The Re-KYC process is the periodic reverification your bank, brokerage, or cryptocurrency platform runs to confirm your identity and refresh the personal information tied to your account. Federal anti-money laundering rules require financial institutions to keep customer records current on a risk-based schedule, so the timing and depth of what they ask for depend on how your account is classified internally. Respond with current documents and your account keeps running. Ignore the request and access gets restricted, then frozen, then eventually closed.
Why You’re Being Asked
The legal basis sits in the Bank Secrecy Act and FinCEN’s Customer Due Diligence Final Rule, which took effect in 2018. The rule requires institutions to conduct ongoing monitoring and, on a risk basis, maintain and update customer information throughout the relationship.1FFIEC BSA/AML InfoBase. Assessing Compliance with BSA Regulatory Requirements – Customer Due Diligence “On a risk basis” is the operative phrase: regulators set the principle without dictating exact intervals, so each institution decides its own review cadence.
Cryptocurrency exchanges follow the same regime. FinCEN treats platforms that accept and transmit convertible virtual currency as money transmitters, so they register as money services businesses and carry the same KYC obligations as banks.2Financial Crimes Enforcement Network. Advisory on Illicit Activity Involving Convertible Virtual Currency If you use both a bank and an exchange, expect Re-KYC requests from both, on different schedules.
What Triggers a Re-KYC Request
The most common trigger is the calendar. Institutions assign each customer a risk profile, and that profile sets how often records are refreshed. A high-risk account might see annual reviews, a medium-risk account every two to three years, and a low-risk account every three to five years. Intervals vary by institution.1FFIEC BSA/AML InfoBase. Assessing Compliance with BSA Regulatory Requirements – Customer Due Diligence
Outside the scheduled cycle, certain events push a review forward. FinCEN guidance says that when an institution becomes aware during normal monitoring of information relevant to a customer’s risk profile, it must update the affected records.3Financial Crimes Enforcement Network. FinCEN Guidance on Customer Due Diligence Requirements – Frequently Asked Questions The event-driven triggers you’re most likely to see:
- Unusual transaction patterns, such as a sudden spike in volume, large international transfers, or activity inconsistent with your stated income or occupation.
- Life changes like moving abroad, changing your legal name, or shifting your primary source of income.
- Expired identification. When the passport or driver’s license on file passes its expiration date, many institutions flag the account automatically.
- Adverse media or watchlist hits. If your name shows up on a sanctions list or in a negative news report, the compliance team will want fresh documentation quickly.
So you might go years without hearing from your bank, then get two requests in the same year because a transaction pattern shifted or your ID expired.
Documents to Have Ready
Exact requirements vary, but the core package is consistent across most banks and exchanges.
Government-Issued Photo ID
Federal regulations tell banks to verify identity using “unexpired government-issued identification evidencing nationality or residence and bearing a photograph,” such as a driver’s license or passport.4eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks The same regulation requires non-documentary procedures for cases where a customer cannot present unexpired ID, so an expired document does not automatically lock you out. It just triggers alternative verification, which takes longer. Renew your ID before responding if you can.
Most platforms ask for a high-resolution scan or photo of both sides of the ID. Blurry images, glare, and cropped edges are the leading causes of automated rejection. Fill the frame, keep all four corners visible, and use even lighting.
Proof of Address
A secondary document confirming your physical address is standard. Utility bills, bank statements, and government correspondence dated within the last three months are the usual accepted forms, though some institutions allow documents up to six or twelve months old. The name and address must match what’s on your account. If utilities are in a spouse’s or landlord’s name, a signed lease or homeowner’s insurance policy typically works instead.
Source of Wealth Documentation
If your account is flagged for enhanced due diligence, usually because of high balances, unusual deposit patterns, or a connection to a high-risk country, you may be asked to explain where your money comes from. This is broader than the source of any single deposit. The institution wants a coherent picture of your finances: employment income, business ownership, investments, inheritance, or property sales. Supporting documents can include recent tax returns, investment account statements, audited business financials, or probate records. The explanation should line up with what the account activity actually looks like.
Biometric Verification
Many digital platforms add a live selfie or short video that the system compares against the photo on your uploaded ID. Adequate lighting, a neutral background, and removing glasses or hats reduce the chance of a mismatch error.
If you carry a mobile driver’s license on your phone, note that most banks and crypto platforms have not yet integrated mDL acceptance into their Re-KYC workflows, even though NIST published a draft reference guide in March 2026 to support adoption.5National Institute of Standards and Technology. SP 1800-42 – Digital Identities – Mobile Driver’s License (mDL) Until your institution announces support, plan on using a physical document or scan.
How to Submit Without Getting Rejected
Submission almost always runs through a secure online portal or the institution’s mobile app. Look for the request in your account settings, security section, or notifications tab. Some institutions send a direct link by email, but phishing messages disguised as Re-KYC requests are common. When in doubt, log in through the institution’s website rather than clicking an emailed link.
