KYC in Commercial Banking: Documents, Beneficial Owners, and EDD

Know Your Customer rules in commercial banking require every bank to verify your business’s legal existence, identify the humans who own or control it, screen everyone against federal sanctions lists, and keep watching the account after it opens. Two federal rules drive the process: the Customer Identification Program at 31 C.F.R. § 1020.220, which sets the minimum data a bank collects when you open an account,¹ and the Customer Due Diligence rule at 31 C.F.R. § 1010.230, which requires the bank to look past the entity and identify the real people behind it.² Both sit under the broader anti-money laundering program mandate at 31 U.S.C. § 5318(h).³ Understanding what the bank needs before you walk in the door will shave weeks off onboarding.

Documents the Bank Will Ask For

Start with proof that your business legally exists. Corporations bring Articles of Incorporation, LLCs bring Articles of Organization, and partnerships bring their partnership agreement. These come from the secretary of state where the business was formed, and many banks verify the documents you hand over against the state registry directly. If a name, address, or officer listed on your paperwork doesn’t match state records, expect the file to stall until you reconcile them.

You also need your federal Employer Identification Number. The IRS issues EINs for tax purposes, and even businesses that don’t strictly need one for taxes typically get one because banks require it to open an account.⁴ Any industry-specific licenses or permits should be current and ready to produce.

The Business Profile

Beyond formation documents, the bank hands you a Business Profile or Customer Fact Sheet. This is where most applicants slow themselves down. The bank wants concrete detail: what your company does day to day, where it operates, who its major customers and suppliers are, how much cash it handles monthly, and whether it sends or receives international wire transfers. Those answers become the baseline of “expected activity” the compliance team compares against every transaction from that point forward.

Vague or inconsistent answers are the fastest way to trigger follow-up requests. Tell the bank monthly deposits will run around $50,000 and then deposit $500,000 in the first quarter, and you will get a call from compliance. The closer your profile matches how the business actually operates, the smoother every later interaction goes.

Who Counts as a Beneficial Owner

Under the CDD rule, the bank must verify the identity of each individual who directly or indirectly owns 25 percent or more of the equity in the legal entity, plus at least one individual with significant management responsibility — a CEO, managing member, or general partner — even if that person owns no equity.² For each of those people, the bank collects:

Full legal name
Date of birth
Residential or business street address
A Social Security number for U.S. persons, or a passport number and country of issuance for non-U.S. persons (an alien identification card or other government-issued photo ID may substitute for a passport)²

Whoever opens the account on the company’s behalf must certify the information is accurate, either by signing the standard Certification of Beneficial Ownership form in Appendix A to the regulation or by providing the same data through another method with a written attestation.² Deliberately providing false ownership information can end the relationship and expose both the individual and the company to legal consequences.

Exempt Entities

Not every legal entity triggers the beneficial ownership certification. The rule exempts categories where ownership information is already available through other regulatory channels: publicly traded companies registered under the Securities Exchange Act, banks and other financial institutions regulated by a federal functional regulator, SEC-registered investment companies and advisers, state-regulated insurance companies, bank holding companies, and registered public accounting firms, among others.² If your company qualifies, the bank still verifies the entity itself through its CIP, but skips the beneficial ownership form.

Layered Ownership

When a company is owned by another company, which is owned by a third entity, the bank is expected to look through the layers until it reaches a natural person holding 25 percent or more of ultimate equity. This is where onboarding gets slow. Nominee shareholders, pass-through entities without real operations, and chains of shell companies are all things compliance teams are trained to flag. If your structure is multilayered, walk in with an organizational chart tracing ownership percentages from the top down to individuals. Transparent presentation is what gets you cleared quickly.

Sanctions Screening and CIP Verification

Once your file is assembled, the bank runs the business and every identified owner against the Office of Foreign Assets Control’s Specially Designated Nationals list. OFAC expects that screening to be completed before the account opens, or in some cases during nightly processing shortly after, with no transactions beyond the initial deposit until the check clears. Completing a transaction before the analysis is finished exposes the bank to liability.⁵⁶

Separately, the compliance team verifies your CIP data against independent sources: state business registries, identification number databases, and internal consistency checks between your profile and your documents. The regulation requires the bank to form a “reasonable belief” that it knows the true identity of the customer, and if it cannot, its procedures must include declining to open the account.¹

Timelines vary widely. A straightforward business with a simple ownership structure and clean documentation can sometimes open an account within days. Companies with multilayered ownership, international operations, or high-risk industry classifications wait weeks or longer while enhanced review runs. Expect at least one round of follow-up questions; missing or unclear information is the single most common reason files stall.

Enhanced Due Diligence for Higher-Risk Businesses

Banks assign every commercial relationship a risk rating, and higher-risk clients face enhanced due diligence. That means more documentation up front and more frequent monitoring later. Industries commonly rated higher risk include money service businesses, cash-intensive operations like restaurants and convenience stores, businesses with heavy international transaction volume, and sectors where anonymity or complex ownership is common. There is no single federal list of high-risk industries, and each bank sets its own categories, but the pattern is consistent across the industry.

For a higher-risk client, the bank may ask for:

Documentation showing the source of the business’s funds and the owners’ wealth
Audited or reviewed financial statements
Detailed operational descriptions covering total sales volume, currency transaction volume, and major customers and suppliers
Negative media screening for adverse news about the business or its principals⁷

Politically exposed persons draw a particular level of attention. The Bank Secrecy Act doesn’t formally define the term, but the industry uses “PEP” to describe foreign individuals entrusted with prominent public functions, along with their immediate family members and close associates. No rule automatically classifies a PEP as high risk; banks evaluate the relationship based on transaction patterns, geography, and the potential for access to funds derived from corruption.⁸ If any beneficial owner qualifies as a PEP, expect more detailed questioning and longer review.

