Anti-money laundering and know your customer are the federal rules that require every U.S. bank, credit union, cryptocurrency exchange, and money services business to verify who you are before opening an account and to watch your transactions for signs of illegal money movement. Anti-money laundering (AML) is the broader framework of monitoring and reporting; know your customer (KYC) is the identity-verification piece that happens up front. Together they are the reason a bank asks for your Social Security number and a government ID, reports your cash deposits above $10,000 to the Treasury Department, and sometimes closes accounts without telling you why.
How KYC Fits Inside AML
KYC is the front door. AML is everything that happens after you walk through it. The identity information a bank collects when you open an account feeds the systems that later decide whether a given transaction looks normal or suspicious. If the bank doesn’t know who you are, where your money comes from, and what your usual activity looks like, its monitoring is guesswork. That is why regulators treat weak identity verification as the root cause of most AML failures.
What a Bank Must Collect Before Opening Your Account
Every bank has to maintain a written Customer Identification Program that spells out the minimum information it collects from anyone opening an account.1eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks At a minimum, the bank must obtain:
- Your full legal name
- Your date of birth
- A residential or business street address (a P.O. box alone will not satisfy this; if you have no street address, the bank may accept a military APO/FPO box or the address of a next of kin)
- Your taxpayer identification number, which for a U.S. person is a Social Security number, and for a non-U.S. person can be a passport number or other government-issued ID number
The bank verifies what you give it against government-issued identification like a passport or driver’s license, and often runs the details through third-party databases to make sure everything matches.1eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks If the information is inconsistent or cannot be verified, the account will be denied. There is no workaround. Anonymous access to the financial system is exactly what these rules exist to prevent.
What Changes for a Business Account
When a company opens an account, the bank collects the entity’s formation documents, its Employer Identification Number, and its principal business address. That is only the start. Under FinCEN’s Customer Due Diligence Rule, the bank also has to identify and verify any individual who owns 25 percent or more of the entity, plus any individual who controls the entity, even if that controller owns nothing.2FinCEN. Information on Complying with the Customer Due Diligence (CDD) Final Rule
Each of those people, called beneficial owners, has to provide the same personal information any individual accountholder provides: name, date of birth, address, and identification number. The rule exists because criminals have long used shell companies to move money while keeping the actual person behind the company invisible to investigators.
Why Some Customers Get Extra Questions
Not every customer gets the same level of scrutiny. Banks are required to apply enhanced due diligence to accounts that carry a higher risk of money laundering or corruption. Categories that routinely trigger it include foreign correspondent bank accounts, private banking clients, politically exposed persons such as senior government officials and executives of state-owned enterprises, and money services businesses.3FFIEC. Assessing Compliance with BSA Regulatory Requirements
Enhanced due diligence goes well past collecting a name and ID. The bank may ask about the source of your funds and wealth, request financial statements, dig into the nature and expected volume of your transactions, and investigate whether your business operates in high-risk jurisdictions. If you fall into one of those categories and wonder why the bank keeps asking questions, this is why. The bank faces real penalties if it does not collect the information.
Reporting That Happens on Your Account
Currency Transaction Reports
Any time you conduct a cash transaction of more than $10,000 in a single business day, your bank must file a Currency Transaction Report with FinCEN. This covers deposits, withdrawals, currency exchanges, and any combination of cash transactions adding up to more than $10,000 in one day.4Financial Crimes Enforcement Network. Notice to Customers: A CTR Reference Guide The filing is automatic. It does not mean you have done anything wrong. It is a threshold the bank has to follow.
Suspicious Activity Reports
When the bank’s monitoring systems or staff spot activity that seems unusual or lacks a clear legitimate purpose, the bank has to file a Suspicious Activity Report (SAR) with FinCEN. Automated software scans for patterns like rapid transfers between unrelated accounts, large deposits immediately followed by withdrawals, or transaction volumes that do not match a customer’s stated business. The SAR must be filed within 30 calendar days of the initial detection; if no suspect can be identified, the deadline extends to 60 days.5FFIEC. Suspicious Activity Reporting – Overview
Here is the part that surprises most people. Federal law bars the bank from telling you a SAR has been filed. No one at the bank, not even a former employee, can notify any person involved in the transaction that it was reported.6Office of the Law Revision Counsel. 31 U.S. Code 5318 – Compliance, Exemptions, and Summons Authority The same prohibition binds government employees who learn about the filing. If your bank suddenly starts asking pointed questions or closes your account with little explanation, a SAR may be the reason, but the bank will never confirm it.
