How Many Forms of ID Do You Need for the Patriot Act?

The Patriot Act does not set a specific number of IDs you need to open a bank account. Section 326 tells banks to build a Customer Identification Program and use it to form a “reasonable belief” about who you are, and the number of documents that takes depends on the bank’s own risk-based procedures, the type of account, and how cleanly your information checks out. For most people, one unexpired government-issued photo ID plus a Social Security number is enough.

What the Law Actually Requires

Before opening any account, a bank has to collect four pieces of information from an individual customer: your name, your date of birth, your address, and an identification number. For U.S. persons, that identification number is a taxpayer identification number, which usually means a Social Security number. If you don’t have a residential or business street address, the bank can accept an APO or FPO box, or the address of a next of kin or other contact person.¹

Collecting those four data points is only half the job. The bank also has to verify that the information is accurate. That’s where identification documents come in, and it’s why “how many IDs” is the wrong frame: the regulation asks for verification, not a document count.

The Standard: One Government-Issued Photo ID

The most common way banks verify identity is by examining an unexpired, government-issued document with your photograph on it. The regulation names a driver’s license or passport as examples, but any government-issued photo document showing your nationality or residence qualifies. A state ID card or military ID works too.¹

The bank records a description of your document: the type, any identification number on it, where it was issued, and its expiration date.¹ One valid photo ID combined with your taxpayer identification number is usually enough for the bank to form its reasonable belief.

If a particular bank’s policy asks for two forms of ID from every customer, that’s the bank going beyond the federal floor. Banks have broad discretion to set their own CIP standards above the regulatory minimum, and many do. Call ahead if you want to know what a specific branch expects.

When Banks Ask for More

Several situations routinely push a bank past the standard one-ID checkout:

Information that doesn’t match. If the name on one document doesn’t line up with another, or your stated address differs from what a credit check returns, the bank has to resolve the discrepancy before opening the account.
No in-person visit. Accounts opened online, by phone, or through the mail lack the face-to-face confirmation that comes with presenting a physical document, so banks layer on additional checks.
An expired or missing photo ID. Without a valid government-issued photo ID, the bank shifts to non-documentary methods and may ask for utility bills or bank statements as supporting proof.
Higher-risk account types. Business accounts, trust accounts, or accounts with large opening deposits draw more scrutiny under a bank’s risk-based procedures.

The bank’s written CIP has to address each of these scenarios. Handling discrepancies and gaps in documentation isn’t optional caution; the regulation requires written procedures for it.¹

If You’re Not a U.S. Person

The identification number requirement works differently if you aren’t a U.S. citizen or resident. Instead of a Social Security number, you can provide one or more of the following: a taxpayer identification number, a passport number along with the issuing country, an alien identification card number, or the number from any other government-issued document showing your nationality or residence and bearing a photograph.¹

In practice, non-U.S. persons often face more document requests because the bank’s risk assessment treats foreign accounts as inherently higher risk. A foreign passport alone may satisfy the regulation, but a bank might still ask for proof of a U.S. address or run additional non-documentary checks before it’s satisfied.

If You Don’t Have a Photo ID

Not everyone can hand over an unexpired government photo ID, and the regulations plan for that. Every bank’s CIP has to include non-documentary verification procedures for those situations. These backup methods also come into play when the account is opened remotely or without you appearing in person.¹

Non-documentary methods include:

Comparing what you provided against data held by consumer reporting agencies.
Cross-referencing your details with public records.
Contacting another financial institution where you already hold an account for a reference.
Reviewing a recent financial statement.
Reaching out to you by phone or other means to confirm details.

Documentary and non-documentary verification aren’t an either-or. Many banks use both. Your driver’s license might be reviewed alongside a consumer reporting agency check, especially for higher-risk account types or when something in your application doesn’t quite match up.

If the Bank Can’t Verify You

The regulation is blunt about what happens when a bank can’t reach its reasonable-belief standard: the CIP has to describe when the bank should refuse to open the account. A bank that proceeds without adequate verification risks violating the Bank Secrecy Act and anti-money laundering rules, so the incentive to turn you away is real.¹

Being denied at the counter isn’t always the end of it. The bank’s procedures also have to describe when it might open the account while verification continues. Some banks will open an account with restrictions, limiting transactions or holding deposits, until the remaining steps are completed. If the bank ultimately can’t verify who you are, it can close the account. Where fraud or other criminal activity is suspected, the bank may also file a Suspicious Activity Report with federal regulators.²

The Practical Answer

Bring a valid, unexpired government-issued photo ID and know your Social Security number. That combination clears the bar at most banks for a standard personal account. Bring a second document, such as a utility bill or a recent bank statement, if you’re opening a higher-risk account, if any of your information has recently changed, or if the bank has told you in advance that it wants two forms of ID. If you’re opening the account remotely, expect the bank to ask for additional verification even when your photo ID is in order. Business accounts add a separate layer: banks must identify each individual who owns 25 percent or more of the entity, plus at least one person who controls it.³

1
eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
2
eCFR. 12 CFR 21.11 – Suspicious Activity Report
3
Financial Crimes Enforcement Network. Information on Complying with the Customer Due Diligence (CDD) Final Rule