If your bank has told you that you fall into its high-risk category, the KYC requirements for high-risk customers go well beyond the name, date of birth, and ID number a typical account holder provides. You should expect to document how you built your net worth, where the specific money entering the account came from, who ultimately owns any business entity on the paperwork, and to keep providing updates for as long as the account stays open. The legal spine of all of this is the Bank Secrecy Act, which requires every bank to run a written anti-money laundering program with risk-based customer due diligence.1eCFR. 31 CFR 1020.210 – Anti-Money Laundering Program Requirements for Banks
Why the Bank Labeled You High Risk
Banks don’t assign this label arbitrarily. Federal examiners expect them to weigh customers across several risk dimensions and apply enhanced scrutiny where the risk of money laundering or terrorism financing is elevated. Three categories account for most designations.
Politically Exposed Persons
A Politically Exposed Person is someone who holds or recently held a prominent public role: a head of state, a senior government official, a military leader, or a top executive at a state-owned enterprise. Banks extend the classification to immediate family members and known close associates, because the corruption risk that attaches to the position doesn’t stop at the officeholder. A defense minister’s spouse opening a personal brokerage account triggers the same enhanced review the minister would.
Geographic Ties
Where you live or do business matters. The Financial Action Task Force publishes two lists of countries with weak anti-money laundering protections: a “grey list” of jurisdictions under increased monitoring, and a “black list” of jurisdictions subject to a call for action.2Financial Action Task Force. High-Risk and Other Monitored Jurisdictions If you reside in, or regularly transact with, a listed country, the bank will apply enhanced scrutiny. For black-list countries, FATF calls on member nations to apply countermeasures, which in practice can make banking relationships very difficult to establish.
Cash-Intensive Business
Businesses that process large volumes of physical cash present a tracking problem. Money services businesses, casinos, convenience stores, car washes, restaurants, and private ATM operators all generate revenue that is hard to verify independently. Compliance departments treat them as high risk by default, and the bank’s task is to confirm the cash flowing through the account matches what the stated business model would produce.
What Enhanced Due Diligence Asks You to Provide
Enhanced Due Diligence (EDD) is essentially a financial biography assembled for the bank’s compliance team. Two pieces do most of the work.
Beneficial Ownership on Business Accounts
If the account is for a legal entity, the bank must identify every individual who owns 25% or more of the company’s equity, plus at least one person with significant day-to-day control, such as a CEO or managing member.3eCFR. 31 CFR 1010.230 – Beneficial Ownership Requirements for Legal Entity Customers This obligation comes from the Customer Due Diligence Rule, not the Corporate Transparency Act. The CTA’s reporting obligations to FinCEN were largely rolled back in 2025 for U.S.-created companies, but banks still independently collect beneficial ownership information as part of their own compliance programs.4FinCEN.gov. FinCEN Removes Beneficial Ownership Reporting Requirements for US Companies and US Persons
Each identified beneficial owner will need to provide a government-issued photo ID and a Social Security number or Taxpayer Identification Number. The entity itself will usually need to submit formation documents such as articles of incorporation, and a certificate of good standing from the relevant secretary of state. Foreign nationals without an SSN can typically satisfy the tax identification requirement with IRS Form W-8BEN, which certifies foreign status for withholding purposes.5Internal Revenue Service. About Form W-8 BEN, Certificate of Foreign Status of Beneficial Owner for United States Tax Withholding and Reporting (Individuals)
Source of Wealth and Source of Funds
These sound similar but answer different questions. Source of wealth is how you accumulated your net worth over time: a career in medicine, a family inheritance, real estate investments, or the sale of a business. Source of funds is where the specific money entering this account came from right now. Banks want both narratives, in writing, backed by documentation. For wealth, that might mean historical tax returns or closing statements from a property sale. For funds, it might be a wire confirmation, a brokerage statement showing a liquidation, or a trust distribution letter. If you’re opening a business account, prepare two to three years of audited financial statements or tax returns. The more organized this package is before you walk in, the faster it moves.
How the Bank Verifies What You Submit
Collecting the documents is the easy part. Compliance officers then cross-reference every beneficial owner’s name against the OFAC sanctions lists and screen names through commercial risk databases.6U.S. Department of the Treasury. Sanctions List Search Any discrepancy between what you disclosed and what shows up in a public registry has to be resolved before the account can move forward.
Your financial history gets checked the same way. If you claim wealth from a property sale, the bank will look for land records or public sales data. If your business claims a certain revenue level, the bank checks whether transaction volumes in existing accounts are consistent with that figure. The goal is simple: confirm the money actually came from where you say it came from.
