Manual KYC is the process where a human compliance officer at a bank or other financial institution reviews your identity documents by hand, usually after an automated system couldn’t clear your application on its own. Federal law requires every bank to verify each customer’s identity under the Bank Secrecy Act’s Customer Identification Program, and software handles most applications in seconds.1eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks When something doesn’t line up cleanly, or your profile falls into a higher-risk bucket, a person takes over. It adds a day or two in most cases, and knowing what triggered the review, what to send, and what a rejection actually means will get you through it faster.
What Triggers a Manual Review
Automated systems work by matching what you type against the images and documents you upload. When those inputs align, you’re approved without human involvement. When they don’t, or when your application carries elevated risk, it goes into a queue.
Most triggers are ordinary. A blurry photo, glare on a hologram, or text the optical character recognition software can’t read is enough. Name discrepancies are another frequent cause. If your legal name changed after marriage, divorce, or a court order, the name on your ID may not match what you typed. Hyphenated names, transliterated names from non-Latin scripts, and compound surnames create similar mismatches that software treats as red flags even when the explanation is innocent.
Beyond document quality, risk-based screening routes some applications to a reviewer regardless of how clear your documents are. Applying from a jurisdiction with elevated fraud or money-laundering risk falls into this category. So does producing a partial match against the Specially Designated Nationals list maintained by the Office of Foreign Assets Control.2U.S. Department of the Treasury. Specially Designated Nationals (SDNs) and the SDN List Properly calibrated screening still generates false-positive rates of 5 to 6 percent on SDN checks, which means plenty of legitimate applicants get flagged simply because their name resembles an entry on the list.
Foreign individuals who hold or recently held prominent government positions — commonly called politically exposed persons, or PEPs — often get manual review as well. No BSA regulation specifically defines the term or imposes unique identification requirements for PEPs.3FFIEC. Politically Exposed Persons Instead, each bank decides internally whether PEP status matters for a customer’s risk profile, and if flagged, expects deeper scrutiny of source of funds and account activity.
What You’ll Need to Submit
Federal regulations require banks to collect four pieces of identifying information from individual customers before opening an account: your name, date of birth, residential or business address, and an identification number, which for U.S. persons means a Social Security number or taxpayer identification number.1eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks Non-U.S. persons can substitute a passport number, alien identification card number, or another government-issued document number that includes a photograph.
In practice, most institutions ask for more. You’ll typically upload a photo or scan of a valid, unexpired government ID such as a passport or driver’s license. The image needs to show all four corners of the document, be free of glare over security features like holograms, and have legible text throughout. Natural, even lighting helps more than a flash. Most platforms accept JPEG or PDF.
Proof of address is standard. A utility bill or bank statement showing your full name and residential address usually satisfies the requirement, though the acceptable age of the document varies. Some institutions want something issued in the last 90 days; others accept a wider window. Many platforms now also require a liveness check: a photo or short video of you holding your ID next to your face so the reviewer can confirm physical possession and match your appearance to the document photo.
If your documents are in a language the institution doesn’t support, plan on providing a certified English translation. Preparing everything before you start prevents the back-and-forth that turns a 48-hour review into a two-week ordeal.
When Your SSN Doesn’t Verify
Automated SSN verification can fail for mundane reasons: a typo, a hyphenated last name entered differently than what Social Security has on file, or a recent legal name change that hasn’t propagated. When this happens, the compliance team will usually ask you to double-check the number against your physical Social Security card.4Social Security Administration. What to Do if an SSN Fails to Verify If there’s a genuine discrepancy between your card and what the SSA has on record, you’ll need to visit a local SSA office to correct it before the institution can finish verification.
How Long the Review Takes and How You’ll Hear Back
Once you upload through the institution’s secure portal, your application enters a queue for a trained compliance officer. That officer checks each document for signs of digital alteration or physical tampering, such as mismatched fonts, inconsistent backgrounds, or edited dates, and cross-references your information against third-party databases and government watchlists.
Typical turnaround is 24 to 72 business hours. Heavy volume or an understaffed compliance team can stretch it. Your account sits in “pending” status during this time, which usually means you can’t transact or access full platform features. Updates come through automated email or a status indicator on your dashboard. Don’t expect a phone call unless the reviewer needs something from you.
