Know Your Customer, usually shortened to KYC, is the set of federal rules that require banks, brokerages, and other financial institutions to verify who you are before they let you open an account or move significant money. The rules come from the Bank Secrecy Act and the USA PATRIOT Act, and they exist to keep the financial system from being used for money laundering, fraud, or terrorism financing. If a bank has ever asked for your driver’s license and Social Security number at account opening, that was KYC.
What You’ll Have to Provide
Every covered institution runs a Customer Identification Program, and the regulation sets a floor on what it must collect from you before opening an account:1eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
- Your full legal name
- Your date of birth
- A residential or business street address (a military APO/FPO box or a next-of-kin address is acceptable if you don’t have one)
- A taxpayer identification number, usually a Social Security number for U.S. persons
You’ll then verify those four points with documents. The regulation calls for unexpired, government-issued identification showing nationality or residence and bearing a photograph, such as a passport or driver’s license.1eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks Many institutions also want a secondary document confirming your address, like a utility bill or lease, though the specific list is left to each institution’s own policy.
Small mismatches are what slow people down. A maiden name on your Social Security card, a hyphen on one ID and not the other, a full middle name versus an initial — any of it can get flagged. Lining up your documents before you walk in saves real time.
This applies to more than just your neighborhood bank. The Bank Secrecy Act’s definition of “financial institution” covers brokerages, credit unions, insurance companies, casinos with more than $1 million in annual gaming revenue, pawnbrokers, and vehicle dealers, among others.2Office of the Law Revision Counsel. 31 U.S. Code 5312 – Definitions and Application Check cashers, currency exchangers, and money transmitters all count as Money Services Businesses and must maintain written anti-money-laundering programs that include customer identification.3eCFR. 31 CFR 1022.210 – Anti-Money Laundering Programs for Money Services Businesses Cryptocurrency exchanges and other virtual-asset platforms that transmit digital currency are also treated as money services businesses under FinCEN guidance and must register and comply with the same requirements.4Financial Crimes Enforcement Network. Advisory on Illicit Activity Involving Convertible Virtual Currency
If You’re Not a U.S. Citizen
Without a Social Security number, you can satisfy the identification-number requirement with a passport number and country of issuance, an alien identification card number, or the number from any other government-issued document showing nationality or residence that includes a photograph.1eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
If you earn income from U.S. sources, you’ll typically also submit IRS Form W-8BEN to certify your foreign status for withholding purposes.5Internal Revenue Service. About Form W-8 BEN If you need a taxpayer identification number, you can apply for an Individual Taxpayer Identification Number through the IRS.
What the Institution Does Behind the Scenes
After you hand over your information, the compliance team runs it against several databases. One check is required by law before any transaction can go through: the Office of Foreign Assets Control’s sanctions lists, which name people and entities that are legally off-limits for U.S. business. An institution that lets a prohibited transaction through before completing the OFAC screen faces enforcement action.6FFIEC BSA/AML Manual. Office of Foreign Assets Control
Most customers go through standard Customer Due Diligence: verifying the four identity data points and forming a baseline understanding of why you’re opening the account and what kind of activity to expect. A 2016 FinCEN final rule made this explicit — every covered institution must use risk-based procedures to develop a customer risk profile that includes the nature and purpose of the account.7Federal Register. Customer Due Diligence Requirements for Financial Institutions
When You’ll Get Extra Scrutiny
Some customers trigger Enhanced Due Diligence. This typically covers individuals in prominent government positions (often called Politically Exposed Persons), customers from countries with weak anti-money-laundering controls, and accounts with unusually complex ownership structures. Expect more questions about the source of your wealth, longer processing times, and sometimes ongoing limits on specific transaction types. The risk rating the institution assigns you also sets how often your account gets re-reviewed afterward: a low-risk account may go years between reviews, while a high-risk one can be reassessed quarterly.
