There is no consumer-issued “KYC certificate” under U.S. law, so if a bank, brokerage, or exchange has asked you to complete KYC, what they actually need is a set of KYC verification documents that prove who you are and where you live. Know Your Customer is a process, not a certificate: financial institutions perform the checks themselves, using documents you provide, to satisfy customer identification rules that sit under the Bank Secrecy Act.1FinCEN.gov. The Bank Secrecy Act Nothing gets issued back to you at the end. The account simply opens, or it doesn’t.
What You Need to Submit as an Individual
Federal regulations require an institution to collect four pieces of information from every individual opening an account: your name, date of birth, address, and an identification number.2eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks In practice, that translates into two documents on your end plus a number you type in.
The photo ID does most of the work. A U.S. passport, a state-issued driver’s license, or a state ID card all satisfy the requirement and let the institution verify your name, date of birth, and photograph in one step. The identification number is your Social Security Number if you’re a U.S. person, or a passport number and country of issuance if you’re not.2eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks That number is what gets cross-referenced against tax records and watchlist databases.
Address verification usually means a recent utility bill, bank statement, or similar document showing your name at a residential or business street address. A P.O. box generally will not work for an individual, because the regulation specifies a residential or business street address.3eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks Military personnel are the exception and may use an APO or FPO box number. Most institutions want the address document dated within the last 90 days, and the name on it must match your photo ID exactly.
Small details cause big delays. “Robert” on the license and “Bob” on the utility bill can stall the whole submission. A transposed digit in your Social Security Number gets flagged as soon as it hits the federal databases. If your legal name changed through marriage or a court order, bring the supporting document so the reviewer can reconcile the two names in one pass.
What You Need to Submit as a Business
Opening an account for a company, partnership, or trust adds a layer. Along with the entity’s legal name, taxpayer identification number (usually an EIN), and principal business address, the institution has to identify the beneficial owners: the real people who ultimately own or control the entity.4FinCEN.gov. CDD Rule FAQs This comes from FinCEN’s Customer Due Diligence Rule and exists to keep shell companies from hiding the individuals behind them.
Expect to hand over formation documents such as articles of incorporation or a certificate of organization, plus any operating agreement or partnership document that shows the ownership structure. Each beneficial owner holding 25 percent or more, along with at least one person with significant management control, then goes through the same individual identification steps: name, date of birth, address, and identification number. Institutions can set their internal standards above these minimums, so some will ask for more.4FinCEN.gov. CDD Rule FAQs
How the Submission and Review Works
Most institutions handle KYC through a digital portal where you upload scans or photos of your documents. Many also require a liveness check, a short video or selfie captured in real time, so the compliance system can confirm that the person submitting the ID is the person on it. Once everything is in, the institution’s team or its automated systems cross-reference your information against government databases, sanctions lists, and fraud watchlists.
Turnaround varies. A straightforward individual account at a major bank may clear in a few hours. Cryptocurrency exchanges sometimes take several days, especially during busy periods. Business entities take longer because of the ownership checks. If the institution cannot verify your identity through its normal procedures, the regulation requires it to have a plan for the situation, which can mean declining to open the account, allowing limited activity while verification continues, or closing the account if verification ultimately fails.3eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
KYC is not one-and-done. Institutions must conduct ongoing monitoring and update customer information on a risk basis for the life of the account.5FinCEN.gov. CDD Final Rule You may be asked to re-verify later, especially if your transaction patterns shift or the institution’s risk assessment changes.
Why Submissions Get Rejected
Document quality causes more rejections than most people expect. Blurry photos, glare on laminated cards, cropped edges that cut off a document number, and low-resolution scans all trigger automatic failures. If you’re photographing an ID with your phone, lay it on a flat, dark surface with even lighting and check that every edge and every character is legible before you submit.
Name mismatches are the other big one. Your name must match across the ID, the address proof, and what you type into the application. A missing middle initial, an abbreviated first name, or a maiden surname on one document and a married name on another can cause a rejection. Address discrepancies work the same way: “Apt 4B” on the utility bill and “Unit 4B” on the ID can be enough for an automated system to flag the file.
