The Know Your Customer rule under the PATRIOT Act requires every U.S. financial institution to verify who its customers actually are before opening an account, and to keep watching those accounts for suspicious activity afterward. The rule sits in Section 326 of the USA PATRIOT Act, codified at 31 U.S.C. § 5318(l), and it is implemented through regulations from the Financial Crimes Enforcement Network (FinCEN), a bureau of the U.S. Treasury Department.1FinCEN.gov. FinCEN’s Legal Authorities In practical terms, it is the reason a bank asks for your Social Security number, your driver’s license, and your address when you open a checking account, and the reason a business has to disclose its owners when it opens one.
Who Has to Follow the Rule
The obligation reaches every entity classified as a “financial institution” under the Bank Secrecy Act, which is a much broader category than most people expect. Banks and credit unions are covered. So are broker-dealers, mutual funds, futures commission merchants, and introducing brokers in commodities.2eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks Money services businesses fall inside the rule too: money transmitters, check cashers, and currency exchangers all have to run a program. Insurance companies that sell products with a cash-surrender value, such as permanent life insurance or annuities, are covered because those products can be cashed out and used to launder funds.
Cryptocurrency exchanges operating in the United States are treated as money transmitters and carry the same KYC and anti-money laundering obligations as any other money services business. FinCEN has been clear that businesses transmitting convertible virtual currency fall under existing BSA requirements, including customer due diligence and suspicious activity reporting.
One geographic boundary matters. The Customer Identification Program (CIP) rule does not apply to any part of a bank located outside the United States.3FinCEN. Ten of the Most Common Questions About the Final CIP Rule
What the Institution Must Collect and Verify
Every covered institution has to maintain a written Customer Identification Program with four required components spelled out at 31 CFR § 1020.220.2eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
The Four Data Points
For every individual opening an account, the institution must collect at a minimum:
- Full legal name
- Date of birth
- Residential address
- A taxpayer identification number — usually a Social Security number for U.S. persons, or an Employer Identification Number for business entities
Foreign nationals without a U.S. taxpayer ID must instead provide a government-issued identification number, such as a passport number or alien identification card number. A foreign taxpayer number is also acceptable where one exists. This collection step applies to every new account, whether it opens in person, online, or by phone.
Verifying the Information
Collection alone is not enough. The institution has to verify the information using risk-based procedures, and verification comes in two forms. Documentary verification means examining a reliable, independent source document like a driver’s license, passport, or articles of incorporation. Non-documentary verification means confirming the information through other channels, such as cross-referencing public databases or pulling a credit report. Most institutions use a combination of both, particularly for accounts opened remotely where a physical document cannot easily be inspected.
Digital identity tools are increasingly part of that mix. A March 2026 Treasury report to Congress noted that financial institutions are adopting mobile driver’s licenses, biometric selfie matching, and liveness detection to satisfy CIP verification requirements.4U.S. Department of the Treasury. Report to Congress on Innovative Technologies to Counter Illicit Finance Involving Digital Assets Treasury has signaled it plans to issue guidance on how verifiable digital credentials can substitute for physical identity documents, referencing NIST’s Digital Identity Guidelines (SP 800-63-4) as the relevant standard.
Notice to the Customer
Before opening the account, the institution must give the customer adequate notice that it will be asking for information to verify identity. The notice can be oral, electronic, posted on a lobby sign, or printed on the account application.2eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks The point is disclosure. The customer does not get to opt out of identification.
How Long Records Are Kept, and How They’re Protected
Institutions must retain a copy of the identifying information collected and a record of the verification methods used, including any documents examined or a description of the non-documentary steps taken. Those records must be kept for at least five years after the account closes.2eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks That window gives regulators and law enforcement time to reconstruct account activity if questions come up later.
Storing that much personal data triggers a parallel set of duties under the Gramm-Leach-Bliley Act. The FTC’s Safeguards Rule requires covered institutions to maintain an information security program with administrative, technical, and physical protections around customer data.5Federal Trade Commission. Gramm-Leach-Bliley Act In practice, the two obligations work together: you must keep the records, and you must protect them.
Business Accounts and Beneficial Owners
When a legal entity such as a corporation, LLC, or partnership opens an account, the institution cannot stop at identifying the entity. Under FinCEN’s Customer Due Diligence (CDD) rule, it must also identify the real people behind that entity. Specifically, it has to collect and verify the identity of every individual who owns 25 percent or more of the entity’s equity interests, plus at least one individual with significant control over the entity, such as a CEO, CFO, or managing member.6eCFR. 31 CFR 1010.230 – Beneficial Ownership Requirements for Legal Entity Customers
The same four data points apply to each beneficial owner: name, date of birth, address, and a Social Security number or equivalent government ID. The person opening the account on the entity’s behalf certifies the accuracy of the information. If no individual owns 25 percent or more, the institution still has to identify one person who controls or directs the entity. There is no scenario where a legal entity opens an account and no human being is identified behind it.7FinCEN. CDD Final Rule
A separate program, the Corporate Transparency Act, originally required most U.S. companies to report beneficial ownership directly to FinCEN. In March 2025, FinCEN issued an interim final rule removing that requirement for all U.S.-created entities and their beneficial owners; only companies formed under foreign law that have registered to do business in a U.S. state remain subject to that direct filing obligation.8FinCEN.gov. FinCEN Removes Beneficial Ownership Reporting Requirements for U.S. Companies and U.S. Persons, Sets New Deadlines for Foreign Companies The CDD rule that requires banks to collect beneficial ownership at account opening is unaffected and remains fully in effect.