What Happens After the Account Opens

KYC doesn’t end at account opening. Every commercial bank runs ongoing transaction monitoring, and when something looks off, the bank must act quietly and quickly. Under 31 C.F.R. § 1020.320, a bank files a Suspicious Activity Report with FinCEN whenever a transaction involves at least $5,000 and the bank suspects a connection to illegal activity, an attempt to evade reporting requirements, or a transaction with no apparent lawful purpose.⁹

The part that surprises most business owners: the bank is legally prohibited from telling you a SAR has been filed. No notification, no warning, no hint. If your activity deviates significantly from the baseline you provided at onboarding, compliance is evaluating it behind the scenes, and you have no chance to explain first. Multiple SARs on a single account generally lead to closure. Regulators expect banks to exit relationships that generate repeated filings, and when a bank closes an account for compliance reasons, SAR confidentiality rules limit how much it can explain to you.

This is why the business profile you fill out at the start matters so much. It defines what “normal” looks like on your account. Dramatic, unexplained shifts from that baseline are what feed the process.

Periodic Reviews and Events You Should Report

Banks refresh their commercial client files on a recurring schedule tied to risk rating. Higher-risk relationships may be reviewed annually; lower-risk clients might go two to three years between formal reviews. The bank checks whether licenses are current, addresses are updated, beneficial ownership hasn’t shifted, and transaction patterns still match the original profile.

Some events should prompt you to call the bank without waiting for the next review:

A new majority owner, buyout, or restructuring that shifts who holds 25 percent or more
Relocating operations or reincorporating in a different state

li>Pivoting into a new line of business, especially one the bank considers higher risk

A sustained increase in deposits, wire transfers, or cash handling that doesn’t match your historical pattern

Discovering a material change during a routine review, rather than hearing it from you, is exactly the gap that prompts compliance to escalate a file. Volunteering the update protects the relationship.

Bank CDD vs. the Corporate Transparency Act

The Corporate Transparency Act, enacted in 2021, created a separate federal beneficial ownership reporting requirement administered by FinCEN. As of March 26, 2025, FinCEN issued an interim final rule exempting all entities created in the United States from the BOI reporting requirement. Only foreign entities registered to do business in a U.S. state or tribal jurisdiction now file.¹⁰

That exemption does not change what your bank requires. The CDD rule at 31 C.F.R. § 1010.230 operates independently of the CTA. Even though domestic companies no longer file BOI reports with FinCEN, banks still collect and verify beneficial ownership information for every legal entity customer at account opening.² The two regimes serve different purposes, and only the bank’s version affects your ability to open an account.

If you are a foreign entity that does qualify as a reporting company under the revised CTA, BOI reports are due within 30 calendar days of registering to do business in the United States. Foreign entities registered before March 26, 2025, faced an April 25, 2025, deadline. Willful failure to file or providing false information carries potential criminal penalties of up to $10,000 in fines and two years of imprisonment.¹⁰

If Your Application Is Denied

A bank can decline to open your account if it can’t verify your identity, if OFAC screening returns a match, or if the compliance team concludes the relationship poses unacceptable risk. The CIP rule requires banks to have procedures for exactly this scenario when they cannot form a reasonable belief about a customer’s true identity.¹

The most common reasons for denial are mundane: a mismatch between IRS EIN records and the application, an expired business license, or a name discrepancy between the responsible party listed with the IRS and the formation documents. Fix the documentation and reapply.

If the denial relied on information from a consumer reporting agency like ChexSystems, the bank must send an adverse action notice under the Fair Credit Reporting Act. That notice tells you which agency supplied the information and gives you 60 days to request a free copy of the report. If you find errors, dispute them directly with the reporting agency, which has 30 days to investigate. For businesses that keep hitting walls at traditional banks, credit unions, online banks, and second-chance account programs offer alternatives while you resolve the underlying issue.

Why the Bank Is So Thorough

The compliance burden on banks is heavy, and the penalties for getting KYC wrong fall on the institution. Willful failure to maintain an anti-money laundering program under 31 U.S.C. § 5318(h) triggers civil penalties under the Bank Secrecy Act framework, adjusted annually for inflation.¹¹ OFAC sanctions violations can reach $250,000 per violation or twice the transaction amount, whichever is greater, with separate criminal exposure for BSA violations.⁵ From the bank’s perspective, asking for one more document is always cheaper than an enforcement action. Understanding that calculus makes the process less frustrating from the business side, and preparing your file with it in mind is what gets your account open.

1
eCFR. 31 CFR 1020.220 – Customer Identification Program
2
eCFR. 31 CFR 1010.230 – Beneficial Ownership Requirements for Legal Entity Customers
3
Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority
4
Internal Revenue Service. Employer Identification Number
5
FFIEC BSA/AML InfoBase. Office of Foreign Assets Control
6
Office of Foreign Assets Control. Additional Questions from Financial Institutions
7
FFIEC BSA/AML InfoBase. Assessing Compliance with BSA Regulatory Requirements
8
FFIEC BSA/AML InfoBase. Risks Associated with Money Laundering and Terrorist Financing – Politically Exposed Persons
9
Federal Reserve. Section 1020.320 – Reports by Banks of Suspicious Transactions
10
FinCEN.gov. Beneficial Ownership Information Reporting
11
Internal Revenue Service. 4.26.7 Bank Secrecy Act Penalties