What Is KYC and CDD? Requirements, Triggers, and Red Flags

Know Your Customer (KYC) and Customer Due Diligence (CDD) are the identity verification and risk assessment processes that banks, credit unions, broker-dealers, and other financial institutions use to confirm you are who you say you are and to screen for money laundering, terrorist financing, and fraud. The requirements trace back to the Bank Secrecy Act and were expanded by the USA PATRIOT Act of 2001, which imposed new due diligence obligations across the financial sector.¹ If a bank has ever asked you for a photo ID and a utility bill just to open a checking account, that was KYC.

The Three Layers Behind Every Account

Federal rules organize the process into three stacked layers. The first is the Customer Identification Program, or CIP. Every bank must maintain a written CIP that spells out how it collects and verifies the identity of each new account holder. Before the account opens, the bank must gather your name, date of birth, address, and a taxpayer identification number.² Two narrow exceptions apply: if you have applied for but not yet received a taxpayer ID, the bank can open the account and collect the number within a reasonable time; and credit card issuers can pull identifying information from a third-party source before extending credit.³

The second layer is Customer Due Diligence itself. Here the institution moves past confirming your name and looks at how risky you are as a customer. That means understanding the nature of the relationship and, for business accounts, identifying the people who ultimately own or control the entity. Federal rules require identifying every individual who directly or indirectly owns 25 percent or more of a legal entity, plus at least one person who exercises significant managerial control.⁴

The third layer is ongoing monitoring. Your relationship with the bank does not freeze at account opening. The institution must keep watching for activity that looks inconsistent with your profile and update your information when circumstances change.

What You Have To Provide

For a Personal Account

The CIP minimum for individuals is straightforward: your full legal name, date of birth, residential or business street address, and a taxpayer identification number such as a Social Security number or ITIN. Non-U.S. persons who lack a taxpayer ID can substitute a passport number with the country of issuance, an alien identification card number, or another government-issued document that shows nationality and includes a photograph.²

In practice, most banks ask for more than the bare minimum. Expect to bring an unexpired government-issued photo ID and at least one document confirming your address, such as a recent utility bill or mortgage statement. Blurry copies and expired documents are the most common reasons applications get kicked back, so bring originals or clean scans.

For a Business Account

Business customers face a longer checklist. On top of the standard identifiers for the entity, the institution must collect information about the people behind the business: every individual who owns 25 percent or more of the equity and at least one person who manages or directs the entity, such as a CEO or managing member.⁵ You will typically need formation documents such as articles of incorporation or a partnership agreement, along with an Employer Identification Number. Certified copies of formation documents generally cost between $1 and $75 depending on the state, and a certificate of good standing typically runs $5 to $25.

Submitting forged documents or false information is a federal crime. Depending on the circumstances, false statements to a federally insured institution can carry penalties of up to $1 million in fines and 30 years of imprisonment.⁶

Why Some Customers Get More Questions Than Others

Not every customer gets the same depth of scrutiny. Institutions use a risk-based approach that sorts customers into tiers, and the tier determines how much digging happens.

Simplified Due Diligence is reserved for low-risk situations where the chance of money laundering is minimal. Publicly traded companies and government entities often fit here because their ownership is already transparent.

Standard CDD is the default for most retail banking customers. The institution collects the required identifiers, verifies them, assesses basic risk factors, and builds a customer profile for future monitoring.

Enhanced Due Diligence is required for high-risk customers or relationships. Federal law mandates EDD for correspondent accounts with foreign banks and private banking accounts held by non-U.S. persons, at a minimum.⁷ EDD involves investigating the source of a customer’s wealth and the source of funds behind large transactions, reviewing public records, and looking for adverse media coverage.

A bank can escalate you from standard CDD to EDD at any point during the relationship if something changes, whether that is an unusual transaction pattern, a move to a high-risk jurisdiction, or a background check that surfaces legal problems. The institution has to document why it made the shift, because examiners will ask.

Common EDD Triggers

Politically exposed persons are one of the most common triggers. Federal examination guidance defines a PEP as a foreign individual who holds or has held a prominent public function, along with their immediate family members and close associates. No single federal regulation defines “PEP,” so institutions develop their own policies based on regulator guidance and international standards.⁸

Customers in jurisdictions with weak anti-money-laundering controls also draw EDD. The Financial Action Task Force maintains lists of countries under increased monitoring, and transactions involving those jurisdictions get a harder look.

What the Bank Actually Does With Your Information

Once you submit your documents, the institution runs your information through automated systems that cross-reference multiple databases. The most critical check is against the OFAC sanctions lists, which include the Specially Designated Nationals and Blocked Persons List, the Foreign Sanctions Evaders List, and several other consolidated lists.⁹ These systems also screen against PEP databases and other watchlists.

For straightforward individual accounts, automated verification often finishes within minutes. Business accounts take longer because the institution needs to verify company registration, ownership structures, and beneficial owner identities. When manual review kicks in, timelines stretch to several hours or a few days, particularly for complex ownership structures, poor-quality document submissions, or PEP matches that need human judgment.

If the automated system finds a potential match, a compliance analyst reviews it to determine whether it is a false positive. A confirmed match typically freezes the application and leads to the filing of a Suspicious Activity Report with FinCEN. The SAR must be filed within 30 calendar days of initial detection; if no suspect has been identified, the institution can take an additional 30 days but cannot delay more than 60 days total.¹⁰

Red Flags That Can Trip You Up After the Account Opens

Banks run continuous transaction monitoring to catch activity that looks inconsistent with your established profile. Federal examination guidance identifies dozens of specific warning signs institutions are expected to watch for:

Using unverifiable documents, providing inconsistent taxpayer identification numbers, or refusing to answer basic questions about business activities.¹¹
Structuring deposits into amounts just below $10,000 to dodge currency transaction reports, or consolidating multiple smaller deposits for international transfer. This is one of the fastest ways to generate a SAR.
Large round-dollar wire transfers to financial secrecy havens, payments with no connection to legitimate contracts, or incoming small transfers immediately wired out to another country.
Activity that does not match the stated business, such as a retail shop depositing far more cash than similar businesses in the area.