High-risk approvals generally require sign-off from senior management or a dedicated compliance committee, not just your relationship manager. Most institutions assign a numerical risk score during onboarding that then dictates how intense the ongoing oversight will be.
What Ongoing Monitoring Looks Like
Approval isn’t the end. Federal rules require banks to conduct ongoing monitoring to identify suspicious transactions and to update customer information on a risk basis.1eCFR. 31 CFR 1020.210 – Anti-Money Laundering Program Requirements for Banks No regulation mandates a specific review cycle, but most banks review high-risk accounts annually, while lower-risk accounts may go two or three years between reviews. Each review typically means updated financials, re-verified ownership, and a fresh risk score. If your business model changes or you start operating in new jurisdictions, the bank may pull a review forward outside the normal cycle.
What Sets Off an Alert
Automated monitoring systems compare your activity against the baseline the bank set at onboarding. Common triggers include sudden spikes in wire volume, frequent transfers to or from high-risk countries, and transactions that appear designed to stay just below the $10,000 threshold that produces a Currency Transaction Report.7FinCEN. The Bank Secrecy Act Examiners specifically watch for structuring: multiple deposits just under $10,000 across different branches, or consolidating small deposits into a master account before wiring the funds overseas.8FFIEC BSA/AML InfoBase. Appendix F – Money Laundering and Terrorist Financing Red Flags
Structuring is a federal crime in its own right, even if the underlying money is entirely legitimate. Breaking a $30,000 deposit into four $7,500 deposits to avoid the reporting threshold violates 31 U.S.C. § 5324 regardless of where the money came from.9Office of the Law Revision Counsel. 31 USC 5324 – Structuring Transactions to Evade Reporting Requirement Prohibited If you have a legitimate large cash deposit, let the bank file the report. Trying to avoid the paperwork creates a far bigger problem than the paperwork itself.
Suspicious Activity Reports
When an alert flags activity that looks unusual, the compliance team investigates. If it concludes the transaction has no apparent business or lawful purpose, the bank must file a Suspicious Activity Report with FinCEN.10Federal Financial Institutions Examination Council. FFIEC BSA/AML Assessing Compliance with BSA Regulatory Requirements – Suspicious Activity Reporting You will never be told a SAR has been filed on your account. Banks are legally prohibited from disclosing that fact.
If You Think You’ve Been Flagged in Error
Commercial risk databases such as LexisNexis and World-Check are not infallible. Names get confused, outdated records linger, and false positives are common, especially for people with names similar to sanctioned individuals. If you’ve been denied an account or hit with unusual restrictions and suspect the problem is inaccurate data in a screening database, you have rights under the Fair Credit Reporting Act.
LexisNexis Risk Solutions, for example, is classified as a consumer reporting agency under the FCRA. You can request a copy of your consumer disclosure report to see what data the system holds on you. If you find errors, you can file a formal dispute, and the agency must investigate and correct or delete inaccurate information, typically within 30 days.11LexisNexis Risk Solutions. Your FCRA Rights If you received an adverse action letter, it should identify the database used, which gives you a starting point.
Don’t Try to Simplify the Story by Leaving Things Out
Faced with the paperwork, some customers are tempted to fudge details or omit inconvenient facts. This is a serious mistake. Knowingly providing false information to a financial institution on matters within federal jurisdiction is a crime under 18 U.S.C. § 1001, carrying up to five years in prison, or up to eight years if the false statement involves terrorism.12Office of the Law Revision Counsel. 18 USC 1001 – Statements or Entries Generally
Beyond the criminal exposure, false KYC information virtually guarantees account closure once the bank discovers it. Banks share SAR data with law enforcement through FinCEN, and a SAR filed on false identity documents can trigger investigations far more invasive than the compliance review you were trying to avoid. If your situation is complicated but legitimate, explain it with documentation rather than paper over it.
The Bank Can Still Decide to Close the Account
The uncomfortable reality of high-risk classification is that some banks will decide the compliance cost isn’t worth the relationship. When a bank ends an account because the customer presents too much regulatory risk, the industry calls it “de-risking.” It’s particularly common for money services businesses, customers with ties to FATF-listed countries, and nonprofits operating in conflict zones.
No federal law requires a bank to keep your account open. If the bank decides the risk is unmanageable, it can close the account, usually with written notice and a short window to move your funds. If you’ve been de-risked, your options are limited: try other institutions with a higher appetite for your risk category, look at credit unions, or work with a compliance consultant to strengthen your documentation before approaching a new bank. Being upfront about why a previous institution closed the account will serve you better than trying to hide it, since compliance databases track these events.