Why Breaking Up Cash Deposits Is a Federal Crime
Some people assume they can dodge the $10,000 threshold by breaking a large cash transaction into smaller ones: $4,000 today, $3,000 tomorrow, $4,000 the day after. That is called structuring, and it is a separate federal crime whether or not the underlying money is legitimate. You do not need to be laundering drug proceeds to be prosecuted. Deliberately breaking up transactions to duck the reporting requirement is the crime by itself.7Office of the Law Revision Counsel. 31 U.S. Code 5324 – Structuring Transactions to Evade Reporting Requirement Prohibited
The basic penalty is up to 5 years in prison. If the structuring is part of a broader pattern of illegal activity involving more than $100,000 in a 12-month period, the maximum doubles to 10 years.7Office of the Law Revision Counsel. 31 U.S. Code 5324 – Structuring Transactions to Evade Reporting Requirement Prohibited Bank monitoring software flags structuring patterns automatically, and staff are trained to spot them. It is one of the most common ways ordinary people stumble into federal criminal exposure.
How the Rules Apply to Cryptocurrency
AML and KYC are not limited to traditional banks. FinCEN treats anyone who administers or exchanges convertible virtual currency as a money services business, subject to the same registration, reporting, and recordkeeping requirements as any other money transmitter.8Financial Crimes Enforcement Network. Application of FinCEN’s Regulations to Persons Administering, Exchanging, or Using Virtual Currencies Cryptocurrency exchanges have to collect the same identity information a bank collects, file CTRs and SARs, and maintain a full AML program.
One useful boundary: if you are just a user buying cryptocurrency to pay for goods or services, you are not an MSB and do not carry those registration and reporting obligations yourself. The exchange you use does, which is why platforms like Coinbase and Kraken require identity verification before letting you trade. Exchanges also have to follow the “travel rule,” which requires them to transmit sender and recipient information along with transfers exceeding $3,000.
The Laws Behind It All
Two federal statutes do most of the work. The Bank Secrecy Act of 1970 is the foundation for all financial-transparency requirements in the United States. It directs the Treasury Department to impose recordkeeping and reporting obligations on financial institutions, including reports on cash transactions above $10,000 and reports of suspicious activity that might signal money laundering or tax evasion.9Financial Crimes Enforcement Network. The Bank Secrecy Act Its stated purpose is to generate records useful for criminal, tax, regulatory, and counterterrorism investigations.10Office of the Law Revision Counsel. 31 U.S. Code 5311 – Declaration of Purpose
The USA PATRIOT Act of 2001 turned KYC from a best practice into a federal mandate. Section 326 directed FinCEN to set minimum standards for verifying the identity of every person who opens an account, keeping records of the identifying information collected, and checking customers against government-provided lists of known or suspected terrorists.11Financial Crimes Enforcement Network. USA PATRIOT Act – Section: Verification of Identification FinCEN, a bureau within Treasury, writes the specific regulations and collects the reports banks submit, making that data available to law enforcement and intelligence agencies.12U.S. Department of the Treasury. Terrorism and Financial Intelligence
What Happened to Beneficial Ownership Reporting
The Corporate Transparency Act, passed in 2021, originally required most small companies formed in the United States to report their beneficial owners directly to FinCEN. That framework has changed. In March 2025, FinCEN issued an interim final rule that exempts all entities created in the United States, along with their U.S.-person beneficial owners, from beneficial ownership information reporting. The requirement now applies only to entities formed under foreign law that have registered to do business in a U.S. state or tribal jurisdiction, and even those foreign entities do not have to report any U.S. persons as beneficial owners.13Financial Crimes Enforcement Network. FinCEN Removes Beneficial Ownership Reporting Requirements for U.S. Companies and U.S. Persons
Foreign reporting companies already registered when the interim rule took effect had 30 days to file their initial reports. Foreign entities that register after the effective date have 30 calendar days from receiving notice that their registration is effective. This area has shifted quickly over the past two years, and further rulemaking or legislation is possible. If your business has a foreign formation, check FinCEN’s BOI page for the current deadlines before relying on any specific date.