Any of these can shift your account from routine monitoring into a formal review. Banks are required to file a SAR for criminal violations aggregating $5,000 or more when a suspect can be identified, or $25,000 or more regardless of whether a suspect is identified.¹²

Your file also has to be updated when circumstances change. A name change, a new address, or a shift in business operations can alter your risk profile. For business accounts, changes in ownership or control trigger a re-verification of beneficial ownership.

Crypto and Real Estate Are Not Exempt

Two places people commonly assume KYC does not reach are cryptocurrency and cash real estate purchases. Both assumptions are wrong.

FinCEN classifies anyone who accepts and transmits convertible virtual currency as a money transmitter, which makes them a Money Services Business subject to the same BSA registration, reporting, and recordkeeping requirements as traditional financial institutions.¹³ The classification covers both domestic and foreign-located platforms doing business in whole or substantial part within the United States.¹⁴ Under the existing travel rule, institutions must collect, retain, and transmit customer information for funds transfers of $3,000 or more. Users who buy virtual currency solely to purchase goods or services are not classified as money transmitters and are not subject to these obligations.

For real estate, FinCEN uses Geographic Targeting Orders requiring U.S. title insurance companies to identify the real people behind shell companies used in non-financed residential purchases. The orders cover specific metropolitan areas in California, Colorado, Connecticut, Florida, Hawaii, Illinois, Maryland, Massachusetts, Nevada, New York, Texas, Virginia, Washington, and the District of Columbia, with a reporting threshold of $300,000 in most covered areas.¹⁵ Buying property in one of these areas with cash through an entity means the title company will ask who really owns the entity.

If Your Account Is Denied or Frozen

Getting flagged is frustrating, and the information available to you is limited. Banks cannot disclose whether they have filed a SAR about you; those reports are confidential by federal law.¹⁰ But if your account application is denied based on a report from a checking account screening company like ChexSystems, you do have concrete rights.

The bank must give you an adverse action notice identifying the screening company that supplied the report. You are entitled to a free copy of that report within 60 days of receiving the notice.¹⁶ If the report contains errors, you can dispute them with both the screening company and the bank or credit union that furnished the inaccurate information. Under the Fair Credit Reporting Act, the screening company must investigate your dispute and inform you of the results.¹⁷ Most checking account screening companies drop negative information after five to seven years. You can also submit a complaint to the Consumer Financial Protection Bureau if the dispute process stalls.

Account freezes are harder to fight because they often involve suspicion of illegal activity, and the bank has broad discretion to close relationships it considers too risky. If you believe a freeze is based on a mistake, document everything: your source of funds, the legitimate purpose of flagged transactions, and any supporting records. In some cases, providing this to the compliance department resolves the issue, though the bank is not legally obligated to reinstate the account.

Beneficial Ownership: Two Different Requirements

The beneficial ownership rules have shifted recently, and two separate requirements often get confused.

The CDD Rule, which took effect in 2018, requires financial institutions to identify beneficial owners when a legal entity opens an account. That rule, with its 25 percent ownership threshold, remains in effect and applies every time a business opens a new banking relationship.⁴

The Corporate Transparency Act created a separate obligation for companies to report beneficial ownership information directly to FinCEN, independent of any banking relationship. In March 2025, FinCEN issued an interim final rule that exempts all entities created in the United States from that reporting requirement. Only entities formed under foreign law that have registered to do business in a U.S. state or tribal jurisdiction are currently required to file BOI reports with FinCEN. Foreign entities that do need to report must file within 30 calendar days of receiving notice that their registration is effective.¹⁸

For a U.S. business owner, the practical takeaway is this: you still need to provide beneficial ownership information to your bank when you open an account, but you do not currently need to file a separate report with FinCEN. That could change if FinCEN issues a new final rule, so the FinCEN BOI page is worth checking periodically.

1
FinCEN.gov. USA PATRIOT Act
2
eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
3
eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
4
FFIEC BSA/AML InfoBase. Beneficial Ownership Requirements for Legal Entity Customers
5
Financial Crimes Enforcement Network. Frequently Asked Questions Regarding Customer Due Diligence Requirements for Financial Institutions
6
Office of the Law Revision Counsel. 18 USC 1014 – Loan and Credit Applications Generally
7
Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority
8
FFIEC BSA/AML InfoBase. Risks Associated With Money Laundering and Terrorist Financing – Politically Exposed Persons
9
U.S. Department of the Treasury. Sanctions List Search Tool
10
Financial Crimes Enforcement Network. FinCEN Suspicious Activity Report Electronic Filing Instructions
11
FFIEC BSA/AML InfoBase. Appendix F – Money Laundering and Terrorist Financing Red Flags
12
FFIEC BSA/AML InfoBase. Suspicious Activity Reporting
13
FinCEN. Application of FinCEN’s Regulations to Persons Administering, Exchanging, or Using Virtual Currencies
14
Financial Crimes Enforcement Network. Advisory on Illicit Activity Involving Convertible Virtual Currency
15
Financial Crimes Enforcement Network. FinCEN Renews Residential Real Estate Geographic Targeting Orders
16
Consumer Financial Protection Bureau. Helping Consumers Who Have Been Denied Checking Accounts
17
Consumer Financial Protection Bureau. Denied for a Bank Account Here’s What You Should Know
18
FinCEN.gov. Beneficial Ownership Information Reporting