Know Your Customer (KYC) bank requirements are the rules that force a bank to verify who you are, understand what you plan to do with your account, and keep watching that account for as long as it’s open. When you walk into a branch or fill out an online application, the bank is legally obligated under the Bank Secrecy Act and its implementing regulations to collect specific pieces of identifying information, evaluate the risk your account might pose, and monitor your activity going forward.1Financial Crimes Enforcement Network. The Bank Secrecy Act These obligations flow from the Financial Crimes Enforcement Network (FinCEN), the Treasury bureau that writes and enforces the rules.2Financial Crimes Enforcement Network. Enforcement Actions
What the Bank Must Collect to Open Your Account
The first stage of KYC is the Customer Identification Program (CIP). Before a bank opens any account for you, federal regulations require it to collect four specific pieces of information:
- Your full legal name.
- Your date of birth (individuals only, not business entities).
- A residential or business street address. If you don’t have one, a military APO/FPO box or the address of a next-of-kin or other contact person is acceptable.
- An identification number. For U.S. persons, this means a taxpayer identification number, usually your Social Security Number. For non-U.S. persons, the bank can accept a taxpayer identification number, a passport number with country of issuance, an alien identification card number, or the number and country of issuance of another government-issued document showing nationality or residence.3eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
After collecting that information, the bank verifies it. The most common method is a government-issued photo ID such as a passport, driver’s license, or state-issued identification card. The document has to be current and legible. Many institutions also ask for a separate proof of address, such as a utility bill, lease, or bank statement dated within the last 90 days, especially when the ID shows a different address than the one on the application.
If You Don’t Have a Social Security Number
You do not need a Social Security Number to open a U.S. bank account. The CIP regulation explicitly allows alternatives for non-U.S. persons, and in practice many banks accept an Individual Taxpayer Identification Number (ITIN), a passport, or a consular identification card.3eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks If you’re a non-citizen or non-resident, you may also need to complete an IRS Form W-8 at account opening. The specific documents accepted vary by institution, so call ahead before your visit.
How the Bank Assesses Your Risk
Customer Due Diligence (CDD) goes beyond checking your ID. The bank gathers information about your occupation, the purpose of the account, and the types and volumes of transactions you expect to make. From that, it builds a risk profile and assigns a rating, usually low, medium, or high.
A salaried employee opening a personal checking account with direct deposit lands in the low-risk bucket. Someone conducting frequent international wire transfers or running a cash-intensive business gets a higher score. Your rating dictates how closely the bank watches your account and how often it refreshes your information. The bank has little discretion here. FinCEN requires these assessments, and examiners check whether banks are actually performing them.
Extra Requirements for Business Accounts
When a legal entity opens an account, the paperwork expands. FinCEN’s CDD rule requires banks to identify and verify the beneficial owners of the entity: any individual who owns 25 percent or more of the equity, plus at least one individual who exercises significant control, such as a CEO, CFO, or managing member.4eCFR. 31 CFR 1010.230 – Beneficial Ownership Requirements for Legal Entity Customers The bank collects names, dates of birth, addresses, and identification numbers for each qualifying individual, along with the entity’s Employer Identification Number and formation documents.
This is separate from Corporate Transparency Act reporting. As of March 2025, FinCEN exempted all U.S.-created entities from that direct reporting obligation, though foreign entities registered to do business in the United States still file.5Financial Crimes Enforcement Network. Beneficial Ownership Information Reporting Regardless of the CTA’s status, the bank’s own obligation to verify beneficial ownership at account opening remains fully in effect under 31 CFR 1010.230.6FinCEN. Information on Complying with the Customer Due Diligence (CDD) Final Rule
Ongoing Monitoring and Suspicious Activity Reports
KYC does not end once your account is open. Banks continuously monitor transactions against the risk profile built at onboarding. Automated systems flag activity outside your expected pattern: a sudden spike in transaction volume, a large incoming wire from an unusual country, or a series of deposits just below the reporting threshold (a tactic called structuring).
When a flag triggers an internal investigation and the compliance team decides the activity looks suspicious, the bank must file a Suspicious Activity Report (SAR) with FinCEN. The deadline is 30 calendar days from the date the bank first detects facts suggesting a reportable transaction. If no suspect has been identified by then, the bank gets an additional 30 days to try to identify one, but the report can never be delayed beyond 60 days after initial detection.7eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions For situations needing immediate attention, such as an active money laundering scheme, the bank must also notify law enforcement by telephone.
Banks are prohibited from telling you that a SAR has been filed about your account. This “tipping off” prohibition exists because SARs are intelligence tools for law enforcement. You will never receive a notice that one was filed, and asking the bank directly won’t get you an answer.
