KYC compliance rules are the federally mandated procedures that require banks, credit unions, broker-dealers, insurance companies, casinos, money services businesses, and other covered financial institutions to identify every customer who opens an account, verify that identity, assess the risk the relationship presents, screen against sanctions lists, and monitor transactions for suspicious activity over the life of the account. The rules come from the Bank Secrecy Act and Section 326 of the USA PATRIOT Act, and willful violations carry criminal exposure of up to $250,000 in fines and five years in prison per offense.
Which Businesses Are Covered
The Bank Secrecy Act defines “financial institution” broadly. The statute reaches banks, credit unions, thrift institutions, brokers and dealers in securities or commodities, insurance companies, casinos, money services businesses, and more.1U.S. Department of the Treasury. Financial Crimes Enforcement Network – Customer Identification Programs for Certain Banks Section 326 of the USA PATRIOT Act then requires each of these entities to maintain a Customer Identification Program that meets minimum federal standards for anyone applying to open an account.2Financial Crimes Enforcement Network. USA PATRIOT Act
Cryptocurrency exchanges are covered. FinCEN treats entities that accept and transmit convertible virtual currency as money transmitters, a category of money services business, which carries the full weight of BSA obligations: FinCEN registration, an AML program, recordkeeping, and reporting.3Financial Crimes Enforcement Network. Advisory on Illicit Activity Involving Convertible Virtual Currency Operating an unlicensed money transmitting business is itself a federal crime.
Residential real estate is partially covered. FinCEN uses Geographic Targeting Orders to require title insurance companies to identify the beneficial owners of legal entities making large all-cash residential purchases in designated metropolitan areas.4Financial Crimes Enforcement Network. Geographic Targeting Order Covering Title Insurance Company This is narrower than a general KYC regime, but title companies in those markets have real identification duties.
What a Customer Identification Program Must Collect
Every covered institution operates a Customer Identification Program (CIP). Before opening any account, the institution collects four minimum data points from each customer: full legal name, date of birth (for individuals), address, and an identification number.5Federal Deposit Insurance Corporation. Customer Identification Program
For a U.S. person, the identification number is a taxpayer identification number — a Social Security Number for most individuals, an Employer Identification Number for businesses.6Financial Crimes Enforcement Network. CIP Order – Customer Identification Program TIN Exemption Order Foreign nationals without an SSN can use a passport number or an Individual Taxpayer Identification Number (ITIN). Applying for an ITIN requires either a valid passport or two supporting documents that prove identity and foreign status, such as a national identification card and a civil birth certificate.7Internal Revenue Service. ITIN Supporting Documents
The address rule is more flexible than many assume. Individuals should provide a residential or business street address, but the regulations also accept an APO or FPO box for military personnel. If someone truly lacks a street address, a description of their physical location or the address of a next of kin can satisfy the requirement.5Federal Deposit Insurance Corporation. Customer Identification Program
How Identity Gets Verified
Collecting the four data points is only step one. The institution then verifies the information using documents, non-documentary methods, or a combination of both. Government-issued photo ID (driver’s license, passport) is the common documentary route. For a business entity, that typically means reviewing formation documents and confirming legal standing.
Non-documentary verification is now the norm for digital onboarding. Institutions cross-reference submitted data against government databases, credit bureau records, and other third-party sources. Many platforms layer in biometric checks, asking the applicant to take a live photograph that software compares against the ID photo. Liveness detection systems are designed to reject static images or masks, with reliability varying across providers.
If the institution cannot verify a customer’s identity through any reasonable combination of methods, it has the authority to refuse to open the account. The CIP rules require verification, and opening an account over unresolved identity questions is regulatory risk. Most friction for applicants happens here: a blurry document scan, a name mismatch between a passport and a utility bill, or an address that doesn’t appear in public records can stall or block an application.
Business Accounts and Beneficial Owners
When a legal entity such as a corporation, LLC, or partnership opens an account, the institution has an added layer of identification under the Customer Due Diligence (CDD) rule. Covered institutions must identify and verify the beneficial owners of every legal entity customer. A beneficial owner is any individual who owns or controls at least 25 percent of the entity’s ownership interests, plus any individual who exercises substantial control, such as a senior executive.8Financial Crimes Enforcement Network. CDD Final Rule
The institution collects the same four CIP data points for each beneficial owner. Shell companies and layered ownership structures are common laundering vehicles, and knowing only the company name on an account gives no insight into who actually controls the money moving through it.
Separate from the CDD rule, the Corporate Transparency Act originally required most small U.S. companies to report beneficial ownership information directly to FinCEN. An interim final rule published in March 2025 exempted all domestic reporting companies from that filing obligation.9Financial Crimes Enforcement Network. Beneficial Ownership Information Reporting The BOI reporting requirement now applies only to foreign companies registered to do business in a U.S. state or tribal jurisdiction.10Federal Register. Beneficial Ownership Information Reporting Requirement Revision and Deadline Extension The CDD rule’s requirement for financial institutions to identify beneficial owners at account opening remains fully in effect.
Risk-Based Due Diligence
Once identity is verified, the institution assigns a risk profile. The CDD rule frames this as understanding the “nature and purpose” of the customer relationship. For lower-risk customers, that understanding often comes from self-evident information — account type, product requested, basic customer profile — and the institution may need nothing beyond the CIP data.11FFIEC BSA/AML InfoBase. Assessing Compliance with BSA Regulatory Requirements – Customer Due Diligence
Higher-risk profiles trigger Enhanced Due Diligence (EDD). The classic example is a Politically Exposed Person, meaning a current or former senior government official or a close associate. PEPs can present elevated money laundering risk because their public position may give them access to funds derived from corruption. Regulators have been explicit that not every PEP is automatically high risk; the assessment depends on specific facts, including transaction volume, geographic location, and jurisdiction.12Financial Crimes Enforcement Network. Joint Statement on BSA Due Diligence Requirements for Customers Who May Be Considered Politically Exposed Persons
EDD goes further than CIP verification. The institution investigates the customer’s source of wealth (how they accumulated assets) and source of funds (where the money for specific transactions originated). That can mean reviewing tax returns, investment statements, or corporate financials. Accounts flagged for EDD are reviewed more frequently, and the compliance team documents every step.