Opening an Account for a Business
When a corporation or LLC opens an account, the institution has to look through the entity to the real people. Under the CDD Rule, it must identify and verify any individual who owns 25 percent or more of the entity, plus at least one individual who controls it, such as a CEO or managing member.8Financial Crimes Enforcement Network. CDD Final Rule The point is to keep people from hiding behind shell companies.
Separate from what your bank asks for, the Corporate Transparency Act originally required most U.S. companies to report their beneficial owners directly to FinCEN. As of March 2025, FinCEN issued an interim final rule that removes that reporting requirement for all U.S.-formed entities and their U.S.-person beneficial owners.9Financial Crimes Enforcement Network. FinCEN Removes Beneficial Ownership Reporting Requirements for US Companies and US Persons Foreign-formed companies registered to do business in the United States still have to report, with a 30-day filing deadline after registration.10Federal Register. Beneficial Ownership Information Reporting Requirement Revision and Deadline Extension FinCEN could change this further through a new final rule, so foreign entities should keep watching.
After the Account Is Open
KYC isn’t a one-time event. Federal rules require ongoing monitoring and updates to your customer information when changes affect your risk profile.7Federal Register. Customer Due Diligence Requirements for Financial Institutions If your activity shifts noticeably — a sudden run of large deposits, wires to countries you’ve never dealt with before — the institution is required to investigate.
Two reporting thresholds are worth knowing. Institutions must file a Currency Transaction Report for any cash transaction over $10,000 in a single business day.11Financial Crimes Enforcement Network. Notice to Customers: A CTR Reference Guide For activity that looks potentially criminal, banks file Suspicious Activity Reports starting at $5,000 when a suspect can be identified.12FFIEC BSA/AML Manual. Assessing Compliance with BSA Regulatory Requirements – Suspicious Activity Reporting You don’t get notified when a SAR is filed about you.
In day-to-day terms, you’ll periodically get requests to confirm your address, update your employer, or send over a fresh copy of your ID after the old one expires. Ignoring those requests can get your account frozen or closed. The institution has to demonstrate active compliance, and that gives it little room to let things slide.
If You’re Denied
If the institution can’t verify your identity, or decides the risk is too high, it can refuse to open your account. When a bank denies you based on information from a checking account reporting agency, federal law requires it to send you an adverse action notice naming the agency that supplied the report.13Consumer Financial Protection Bureau. Why Was I Denied a Checking Account? You can then request a free copy of that report and dispute anything inaccurate. The agency has to investigate and correct errors.
A denial often isn’t about wrongdoing. Common causes include mismatched names across documents, an address that doesn’t yet appear in verification databases after a recent move, or a thin file because you haven’t held many accounts before. Fixing the underlying issue and reapplying, sometimes at a different institution, usually resolves it.
Penalties for Lying on a KYC Form
Submitting false or fraudulent information during KYC is a federal crime, not just a reason for denial. Making a false statement to influence a financial institution’s decision carries a fine of up to $1 million, imprisonment for up to 30 years, or both.14Office of the Law Revision Counsel. 18 USC 1014 Producing or using a false identification document, such as a fake driver’s license or forged passport, carries up to 15 years. If the false ID is tied to terrorism, the maximum rises to 30 years.15Office of the Law Revision Counsel. 18 U.S. Code 1028 – Fraud and Related Activity in Connection with Identification Documents
How Your Information Is Protected
A KYC file holds a lot: your Social Security number, date of birth, home address, copies of your government ID. The Gramm-Leach-Bliley Act requires every financial institution that collects this material to develop and maintain a security program with administrative, technical, and physical safeguards, and to explain its information-sharing practices to you.16Federal Trade Commission. Gramm-Leach-Bliley Act
The Red Flags Rule layers identity-theft prevention on top. Covered institutions must maintain written programs that detect warning signs of identity theft in daily operations and take steps to prevent and mitigate the damage.17Federal Trade Commission. Fighting Identity Theft with the Red Flags Rule: A How-To Guide for Business The same system that verifies you at account opening is also supposed to catch someone else trying to open an account in your name.