How to Fill Out and Submit a USA PATRIOT Act Verification Form

The USA PATRIOT Act verification form is the identity paperwork a bank or credit union has you complete before it will open an account for you. Section 326 of the PATRIOT Act told the Treasury Department to set minimum identity checks for every financial institution, and the resulting rule at 31 CFR § 1020.220 lays out what the bank must collect and how it must confirm the answers.¹ Every bank’s version of the form looks a little different. The fields on it, and the documents that satisfy them, are the same everywhere.

The Four Pieces of Information You Have to Provide

Federal regulations require a bank to collect at least four identifiers from every individual before opening an account: your name, date of birth, address, and an identification number.²

Enter your full legal name exactly as it appears on the ID you plan to hand over. A missing middle name or a hyphen where the ID shows a space can be enough to bump the application into manual review. Your date of birth helps the bank separate you from other people with similar names and lets its systems cross-check you against third-party databases.

For the address field, you need a residential or business street address. If you don’t have one, the regulation allows an APO or FPO box number, or the street address of a next of kin or another contact person. A standard post office box on its own doesn’t satisfy the address requirement for an individual.²

The identification number depends on who you are. U.S. persons provide a taxpayer identification number, almost always a Social Security Number. Non-U.S. persons may provide a taxpayer identification number, a passport number with the country of issuance, an alien identification card number, or the number of another government-issued document that shows nationality or residence and carries a photograph.²

Check every digit of your SSN or taxpayer ID before you submit. Transposed numbers are the most common cause of automated rejections, and they can push your file into a fraud review that takes days to unwind.

Documents That Satisfy the Bank

Once you’ve filled in the four fields, the bank has to verify them. The regulation lets it rely on unexpired, government-issued identification that shows nationality or residence and includes a photograph or similar safeguard. A driver’s license and a U.S. passport are the two most common choices.²

For non-U.S. persons, a valid foreign passport usually works, as does an alien registration card or another government-issued document with a photo. The form will ask you to record the document number, the issuing authority, and the expiration date next to your personal details. Bring the original. Photocopies alone rarely satisfy a branch representative, who needs to look at security features like holograms and microprinting.

If you’re opening an account for a business entity such as a corporation, partnership, or trust, the bank looks for documents showing that the entity legally exists: certified articles of incorporation, a government-issued business license, a partnership agreement, or a trust instrument.²

If You Don’t Have a Photo ID

Not everyone can walk in with a current driver’s license, and the regulation accounts for that. Banks must have written procedures for verifying identity through non-documentary methods when a customer cannot present an unexpired government-issued photo ID, when the bank isn’t familiar with the documents offered, or when the account is being opened without the customer appearing in person.²

The non-documentary methods the regulation names include contacting you directly to confirm details, cross-referencing your information against a consumer reporting agency or public database, checking references with other financial institutions, and reviewing a financial statement.² If you already know your only ID is expired, or that you’ll be applying remotely, call the bank before you start. Each institution’s written program is tailored to its own risk profile, so the answer varies from one bank to the next.

If You Don’t Have a Social Security Number

You don’t need an SSN to open a U.S. bank account. The rule requires a taxpayer identification number from U.S. persons, but for non-U.S. persons it accepts several alternatives, including an Individual Taxpayer Identification Number (ITIN), a passport number, or an alien identification card number.² Many major banks, including PNC, explicitly offer accounts to non-residents using an ITIN or passport number as the primary identifier.

If you have neither an SSN nor an ITIN, the bank may ask you to complete IRS Form W-8 BEN, which certifies your status as a non-U.S. taxpayer. You’ll likely also need proof of your current U.S. address, such as a recent utility bill, pay stub, or lease agreement dated within the last 60 days, alongside your passport or consular ID.

Completing the Form at a Branch or Online

Banks hand you the form in one of two settings: as part of the digital onboarding flow when you apply online, or as paper at a branch. Before you see the questions, the bank has to give you notice explaining that it is collecting the information to comply with federal identity-verification law.³

At a Branch

Hand your unexpired photo ID to the representative. They will inspect the physical security features and record the document number, issuer, and expiration date. You then fill in your name, date of birth, address, and taxpayer ID on the form, or the representative enters them for you. Look over everything on screen or on paper before you sign. Once you submit, corrections require a separate review cycle.