Sanctions Screening
Separate from BSA/AML obligations, every financial institution must comply with the sanctions programs run by the Treasury Department’s Office of Foreign Assets Control (OFAC). In practice, that means screening customers and transactions against OFAC’s Specially Designated Nationals and Blocked Persons (SDN) list. New accounts should be compared against the list before or shortly after opening, and existing customers must be re-screened whenever OFAC updates the list.13FFIEC BSA/AML InfoBase. Office of Foreign Assets Control
A screening match requires the institution to block the account or reject the transaction. Missing an SDN account can mean a direct transfer of funds to a sanctioned individual or entity, an enforcement action against the institution, and serious reputational damage.14OFAC. Starting an OFAC Compliance Program Wire transfers, letters of credit, and other transactions should all be screened before execution. OFAC compliance is technically distinct from the CIP regulation, but most institutions build sanctions screening directly into their KYC onboarding workflow.
Ongoing Monitoring and CTRs
Identifying a customer at account opening is the beginning of the obligation, not the end. The CDD rule explicitly requires ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information over the life of the relationship.8Financial Crimes Enforcement Network. CDD Final Rule An address change, an industry shift, or a change in beneficial ownership all call for updated records.
Transaction monitoring is where most of the ongoing work lives. Institutions run automated systems that flag activity inconsistent with a customer’s risk profile. Cash transactions over $10,000 require a Currency Transaction Report (CTR) filed with FinCEN. The threshold applies to a single transaction or to multiple transactions aggregating above $10,000 in a single business day.15Financial Crimes Enforcement Network. Notice to Customers – A CTR Reference Guide CTRs are a routine reporting mechanism, not an accusation. Customers should expect to show identification for large cash transactions.
Suspicious Activity Reports
When an institution spots activity that could involve illegal funds, money laundering, or evasion of BSA requirements, it files a Suspicious Activity Report (SAR) with FinCEN. For banks, the filing obligation kicks in when a suspicious transaction involves or aggregates at least $5,000.16eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions Money services businesses have a $2,000 threshold.17Financial Crimes Enforcement Network. FinCEN Suspicious Activity Report Electronic Filing Instructions Banks must also file when insider abuse is involved at any dollar amount.
SARs are confidential by law. The institution cannot tell the customer that a SAR has been filed, and no employee involved may disclose its existence. If a bank or an employee is subpoenaed for information about a SAR, they must decline to produce it.18eCFR. 12 CFR 163.180 – Suspicious Activity Reports and Other Reports and Statements That secrecy is what gives the system its value; if customers knew they were being reported, the people the system is built to catch would move their money elsewhere.
The Written AML Program
Section 352 of the USA PATRIOT Act requires every financial institution to maintain a written anti-money laundering program with four minimum components: internal policies, procedures, and controls; a designated compliance officer; an ongoing employee training program; and an independent audit function to test effectiveness.2Financial Crimes Enforcement Network. USA PATRIOT Act The CIP, due diligence procedures, transaction monitoring, and SAR filing all operate within this framework.
The compliance officer role carries weight. That person is responsible for making sure day-to-day operations match the written policies. When regulators examine an institution, they look at both whether the AML program exists on paper and whether it functions in practice. A compliance manual nobody follows is worse than no manual, because it shows the institution knew what it should have been doing.
Recordkeeping and Customer Privacy
Institutions must retain all identifying information collected under the CIP for at least five years after the account is closed. The description of any verification documents, the methods and results of verification, and the resolution of any discrepancies must also be kept for five years from the date the record was created.19eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks Records remain available for law enforcement long after a customer relationship ends.
Customers have meaningful privacy protections against government overreach. The Right to Financial Privacy Act generally bars a federal government authority from accessing a customer’s financial records unless a specific condition is met, including valid customer authorization, an administrative or judicial subpoena, or a search warrant. When the government uses a subpoena or formal written request, the customer must be notified and given at least ten days to challenge the disclosure in court. A customer authorization for disclosure cannot exceed three months and cannot be required as a condition of doing business with the institution.20Office of the Law Revision Counsel. Title 12 – Banks and Banking, Chapter 35 – Right to Financial Privacy
Penalties for Non-Compliance
BSA penalties split into two categories. Civil penalties for willful violations cap at the greater of the transaction amount (up to $100,000) or $25,000 per violation. Negligent violations carry a lower ceiling of $500 each, though a pattern of negligence can raise the penalty to $50,000.21Office of the Law Revision Counsel. 31 U.S. Code 5321 – Civil Penalties For international counter-money-laundering violations, such as failures in correspondent banking due diligence, the penalty jumps to at least twice the transaction amount and can reach $1,000,000.
Criminal penalties are where the real exposure lies. A person who willfully violates the BSA faces up to $250,000 in fines, up to five years in prison, or both. If the violation occurs alongside another federal crime or is part of a pattern involving more than $100,000 in illegal activity over 12 months, the maximums double to $500,000 in fines and up to ten years in prison.22Office of the Law Revision Counsel. 31 U.S. Code 5322 – Criminal Penalties Operating an unlicensed money transmitting business carries a separate five-year prison term under federal law.23Financial Crimes Enforcement Network. Enforcement Actions for Failure to Register as a Money Services Business