Customer Due Diligence and KYC Requirements Under the BSA

Customer due diligence and KYC requirements under the Bank Secrecy Act are the rules that force every U.S. bank to confirm who you are before opening an account, identify the real people behind any business you open an account for, understand what the account will be used for, and watch how it is used from that point forward. The rules sit in 31 CFR 1020.220 and 31 CFR 1010.230, with additional obligations layered on by the USA PATRIOT Act and FinCEN’s 2016 Customer Due Diligence Rule. For you as a customer, they shape what a bank will ask, what it can tell you, and when it can freeze or close your account.

What the Bank Collects When You Open an Account

Federal regulations require the bank to gather four items of identifying information before opening any account: your name, date of birth, a residential or business street address, and a taxpayer identification number, typically a Social Security number.¹ If you are not a U.S. person, you can provide a passport number, alien identification card number, or another government-issued document number instead of a taxpayer ID. Business entities give the legal name, principal business address, and Employer Identification Number.

Verification usually means an unexpired government-issued photo ID such as a driver’s license or passport. Businesses may be asked for formation documents like articles of incorporation or a partnership agreement. Many banks run the information you provide against third-party databases. Every bank’s Customer Identification Program has to spell out what happens when verification fails, including when to deny the account, when to allow limited use while verification continues, and when to close the account and file a Suspicious Activity Report because identity could not be confirmed.¹

If a parent or guardian opens an account for a minor who lacks legal capacity, the bank treats the adult as the customer and collects their information. A minor who opens an account independently gets identified on their own.²

The identifying information stays on file for five years after the account closes.³ Descriptions of the verification methods and documents used are kept for five years after the record is made. Investigations that reach into your account history years later depend on that retention window.

Beneficial Ownership for Business Accounts

Opening an account in the name of a company is not the end of the identification process. The CDD Rule at 31 CFR 1010.230 requires the bank to look through the corporate structure and identify the human beings who own or control the business.⁴ The rule uses two tests, and both apply.

The ownership test picks up any individual who directly or indirectly owns 25 percent or more of the entity’s equity. The control test picks up one individual with significant day-to-day responsibility for managing the entity, such as a CEO, CFO, or managing member. Even when no one hits the 25 percent ownership threshold, the control test still requires a named individual.⁴

The person opening the account provides each qualifying beneficial owner’s name, date of birth, address, and identification number, and certifies that the information is accurate. FinCEN publishes an optional standardized certification form, but the same information can be gathered in other ways.⁵ Signing a false certification can lead to federal fraud charges and immediate termination of the banking relationship.

When one company owns another, the bank traces the chain until it reaches a natural person, multiplying the percentages at each level to determine whether an individual crosses the 25 percent threshold indirectly.⁶ Banks do not have to investigate ownership independently; they can rely on what the customer’s representative provides, unless something gives them reason to doubt it.

If a trust owns 25 percent or more of the entity, the trustee is treated as the beneficial owner under the ownership test. When co-trustees exist, the bank identifies at least one and may identify more based on its own risk assessment. If the trustee is itself an entity, such as a bank trust department or law firm, that entity is identified for the ownership test, but the control test still requires a natural person.⁶

Businesses That Are Exempt or Partially Exempt

Some entities are excluded from beneficial ownership collection because their ownership and management are already visible to regulators. Publicly traded companies on the NYSE, NASDAQ, or American exchanges (and their majority-owned subsidiaries), banks and other regulated financial institutions, federal and state government entities, SEC and CFTC registrants, state-regulated insurers, and Sarbanes-Oxley registered public accounting firms all fall outside the requirement.

Nonprofits that have filed organizational documents with the appropriate state authority, and pooled investment vehicles operated by a non-excluded financial institution, only need to satisfy the control test because they lack traditional equity owners.⁴ Sole proprietorships and individuals opening accounts in their own names sit outside the rule entirely, since there is no corporate structure to look through.

Questions About What the Account Will Be Used For

Confirming your identity is only half the job. Banks also have to understand the nature and purpose of the relationship. Expect questions about your primary business activities, the geographic scope of your operations, anticipated transaction volumes and types, and the source of your funds. A cash-heavy local restaurant and an import-export business look very different on paper, and the bank needs that context to define what normal activity should look like on your account.

Your answers feed a risk rating. Accounts expected to handle high volumes of international wires, cash-intensive deposits, or transactions touching jurisdictions with weak anti-money-laundering controls draw a higher rating, which drives how closely the bank watches the account and whether enhanced due diligence applies.

When Enhanced Due Diligence Kicks In

Federal examination guidance identifies categories that trigger enhanced due diligence automatically, including foreign correspondent bank accounts, private banking relationships, accounts held by money services businesses, and accounts involving politically exposed persons, meaning senior foreign political figures and their close associates.⁷

When enhanced due diligence applies, the bank may request documentation of your source of wealth, financial statements, a description of your major customers and suppliers, expected international transaction volumes, and an explanation of why you chose that particular bank. High-net-worth individuals may be asked how their assets were accumulated. The questions can feel intrusive, but they reflect a regulatory expectation. Refusing to answer typically means the bank declines to open the account, or closes an existing one.

Monitoring After the Account Is Open

Due diligence continues for the life of the account. Automated systems compare daily activity against the risk profile set at onboarding. A sudden spike in cash deposits, a run of international wires to a country you have no stated business with, or transactions that fit no logical business pattern can push the account into a manual review by the compliance team.