Expired documents get rejected outright, so confirm your passport or driver’s license is current before you start. Address documents older than 90 days are typically considered stale. And screenshots instead of actual scans or photos often fail, because the image metadata looks altered and trips the fraud filters.
Which Institutions Ask You for This
Effectively any institution that touches your money.
Banks and credit unions are required by federal law to maintain a written Customer Identification Program as part of their anti-money laundering compliance.6Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority You cannot open a checking, savings, or business account without going through it, and the implementing regulation spells out what has to be collected and how it must be verified.2eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
Broker-dealers and investment firms operate under the same customer identification framework. A broker-dealer must obtain your name, date of birth, address, and identification number before opening an account, and must have risk-based procedures for verifying that information; if it cannot form a reasonable belief about your identity, it has to have procedures for declining or closing the account.7eCFR. 31 CFR 1023.220 – Customer Identification Programs for Broker-Dealers
Cryptocurrency exchanges are classified by FinCEN as money services businesses and are subject to the same BSA registration, recordkeeping, and reporting obligations as traditional financial institutions.8FinCEN.gov. FinCEN Notice FIN-2025-NTC1 That is why major crypto platforms require an ID upload and identity verification before you can trade or withdraw. A platform that lets you transact without ever asking for name, date of birth, and address is operating outside the rules.
One boundary worth noting: FinCEN finalized a rule in 2024 that would require certain professionals to report non-financed transfers of residential property to legal entities and trusts, targeting all-cash shell-company purchases.9Federal Register. Anti-Money Laundering Regulations for Residential Real Estate Transfers As of early 2026, a federal court order has paused enforcement, so reporting persons are not currently required to file those reports while the order remains in effect.10FinCEN.gov. Residential Real Estate Rule
Extra ID Checks on Cash Transactions Over $10,000
Any cash transaction over $10,000 at a financial institution, whether a deposit, withdrawal, or currency exchange, triggers a Currency Transaction Report to FinCEN.1FinCEN.gov. The Bank Secrecy Act That is separate from the KYC you did to open the account, and the bank must verify and record your name, address, and identification number for the report even if you’re already a customer.11FFIEC BSA/AML InfoBase. Currency Transaction Reporting Multiple smaller transactions in a single day are aggregated toward the threshold, so structuring cash to stay under $10,000 is both illegal and easily detected.
When You’ll Face Enhanced Due Diligence
Standard KYC is the baseline. Certain relationships require enhanced due diligence, which the statute specifically calls for on private banking accounts and correspondent accounts involving foreign persons, with policies designed to detect and report potential money laundering.6Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority
In practice, enhanced due diligence tends to apply to:
- Politically exposed persons, meaning current or former senior government officials and their close associates.
- Entities with layered or offshore ownership structures, or beneficial ownership details that are hard to pin down.
- Customers or transactions connected to jurisdictions with weak anti-money laundering controls.
- Unusual transaction patterns, such as sudden large deposits, activity that doesn’t match the customer’s stated business, or adverse media reports involving financial crimes.
If you fall into one of these categories, expect requests for more detailed documentation, including evidence of where your wealth comes from and a closer look at your transaction history. Accounts flagged this way also receive closer ongoing monitoring.
How Your KYC Information Is Protected
Handing a copy of your passport and Social Security Number to a financial institution raises reasonable privacy questions. The Gramm-Leach-Bliley Act requires financial institutions to explain their information-sharing practices, give customers the right to opt out of certain third-party sharing, and maintain a written information security program with administrative, technical, and physical safeguards.12Federal Trade Commission. Gramm-Leach-Bliley Act
The FTC’s Safeguards Rule adds specific security requirements on top of that and extends the obligation to affiliates and service providers.13Federal Trade Commission. Safeguards Rule In practice, your KYC documents should travel over encrypted connections, sit encrypted at rest, be accessible only to authorized personnel, and be covered by an incident response plan. If you’re being asked to upload documents to a site that doesn’t use an encrypted connection or looks unprofessional, treat that as a signal and stop.