KYC photo ID verification is the identity check a financial institution runs before letting you open an account, and it usually means photographing a government-issued ID with your phone and taking a selfie so software can match your face to the document. Federal rules under 31 CFR § 1020.220 require every bank to maintain a written Customer Identification Program that verifies each person who opens an account.1eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks Get the document and the photo right and approval can land in seconds; get either wrong and you’ll be resubmitting.
What the Bank Has to Collect From You
At a minimum, a bank must collect four pieces of information when you open an account: your name, date of birth, address, and an identification number.2eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks – Section: Customer Information Required For U.S. persons, that identification number is a Social Security number or taxpayer identification number. For non-U.S. persons, it can be a passport number with the issuing country, an alien identification card number, or the number from another government document showing nationality or residence.
The bank then has to follow “risk-based procedures” to verify the information is accurate.1eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks Banks have discretion here. A basic checking account may need only a quick document scan; a higher-value account can trigger deeper scrutiny. The regulation also requires the bank to check your name against government lists of known or suspected terrorists and to tell you the check is happening.
Which Photo IDs Are Accepted
The regulation describes acceptable documents as “unexpired government-issued identification evidencing nationality or residence and bearing a photograph or similar safeguard,” offering a driver’s license or passport as examples.1eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks In practice, nearly every platform accepts:
- A U.S. passport or passport card, accepted almost universally and useful when your license doesn’t show your current address.
- A state-issued driver’s license, the most common submission, which must be unexpired and display a photograph.
- A state-issued non-driver ID card, treated the same as a driver’s license at most institutions.
Two words in that regulatory language matter. “Unexpired” is enforced strictly by automated systems, so a license that lapsed last week will fail even if everything else is correct. And individual banks set their own policies within the federal floor, so acceptance can vary by platform.
If You’re Not a U.S. Citizen
For non-U.S. persons, banks may accept a broader set of identification: a passport, an alien identification card, or any other government-issued photo document showing nationality or residence.1eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks Platforms commonly accept permanent resident cards, employment authorization cards, and foreign passports. Many major banks also accept an Individual Taxpayer Identification Number in place of a Social Security number when the account is opened in person at a branch.
If You Don’t Have a Valid Photo ID
The regulation requires banks to have non-documentary verification procedures for people who can’t present a valid photo ID, whether because the account is being opened remotely or because they simply don’t have an unexpired government document.1eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks These backup methods include cross-referencing your information against consumer reporting agencies, public databases, or other financial institutions. Not every platform advertises the option, but the law requires the bank to have a process. You may need to ask for it by name.
Photographing Your ID So It Passes
Most rejections aren’t about your identity. They’re about the picture.
Put the ID flat on a dark, non-reflective surface. Kitchen counters and glossy desks bounce light back into the lens and wash out the text on a laminated card. A dark cloth or piece of paper underneath fixes this. All four corners of the document need to be inside the frame; cropping even a sliver off an edge tells the system the document may have been altered.
Overhead lighting is the biggest source of glare on plastic-coated IDs. Angle your phone slightly instead of shooting straight down, or move to indirect natural light. Let the camera autofocus settle before you capture the image. The text fields on an ID are small, and even mild motion blur makes them unreadable to the optical character recognition software that parses your name and date of birth.
Most platforms also want the back of the card, where the barcode or magnetic stripe sits. Same rules apply: flat surface, no glare, all edges visible. Skipping the back or submitting a blurred image of it triggers an immediate resubmission request.
The Selfie and Liveness Check
After the document capture, most platforms ask for a selfie or a short liveness check. The selfie lets facial recognition software compare your live face against the photo on your ID. A liveness check goes further: you might be asked to follow a dot on the screen with your eyes, turn your head slightly, or blink on command. The point is to prove a real person is in front of the camera, not someone holding up a printed photo.