If the review confirms suspicious activity, the bank must file a Suspicious Activity Report with FinCEN. SARs are required for transactions involving $5,000 or more where the bank suspects proceeds from illegal activity, an attempt to evade BSA reporting requirements, or no apparent lawful purpose.⁸

Here is the part that surprises people. The bank is legally prohibited from telling you a SAR has been filed. No employee, officer, or director may notify you that your transaction was reported, and government officials who learn about the filing are bound by the same prohibition.⁹ Banks also receive a safe harbor from civil liability for filing, even if the report proves unfounded. Asking your banker whether a SAR has been filed will not produce a straight answer, because giving one would be a federal violation.

Cash Reports and the Structuring Trap

A Currency Transaction Report is a separate filing, required for any cash transaction exceeding $10,000 in a single business day. It applies to deposits, withdrawals, exchanges, and other cash transfers, and multiple cash transactions that add up to more than $10,000 on the same day are aggregated.

Breaking a large cash deposit into smaller amounts across multiple days or branches to stay under the $10,000 line is called structuring, and it is a federal crime carrying up to five years in prison, even when the money is entirely legitimate.¹⁰ If structuring is part of a broader pattern of illegal activity involving more than $100,000 in a 12-month period, the maximum doubles to ten years. Bank staff are trained to spot structuring, and a customer depositing $9,500 in cash three days in a row draws more scrutiny than one who deposits $15,000 at once and lets the CTR file automatically.

Sanctions Screening

Banks also check customer names and transactions against government watchlists, most importantly the Office of Foreign Assets Control sanctions list maintained by the Treasury Department.¹¹ When a customer, beneficial owner, or counterparty matches a listed name, the bank must freeze the assets and report the match. Screening happens at account opening and continues as the lists are updated.

Keeping Your Information Current

Banks refresh customer information periodically, and the frequency tracks the account’s risk level. A low-risk retail account might be reviewed every few years; a high-risk business account could be reviewed annually. Reviews cover changes to your address, business activities, ownership structure, and typical transaction patterns.

An ownership change that pushes a new person above the 25 percent threshold requires updated beneficial ownership information. Banks may also run adverse media searches during these reviews for coverage that could affect a customer’s risk profile.⁷ Ignoring a request for updated information puts your account at risk of restriction or closure. From the bank’s side, an account it can no longer verify is a compliance liability it cannot afford to keep.

Where the Corporate Transparency Act Fits Now

The Corporate Transparency Act, enacted in 2021, created a separate obligation for businesses to report beneficial ownership directly to FinCEN. Following legal challenges and a March 2025 interim final rule, FinCEN exempted all entities created in the United States from the reporting requirements. Only foreign entities registered to do business in a U.S. state or tribal jurisdiction remain subject to the filing obligation, and FinCEN has stated it will not enforce BOI reporting penalties against U.S. citizens or domestic companies.¹²

That leaves the CDD Rule’s account-opening collection as the primary mechanism for identifying who owns and controls business customers. When the federal registry eventually becomes accessible to financial institutions, it will supplement rather than replace the bank-level process. Banks that gain access will need customer consent before pulling BOI, and the information may only be used for CDD compliance, not for general business decisions like whether to extend credit.¹³

Why Banks Push So Hard on Documentation

Civil penalties for willful BSA violations are adjusted annually for inflation and, at the most recent adjustment, range from roughly $71,545 to $286,184 per violation depending on the amount involved.¹⁴ Criminal penalties reach up to $250,000 in fines and five years in prison for a willful violation, doubling to $500,000 and ten years when the violation occurs alongside another federal crime or as part of a pattern involving more than $100,000 within a 12-month period.¹⁵

These penalties reach individual bank officers and employees, not only the institution. A compliance officer who ignores red flags or a branch manager who helps a customer structure deposits faces personal criminal exposure. That is why banks err on the side of asking one more question, requesting one more document, or closing an account they cannot verify. Understanding that pressure makes the process easier to work with: the bank is not being difficult, it is answering to a rule set with its own name on the line.

1
eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
2
Financial Crimes Enforcement Network. FAQs: Final CIP Rule
3
eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
4
eCFR. 31 CFR 1010.230 – Beneficial Ownership Requirements for Legal Entity Customers
5
Financial Crimes Enforcement Network. Certification Regarding Beneficial Owners of Legal Entity Customers
6
Financial Crimes Enforcement Network. Frequently Asked Questions Regarding Customer Due Diligence Requirements for Financial Institutions
7
FFIEC BSA/AML InfoBase. Assessing Compliance with BSA Regulatory Requirements – Customer Due Diligence
8
eCFR. 12 CFR 208.62 – Suspicious Activity Reports
9
Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority
10
Office of the Law Revision Counsel. 31 USC 5324 – Structuring Transactions to Evade Reporting Requirement
11
Office of Foreign Assets Control. OFAC FAQ 29 – How Do I Set Up a Compliance Program for My Bank
12
Financial Crimes Enforcement Network. Beneficial Ownership Information Reporting
13
Financial Crimes Enforcement Network. Beneficial Ownership Information Access and Safeguards Requirements
14
eCFR. 31 CFR 1010.821 – Penalty Adjustment and Table
15
Office of the Law Revision Counsel. 31 USC 5322 – Criminal Penalties