If the officer spots a fixable issue — a blurry image, the wrong document type, a failed liveness check from a technical glitch — many institutions send a resubmission request rather than a rejection. That’s important to notice: a resubmission request is not a denial. Your application stays open, and the fix is usually straightforward.
Fixable Problems vs. Final Rejections
Some rejections come from problems a better photo won’t fix. An ID showing signs of physical tampering, such as altered dates, mismatched lamination, or inconsistent typefaces, results in immediate denial. So does submitting an expired document when the institution requires a current one, or sending foreign-language documents without a certified translation.
The most serious rejection ground is a confirmed match on the OFAC Specially Designated Nationals list. Federal law prohibits U.S. persons and institutions from conducting any transactions with individuals or entities on that list, and their assets must be blocked.2U.S. Department of the Treasury. Specially Designated Nationals (SDNs) and the SDN List Willful violations of these sanctions carry criminal penalties of up to 20 years in prison and fines up to $1 million per violation under the International Emergency Economic Powers Act.5Office of the Law Revision Counsel. 50 USC 1705 – Penalties Civil penalties reach $377,700 per violation as of the most recent inflation adjustment.6Federal Register. Inflation Adjustment of Civil Monetary Penalties A confirmed SDN match is final at that institution, with no internal appeal.
Clear evidence of fraud or identity theft triggers a different but equally final outcome. When a bank detects certain suspicious activity, it must file a Suspicious Activity Report with FinCEN, and federal law explicitly prohibits telling the subject of a SAR that one has been filed.7Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority You won’t be told the specific reason for that kind of rejection, and the institution legally cannot elaborate.
What to Do If You’re Rejected
If your rejection was for a documentation problem, read the notification carefully before you do anything else. People waste weeks resubmitting the same blurry passport photo when the actual issue was a name mismatch on the proof of address. The notice should tell you exactly what to redo.
For an SSN verification failure, resolve the underlying discrepancy with the Social Security Administration first, then return to the institution with updated information. If you recently changed your name, bring your court order or marriage certificate along with your corrected Social Security card so the resubmission is airtight.
Rejections based on sanctions screening or fraud detection are essentially permanent at that institution. If you believe a sanctions-related rejection was a false positive because your name resembles but is not the same as an SDN entry, your options at that bank are limited, but you can try applying at a different institution where the screening algorithms may handle name-matching differently. OFAC also maintains an online search tool you can check yourself to see whether your name appears on the list.8U.S. Department of the Treasury. Sanctions List Search
Business Accounts: Extra Reviews for Owners
Opening a business account adds complexity because the institution must identify not just the entity but the people behind it. Under the Customer Due Diligence rule, banks must identify every individual who owns 25 percent or more of the equity interests of a legal entity customer, plus at least one person with significant managerial control.9Federal Financial Institutions Examination Council. Beneficial Ownership Requirements for Legal Entity Customers Each of those individuals goes through the same identity verification process as any individual applicant, so one business account can generate multiple manual reviews at the same time. Note that this bank-side identification is separate from any FinCEN Beneficial Ownership Information reporting your entity may or may not owe; the bank collects its own information regardless.
What Happens to Your Documents
The information you hand over during KYC — ID images, Social Security numbers, proof of address — is some of the most sensitive data a financial institution holds. The Gramm-Leach-Bliley Act requires institutions to develop, implement, and maintain an information security program with administrative, technical, and physical safeguards to protect it.10Federal Trade Commission. Gramm-Leach-Bliley Act Under the Privacy Rule, the institution must also tell you what it collects, who it shares that data with, and how it protects it, and you have the right to opt out of certain third-party sharing.
Your records don’t disappear when your account closes. Federal regulations require banks to retain identity verification records for five years after account closure.11Federal Financial Institutions Examination Council. Appendix P – BSA Record Retention Requirements That period can extend if law enforcement requests the records or if Treasury issues a specific order. If you close an account assuming your documents will be deleted, they won’t be, and under BSA rules, they can’t be.