A KYC update is a routine request from your bank or brokerage to re-verify your identity and refresh the personal information on file for your account. Federal law requires financial institutions to identify every account holder and monitor for suspicious activity under the Bank Secrecy Act and the USA PATRIOT Act’s Customer Identification Program provisions.1Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority When a KYC update notice lands in your inbox or mailbox, the bank is asking you to confirm that the details it has are still correct and to hand over fresh documentation to prove it.
Respond on time and it’s a fifteen-minute errand. Ignore it and your account can be restricted or closed.
Why You Got the Notice
Under federal rules, the duty to update customer information is event-driven, not calendar-driven. FinCEN’s 2016 Customer Due Diligence Rule clarified that banks are not required to refresh customer records on a rigid schedule; the obligation kicks in when normal account monitoring reveals something relevant to the bank’s risk assessment.2Federal Register. Customer Due Diligence Requirements for Financial Institutions Most banks layer their own periodic reviews on top of that baseline, with higher-risk accounts reviewed more often.
Common reasons an individual account holder gets pulled in for a review:
- The government-issued ID on file has expired. Federal guidance recommends institutions accept only current, valid, and unexpired photo identification.3Federal Bureau of Investigation. Identity Verification Program Guide
- You’ve legally changed your name through marriage, divorce, or a court order, and the records no longer match your current legal identity.4USAGov. How to Change Your Name and What Government Agencies to Notify
- You’ve moved, and the address on file no longer matches where you live.
- Your account activity has shifted in a way the bank didn’t expect. Large cash deposits, wire transfers, or a spike in volume can prompt re-verification. Banks must file a Currency Transaction Report for cash transactions above $10,000 in a single business day and a Suspicious Activity Report when transactions above $5,000 raise red flags.5FinCEN.gov. The Bank Secrecy Act6OCC.gov. Suspicious Activity Report (SAR) Program
- Your source of income has changed and deposits no longer match your profile.
You don’t need a dramatic life change to get flagged. Sometimes the bank is simply cycling through accounts on its internal review schedule and yours came up. The notice itself should spell out the deadline and the specific documents required.
What Documents to Gather
Federal regulations set a minimum. Under the Customer Identification Program rule, every bank must collect your name, date of birth, residential or business street address, and a taxpayer identification number (typically your Social Security number).7eCFR. 31 CFR 1020.220 – Customer Identification Programs for Banks That is the floor. Your bank can ask for more based on its own risk assessment, but not less.
Photo ID
Bring a government-issued photo ID that has not expired. State driver’s licenses and ID cards, U.S. passports, and military IDs are the standard acceptances. The document needs to show your full legal name and a photo the bank can match to you or to the image already on file.3Federal Bureau of Investigation. Identity Verification Program Guide If your name recently changed, get the ID reissued in the new name first, or supply a marriage certificate or court order linking the old name to the new one.
Proof of Address
The CIP rule requires a residential or business street address. If you don’t have one, the regulation allows an APO or FPO box, or the street address of a next of kin or another contact person.7eCFR. 31 CFR 1020.220 – Customer Identification Programs for Banks Most banks verify address with a recent utility bill, a statement from another institution, or a lease. Documents older than 90 days are typically rejected. A standard P.O. box usually won’t satisfy the requirement because the bank needs your physical location.
Social Security or Tax ID Number
Your Social Security number or Individual Taxpayer Identification Number ties the account to federal reporting to the IRS.8Internal Revenue Service. Taxpayer Identification Numbers (TIN) Check every digit before you submit. A single transposed number is the most common reason compliance teams kick an update back for manual review.
Employment or Income Details
Some banks also ask for your employer, job title, or source of income. That isn’t part of the federal CIP minimum, but banks collect it as part of broader due diligence so account activity lines up with what they’d expect from someone in your situation. If asked, provide it. If you’ve changed jobs or retired since opening the account, use this as the moment to update it.
How to Submit and How Long It Takes
Most banks accept KYC updates through their online portal or mobile app. You upload photos or scans of your ID and address documents into an encrypted form, correct any fields that have changed, and submit in a single session. Many apps have a built-in camera that auto-crops your ID and checks image quality before upload, which cuts down on rejections for blurry photos.
If your situation is complicated, such as updating a trust account, dealing with a court-ordered name change, or presenting foreign documentation, going to a branch in person is often faster. A representative can scan originals directly into the system and verify your identity on the spot, avoiding the back-and-forth of rejected digital uploads.
After submission, expect review to take roughly two to five business days. The compliance team checks your documents against government watchlists and internal records. If something looks off (a blurry image, a name mismatch, information that contradicts existing records), they’ll usually reach out for clarification rather than reject outright. Respond quickly. Every day the review stalls is a day closer to account restrictions.
What Happens If You Ignore It
KYC update requests are not suggestions. Federal regulations require institutions to have written procedures for situations where they cannot form a reasonable belief about a customer’s true identity. Those procedures cover when the bank should restrict account use, when it should close the account, and when it should file a Suspicious Activity Report.9FFIEC BSA/AML InfoBase. FFIEC BSA/AML Assessing Compliance with BSA Regulatory Requirements – Customer Identification Program
The escalation usually follows a predictable pattern once the deadline passes. The bank places your account in a restricted status. Outgoing wire transfers and ACH bill payments are typically the first to go. Debit card transactions and ATM withdrawals may be blocked next. Continued silence can result in a full lockout from online banking and, eventually, account closure.
No single federal statute prescribes a specific “freeze at 30 days” rule, so the exact timeline varies by institution. Some banks give a generous warning window; others move quickly. What doesn’t vary is the outcome of doing nothing: you lose access to your money until you comply.
If an account then sits dormant long enough with no customer-initiated activity, the bank is eventually required to turn the balance over to the state as unclaimed property. That typically happens after three to five years of inactivity, depending on state escheatment laws.10HelpWithMyBank.gov. When Is a Deposit Account Considered Abandoned or Unclaimed You can still claim the funds afterward, but the process is slow.
Pushing Back on an Unfair Freeze
If the bank freezes your account over a KYC issue you believe you already resolved, or is demanding information it cannot legally require, you have options beyond calling the branch and hoping.
Start with the bank directly, in writing, and include documentation of what you submitted and when. If that doesn’t resolve it, file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov. You’ll describe the problem, attach supporting documents such as your submission confirmation and any correspondence from the bank (up to 50 pages), and give your contact information.11Consumer Financial Protection Bureau. Submit a Complaint The CFPB forwards your complaint to the bank, which generally responds within 15 days. Complex cases can take up to 60 days. After the response, you have 60 days to provide feedback if you’re unsatisfied.
For national banks, you can also contact the Office of the Comptroller of the Currency. For state-chartered banks, your state banking regulator handles complaints. Act quickly. Restrictions tend to escalate the longer an account remains unresolved.
If the Account Is in a Business’s Name
The guidance above assumes an individual account. If the account belongs to a legal entity such as an LLC, corporation, or partnership, there’s an extra layer. Under the Customer Due Diligence Rule, banks must identify and verify the beneficial owners of every legal entity customer: anyone who directly or indirectly holds 25 percent or more of the entity’s equity interests, plus at least one individual with significant management responsibility, such as a CEO, CFO, or managing member.12eCFR. 31 CFR 1010.230 – Beneficial Ownership Requirements for Legal Entity Customers
When a business account comes up for review, the bank may ask you to re-certify the ownership structure and provide updated identification for each beneficial owner. New partners, buyouts, and changes in management all need to be reflected. A major ownership change is exactly the kind of event the CDD Rule was designed to catch.2Federal Register. Customer Due Diligence Requirements for Financial Institutions