What Happens After the Account Is Open
KYC is not a one-time gate. Covered institutions must maintain risk-based procedures for monitoring transactions on an ongoing basis, watching for patterns that deviate from a customer’s expected behavior. Higher-risk relationships call for enhanced due diligence, with the depth of review proportionate to the actual risk the relationship presents rather than a uniform template applied to everyone.9National Credit Union Administration. Joint Statement on Bank Secrecy Act Due Diligence Requirements for Customers Who May Be Considered Politically Exposed Persons
Suspicious Activity Reports
When an institution detects activity that may involve illegal funds, structuring to evade reporting requirements, or transactions with no apparent lawful purpose, it must file a Suspicious Activity Report (SAR) with FinCEN. The filing deadline is 30 calendar days from initial detection. If the institution cannot identify a suspect within that window, it gets an additional 30 days, but never more than 60 days from initial detection.10eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions
Dollar thresholds vary by institution type and circumstance:
- Banks with an identified suspect must file for suspicious transactions of $5,000 or more.10eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions
- Banks without an identified suspect must file at $25,000 or more.11Financial Crimes Enforcement Network. FinCEN Suspicious Activity Report Electronic Filing Instructions
- Insider abuse must be reported regardless of dollar amount.
- Money services businesses file at $2,000 or more.12FinCEN.gov. MSB Threshold – $2,000 or More
Federal law shields institutions and their employees from civil liability for filing a SAR in good faith. The institution cannot be sued by the person named in the report, and it is prohibited from telling that person a SAR was filed.13Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority
Currency Transaction Reports
Institutions must file a Currency Transaction Report (CTR) for any transaction in currency exceeding $10,000 in a single business day. Unlike a SAR, a CTR does not require suspicion. It is a mechanical threshold applied to cash deposits, withdrawals, and exchanges. Structuring transactions to stay just below $10,000 to avoid the CTR is itself a federal crime and a common trigger for SAR filings.
Sanctions Screening
Institutions also screen customers and transactions against government sanctions lists, most prominently the Specially Designated Nationals and Blocked Persons (SDN) List maintained by the Treasury Department’s Office of Foreign Assets Control.14Office of Foreign Assets Control. Sanctions List Service A match on the SDN list obligates the institution to block the assets immediately and file a blocking report within ten business days.15eCFR. 31 CFR 501.603 – Reports of Blocked, Unblocked, or Transferred Property
When Re-Verification Isn’t Required
Not every interaction triggers a fresh CIP check. The most common exemption is for existing customers. If someone already has an account with the institution and the institution has a reasonable belief that it knows the person’s true identity, it does not need to re-verify when that customer opens an additional account, renews a loan, or rolls over a certificate of deposit.3FinCEN. Ten of the Most Common Questions About the Final CIP Rule
The exemption has hard edges. The person must currently hold an account at the time the new one opens; someone who paid off a loan and closed their only account a year ago does not qualify. And an account at an affiliate of the bank does not count as an existing account with the bank itself.
Penalties for Getting It Wrong
Consequences for failing to meet KYC and anti-money laundering requirements run on two tracks: civil penalties from FinCEN and criminal prosecution by the Department of Justice.
Civil penalties turn on whether a violation was willful or negligent. Under the statute, a willful BSA violation, which includes failing to maintain a CIP, failing to file SARs, or failing to implement an adequate anti-money laundering program, carries a penalty of up to the greater of the amount involved in the transaction (capped at $100,000) or $25,000 per violation, with each day and each branch counting as a separate violation.16Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties
Inflation adjustments have pushed the current ranges much higher. As of January 2025, FinCEN’s inflation-adjusted penalties for willful BSA violations run from $71,545 to $286,184 per violation. Negligent violations carry a penalty of up to $1,430 each, with a pattern of negligence raising the ceiling to $111,308. Violations of certain due diligence and special measures requirements can reach $1,776,364 per violation.17Federal Register. Inflation Adjustment of Civil Monetary Penalties
On the criminal side, individuals who conduct financial transactions involving proceeds of illegal activity, with intent to promote the underlying crime, conceal the proceeds, or evade a reporting requirement, face up to 20 years in prison and a fine of up to $500,000 or twice the value of the property involved, whichever is greater.18Office of the Law Revision Counsel. 18 U.S. Code 1956 – Laundering of Monetary Instruments When a financial institution or one of its officers, directors, or employees is convicted, the Attorney General must notify the institution’s regulatory agency, which typically triggers additional enforcement action.