Enhanced Due Diligence for Higher-Risk Accounts
Enhanced Due Diligence (EDD) is a more intensive version of CDD, reserved for customers or situations where the risk of money laundering or terrorist financing is elevated. EDD means more documentation, deeper investigation into the source of your money, and more frequent reviews. Two categories trigger it more than any others: politically exposed persons and connections to high-risk countries.
Politically Exposed Persons
A Politically Exposed Person (PEP) is someone who holds or has held a prominent government role, such as a head of state, senior legislator, military commander, or executive of a state-owned enterprise. The Financial Action Task Force (FATF) expanded its mandatory PEP requirements in 2012 to cover both foreign and domestic officials, along with leaders of international organizations.8FATF. Politically Exposed Persons (Recommendations 12 and 22) Close family members and known associates of PEPs face the same heightened scrutiny, because corruption often flows through people adjacent to power rather than the officeholder directly.
For PEP accounts, banks typically require senior management approval before opening the relationship. The institution must understand the PEP’s source of wealth and source of funds, and the account undergoes more frequent reviews, often annually.
High-Risk Countries
The FATF publishes and regularly updates two lists of countries with weak anti-money-laundering controls. As of February 2026, the countries under the most severe designation are Iran, North Korea, and Burma. The FATF calls on all countries to apply countermeasures against Iran and North Korea, including refusing to allow their financial institutions to open branches and limiting business relationships with people in those countries. Burma is subject to enhanced due diligence but not full countermeasures.9Financial Crimes Enforcement Network. Financial Action Task Force Identifies Jurisdictions with Anti-Money Laundering, Combating the Financing of Terrorism, and Counter-Proliferation Finance Deficiencies
A separate “increased monitoring” list includes additional countries that have committed to addressing deficiencies but haven’t finished. Kuwait and Papua New Guinea were added in February 2026. If you do business with individuals or companies in any of these jurisdictions, expect more questions and more frequent reviews.
Source of Wealth Verification
EDD accounts require the bank to document where your money comes from, not just where it goes. A high-net-worth individual might have to produce tax returns, audited financial statements, or sale agreements for major assets like real estate or a business. The compliance team compares your stated source of wealth against actual account activity. If you claim consulting income but the account is processing real estate purchases, the bank will follow up. These consistency checks happen on a recurring basis, not just at opening.
What Happens if You Provide False Information
Lying on a bank application is not a gray area. Under federal law, knowingly using false information to defraud a financial institution or obtain its assets is bank fraud, punishable by up to 30 years in prison and fines up to $1,000,000.10Office of the Law Revision Counsel. 18 U.S. Code 1344 – Bank Fraud That statute covers everything from fabricating identity documents to misrepresenting your financial situation on a loan application.
Even without criminal prosecution, refusing to provide updated KYC documentation or giving inconsistent information can get your account frozen or closed. A freeze triggered by a KYC deficiency typically lasts until you supply the missing paperwork and the compliance team verifies it, which can take anywhere from a few days to several weeks. During that time, you lose access to your funds. If the bank decides the risk is too high, it will close the account entirely and mail you a cashier’s check for the balance.
Disputing a Denied Account
Banks sometimes deny applications based on information from specialized consumer reporting agencies like ChexSystems or Early Warning Services. These databases track things like previously overdrawn accounts, suspected fraud, and involuntary closures. If you’re denied based on one of these reports, you have rights under the Fair Credit Reporting Act.
The bank must tell you which reporting agency provided the information behind the denial. You’re then entitled to a free copy of that report within 60 days of the adverse action notice. Read it carefully. If you find errors, you can dispute them with both the reporting agency and the bank that furnished the information. The reporting agency has to investigate and notify you of the results.11Consumer Financial Protection Bureau. Helping Consumers Who Have Been Denied Checking Accounts
If the bank doesn’t resolve your complaint, you can escalate to the Consumer Financial Protection Bureau. The CFPB accepts complaints online, forwards them to the company, and requires a response, generally within 15 days.12Consumer Financial Protection Bureau. Submit a Complaint You’ll have 60 days to review the response and provide feedback. A CFPB complaint doesn’t guarantee a resolution in your favor, but it creates a documented record.
How Long the Bank Keeps Your Records
All records collected during KYC, including copies of your identification documents, verification notes, and transaction monitoring records, must be retained for five years after the account is closed.13FFIEC BSA/AML InfoBase. Appendix P – BSA Record Retention Requirements On a case-by-case basis, such as during a law enforcement investigation or by Treasury Department order, a bank may need to keep records longer. Your information persists well beyond the end of the banking relationship, which is worth knowing if you ever need to dispute past activity or respond to a government inquiry about a closed account.