Online or Mobile

Digital applications typically ask you to photograph or scan the front and back of your ID and upload the images through an encrypted portal. Some banks also use liveness detection, where your phone’s camera checks that a real person is holding the ID rather than a printed photo or a screen. You may be asked to blink, turn your head, or hold still while the system analyzes the image. After the upload, you enter your four identifiers and submit. The bank’s system then cross-references what you’ve provided against third-party databases and credit bureau records.

What Happens After You Submit

The bank’s compliance systems compare your information against multiple sources. The most consequential is the Office of Foreign Assets Control’s Specially Designated Nationals list, the database of individuals and entities under U.S. sanctions. Banks must confirm you don’t appear on the list before completing any transaction. OFAC has made clear that the important thing is not to conclude a transaction before that analysis is finished.⁴ The bank also checks credit bureau records and may query other public databases to confirm your identity matches what’s on file.

For a standard checking or savings account, verification often wraps up within a day or two. Once the bank is satisfied, you’ll get confirmation through a mobile app notification or email, and the account is activated. Debit cards and checkbooks are issued after that step, not before.

If the Bank Flags a Problem

When the automated systems catch a mismatch, whether a name spelling that doesn’t line up with credit bureau records, an address that can’t be confirmed, or a possible SDN list hit, the bank may ask for secondary documentation such as a utility bill, a second form of ID, or a written explanation. If the bank still can’t form a reasonable belief that it knows your identity, the regulation requires it to follow its written procedures. Those may include declining to open the account, closing a provisionally opened account, or filing a Suspicious Activity Report.²

If You Are Denied

A denial based on information in a checking account reporting database triggers specific consumer rights. The bank must send you an adverse action notice identifying the reporting company whose data influenced the decision. You can then contact that company, request a free copy of your report, and dispute any inaccurate entries in writing. Under the Fair Credit Reporting Act, both the reporting company and the bank that furnished the data have to investigate and correct errors.⁵

If the denial comes from a false positive on the OFAC sanctions list because your name closely resembles a sanctioned person’s, you can petition OFAC’s Office of the Director directly. Send it by email to OFAC.Reconsideration@treasury.gov or by mail to the Office of Foreign Assets Control, 1500 Pennsylvania Avenue N.W., Washington, D.C. 20220. Include the name as it appears on the sanctions list, the date of the listing action, and a detailed explanation of why you are not the listed person. You don’t need an attorney to file. OFAC typically acknowledges emailed petitions within seven business days.⁶

Do Not Put False Information on the Form

Lying on the verification form carries severe federal consequences. Under 18 U.S.C. § 1014, anyone who knowingly makes a false statement to a federally insured financial institution faces up to 30 years in prison, a fine of up to $1,000,000, or both.⁷ Courts may also order full restitution of any losses the institution suffered and impose supervised release after the prison term. This statute covers false information on any application, loan, or account, not just mortgage fraud, despite its frequent association with that area.

How Long the Bank Keeps Your Information

Your personal information doesn’t disappear once the account opens. Banks must keep the identifying information they collected, your name, date of birth, address, and taxpayer ID, for five years after the account is closed. Records of the documents used to verify your identity and the results of any verification methods are kept for five years after the record is made.³

Separately, the Gramm-Leach-Bliley Act requires the bank to tell you how it handles your non-public personal information. You should receive a privacy notice no later than when the customer relationship is established. That notice has to describe what categories of personal data the bank collects, who it shares that data with, how it protects the information, and how you can opt out of certain disclosures to unaffiliated third parties.⁸ If you never received the notice, ask for it. The bank is legally obligated to provide one.

1
Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority
2
eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
3
eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
4
U.S. Department of the Treasury. Frequently Asked Questions – 43
5
Consumer Financial Protection Bureau. Why Was I Denied a Checking Account?
6
U.S. Department of State. Sanctions Delisting
7
Office of the Law Revision Counsel. 18 USC 1014 – Loan and Credit Applications Generally
8
Federal Trade Commission. Gramm-Leach-Bliley Act