a separate application, but the bank will ask for more and review it more carefully. Typical additional inquiries include your source of funds and source of wealth, financial statements for business customers, a detailed description of your business (primary trade area, whether transactions are domestic or international, currency transaction volume, and information about major customers and suppliers), and details about where the business is organized and operates. The institution also commits to reviewing the account more frequently throughout the relationship, and unusual transaction patterns get flagged faster than they would for a low-risk customer.6FFIEC BSA/AML InfoBase. Customer Due Diligence
Submission, Timelines, and Activation
Once your forms and documents are ready, you submit the package through whatever channel the institution supports. Most banks now offer secure digital portals for uploading scans or photos. Some still require an in-person visit for original document inspection, particularly for business accounts or when the institution cannot verify your identity through non-documentary methods.
Timelines vary widely. A straightforward personal account with clean watchlist results might be approved the same day. A business account with multiple beneficial owners, international ties, or a watchlist near-match that requires manual review can take a week or more. During this window, the compliance team cross-references your submitted information against independent databases and may come back for clarification or clearer document copies. When everything checks out, you get notice that the account is active and ready for funding.
What Happens After the Account Opens
Onboarding is not the finish line. Federal regulations require ongoing monitoring for the life of the account, and this catches many people off guard. The institution has to watch for transactions that do not fit your established risk profile and report anything suspicious.
Currency Transaction Reports
Any cash transaction over $10,000 triggers an automatic currency transaction report filed with FinCEN.7eCFR. 31 CFR 1010.311 – Filing Obligations It is a routine filing and does not mean you are under investigation. You cannot ask the bank to skip it or split the transaction into smaller amounts to avoid the report. Doing so is a federal crime called structuring, covered below.
Suspicious Activity Reports
When a bank detects facts suggesting possible money laundering, fraud, or other criminal activity, it must file a suspicious activity report with FinCEN within 30 calendar days of initial detection. If no suspect has been identified, the bank can take an additional 30 days to investigate, but reporting cannot be delayed beyond 60 days total. Situations involving ongoing criminal schemes require the bank to notify law enforcement by phone in addition to filing.8Federal Reserve. Section 1020.320 – Reports by Banks of Suspicious Transactions Banks are prohibited from telling you that a SAR has been filed. If your account is flagged and the institution decides the risk is too high, you may simply receive a closure notice with little explanation.
Updating Your Customer File
The institution is expected to keep your customer information current on an ongoing, risk-based schedule. If you change your address, business structure, or ownership, the bank may reach out to refresh your file. For business accounts, ownership changes above the 25 percent threshold should be communicated promptly, because outdated ownership records can trigger compliance concerns during routine reviews.
What Can Go Wrong on Your Side
Two customer-side pitfalls carry serious criminal exposure and are worth understanding before you sign anything.
Structuring is breaking up transactions to dodge the $10,000 currency transaction reporting threshold. It is a separate federal crime, and it does not matter whether the underlying money is clean. The act itself is illegal, and it covers deposits, withdrawals, and international monetary instrument transactions.9Office of the Law Revision Counsel. 31 USC 5324 – Structuring Transactions to Evade Reporting Requirement Prohibited Consistent ATM deposits sized to stay just under $10,000, depositing into multiple accounts in amounts just below the threshold and then consolidating, and asking bank employees to skip a required report are all classic patterns compliance teams are trained to spot.10FFIEC BSA/AML InfoBase. Appendix F – Money Laundering and Terrorist Financing Red Flags
False statements on your application can trigger prosecution under federal bank fraud statutes. Making a knowing false statement to influence the action of a federally insured bank or credit union carries penalties of up to $1,000,000 in fines and 30 years in prison.11Office of the Law Revision Counsel. 18 USC 1014 – Loan and Credit Applications Generally, Renewals and Discounts, Crop Insurance, and Mortgage Lending Business That ceiling is rarely imposed for a routine account application, but the statute reaches from account opening to loan applications, and prosecutors have broad discretion. Accuracy on your onboarding paperwork is not optional.