Once you upload, an automated system checks security features on the ID, matches the name and address against your account records, and runs the biometric comparison if applicable. Discrepancies between your form entries and your uploaded documents are the single most common cause of rejection. Transcribe your name, address, and ID number exactly as they appear on the document, even if you normally use a nickname or abbreviated address.
If the automated system flags something, a compliance officer reviews manually. That secondary review usually takes one to five business days depending on volume, with email or in-app status updates. Once cleared, you get a confirmation and full account functionality returns.
What Happens If You Ignore a Re-KYC Request
Institutions do not shut you out immediately. The typical pattern is a graduated squeeze meant to get your attention before things escalate.
The first stage usually limits outgoing transactions. You can still view your balance and may receive incoming deposits, but withdrawals, transfers, and new trades are blocked. If weeks pass without a response, restrictions tighten to a full freeze where nothing moves in or out.
Extended non-compliance eventually leads to closure. No single federal statute explicitly mandates termination for unverifiable customers, but 31 U.S.C. ยง 5318 requires institutions to implement reasonable procedures for verifying identity, and regulators expect them to exit relationships where they cannot satisfy those obligations.6Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority FinCEN can impose civil money penalties on institutions that miss BSA obligations, which pushes them toward closing accounts rather than keeping unverified ones.7Financial Crimes Enforcement Network. Enforcement Actions
If an account is closed with a balance still in it, the institution typically holds the funds for a period and tries to contact you. Funds that remain unclaimed for an extended period, generally three to five years depending on the state, are eventually turned over to the state through escheatment.8Investor.gov. Escheatment by Financial Institutions You can reclaim the money through your state’s unclaimed property program, but it takes time that a document upload would have avoided.
If Your Submission Is Rejected
Rejections happen more often than people expect, and the reasons are usually fixable. The common culprits are blurry document images, a name mismatch between your ID and your account (often the aftermath of a marriage or legal name change that was updated on one but not the other), and expired identification. Before resubmitting, confirm every detail on your form matches your documents exactly, and that your ID scan is sharp with all four corners visible.
If you have corrected everything and the submission is still denied, or if the restriction on your account seems disproportionate, escalate through the institution’s internal complaint or dispute process. A direct conversation with a compliance team often resolves things faster than repeated resubmissions through the automated pipeline.
When internal channels stall, file a complaint with the Consumer Financial Protection Bureau. The CFPB takes complaints on checking and savings accounts, including disputes over freezes. Companies generally respond within 15 days, with more complex cases taking up to 60 days. You then have 60 days to review and respond to the company’s answer. A CFPB complaint does not guarantee a specific outcome, but it creates a documented record and puts regulatory pressure on the institution.
How Your Data Is Protected
Handing over a passport scan and a utility bill to a website understandably makes people uneasy. The Gramm-Leach-Bliley Act requires financial institutions to develop and maintain an information security program with administrative, technical, and physical safeguards for customer information.9Federal Trade Commission. Gramm-Leach-Bliley Act The FTC’s Safeguards Rule was strengthened in recent years with specific technical standards including encryption, access controls, and regular security assessments.
The documents you upload are subject to BSA record retention rules, which generally require identification records to be kept for five years after an account is closed.10FFIEC BSA/AML InfoBase. Appendices – Appendix P – BSA Record Retention Requirements If you want specifics on a particular platform, its privacy policy should describe retention periods and whether documents are shared with third-party verification services.
Re-KYC on Business Accounts
Business accounts carry an extra layer because institutions must verify not just the entity but its beneficial owners, meaning the individuals who ultimately own or control the business. The CDD Final Rule requires covered institutions to identify and verify beneficial owners at account opening and to update that information when changes come to light during normal monitoring.11eCFR. 31 CFR 1010.230 – Beneficial Ownership Requirements for Legal Entity Customers The update obligation kicks in when the institution becomes aware of a possible ownership change, not on a fixed calendar.3Financial Crimes Enforcement Network. FinCEN Guidance on Customer Due Diligence Requirements – Frequently Asked Questions If your company changes its ownership structure, adds a partner with a significant stake, or replaces its CEO, expect a request for updated ownership documentation. Only the information that actually changed needs to be updated.
One boundary worth flagging: FinCEN’s beneficial ownership information reporting under the Corporate Transparency Act is a separate filing, and as of March 2025 an interim final rule exempted all U.S.-formed entities from filing BOI reports directly with FinCEN, with U.S. persons also exempt from providing their ownership information for any reporting company.12FinCEN.gov. Beneficial Ownership Information Reporting That exemption does not touch your bank’s own Re-KYC obligations. Your bank still needs to know who owns and controls the entity under the CDD rule, even when FinCEN is not collecting the information directly.