Remove hats, sunglasses, and anything else that partially covers your face. The software needs a clear view of your eyes, jawline, and the bridge of your nose to map the biometric reference points. Use a plain background and even lighting; harsh shadows on one side of your face cause the same kind of matching problems that glare causes on an ID. Stay still during the recording. A slight head bob can force a restart.
What Happens After You Submit
Your encrypted images go to the institution’s verification servers. Automated software handles the first pass, reading the text fields on your ID, checking security features like holograms and barcode data, and comparing your selfie to the ID photo. When everything matches cleanly, approval can come through in seconds.
If something gets flagged, a low-confidence facial match, an unreadable field, or a document format the system doesn’t recognize, your submission is routed to a human reviewer. Manual review typically takes one to three business days and can stretch longer during high-volume periods. You’ll usually see a “pending” status on your dashboard, and certain features such as large transfers or withdrawals may be restricted until the review clears. You’ll get an email or in-app alert once a decision is made. If you’re denied, the notification should explain why and whether you can resubmit.
Why Submissions Fail
Most failures fall into a few predictable buckets, and knowing them keeps you from resubmitting the same bad data:
- Expired document. Even a document that expired last week is rejected; automated systems enforce the “unexpired” rule strictly.
- Name or date-of-birth mismatch. A recent legal name change, or a middle name on the ID that you didn’t type during sign-up, reads as a discrepancy.
- Poor image quality. Motion blur, glare, low-resolution cameras, and cropped edges are the most common technical failures.
- Selfie problems. Insufficient lighting, glare on glasses, awkward framing, or not facing the camera directly.
- Thin data history. Recent immigrants and younger adults may have limited records in the databases platforms use for cross-referencing, which can produce a “no data” result even with a valid document.
If your submission is rejected, read the denial reason carefully. Most platforms allow at least one resubmission, so fix the specific issue rather than reuploading the same images. If the problem persists, contact the institution’s customer support directly and ask about non-documentary verification, which the regulation requires them to have available. When direct contact doesn’t resolve it, you can file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov.3Consumer Financial Protection Bureau. Submit a Complaint Include all the key facts, dates, and any communications you’ve had with the company, because you can’t submit a second complaint about the same issue.
How Long the Bank Keeps Your ID Data
Handing over a photo of your government ID and a biometric selfie is a lot of personal data, and the regulations reflect that. Under the FTC’s Safeguards Rule, financial institutions must encrypt customer information in transit and at rest, implement multi-factor authentication for anyone accessing their systems, limit employee access to only the customer data needed for the job, and maintain logging that detects unauthorized access.4eCFR. 16 CFR 314.4 – Elements of a Safeguards Rule
The same rule imposes a disposal requirement: institutions must securely delete your information no later than two years after it was last used to provide you a service, unless another law requires them to keep it longer.4eCFR. 16 CFR 314.4 – Elements of a Safeguards Rule Bank Secrecy Act regulations do require that: banks must retain identification records for five years after the account is closed.1eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks Your scanned ID and selfie will sit in the institution’s systems for at least five years after you close the account, in original, electronic, or reproduced form.5eCFR. 31 CFR 1010.430 – Nature of Records and Retention Period
If a breach occurs, institutions under FTC jurisdiction must report it within 30 days of discovery when the unencrypted data of 500 or more consumers is compromised.6Federal Trade Commission. Safeguards Rule Notification Requirement Now in Effect
Don’t Submit Someone Else’s ID
Submitting a fraudulent document to pass KYC is a federal crime. Under 18 U.S.C. § 1028, producing or using a false government-issued ID, driver’s license, or birth certificate carries up to 15 years in prison; other fraudulent use of identification documents carries up to 5 years; and penalties rise to 20 years when the fraud is connected to drug trafficking or violent crime, and 30 years when it facilitates terrorism.7Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents Bank Secrecy Act penalties can also reach customers who knowingly provide false information to evade identification requirements.8Office of the Law Revision Counsel. 31 USC 5322 – Criminal Penalties If your own ID has a real problem, ask the bank about non-documentary verification rather than trying to work around it.