KYC data is the set of personal and business identity information that banks, credit unions, and brokerages are required to collect and verify before letting you open an account or move money through it. The term is shorthand for “know your customer,” and it covers everything from your name and Social Security number to the documents you hand over at account opening and the ownership details behind any company you register. Federal law makes the collection mandatory, dictates how it must be verified, and sets how long it stays on file after you leave.
What a Bank Collects From You
Every financial institution must gather four pieces of information from an individual before opening an account: your name, your date of birth, your residential or business street address, and your taxpayer identification number, which for most people is a Social Security number.1eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks If you don’t have a U.S. street address, the rule accepts a military APO or FPO box, or the street address of a next of kin or other contact person.
Those four items are the floor. Institutions then verify your identity using documents, and a government-issued photo ID like a driver’s license or passport is standard. Many banks also ask for a utility bill, bank statement, or mortgage statement to confirm your current address, though the regulation gives institutions flexibility to choose what they accept. How much documentation they ask for sometimes scales with the type of account and expected transaction volume. A basic checking account involves less scrutiny than a large investment portfolio.
Non-U.S. persons go through a slightly different path. Instead of a Social Security number, the institution can accept a passport number with country of issuance, an alien identification card number, or the number from any other government-issued document that shows nationality or residence and includes a photograph.1eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
What a Bank Collects From a Business
When an LLC, corporation, partnership, or other legal entity opens an account, the institution has to look past the entity and identify the real people behind it. Under the Customer Due Diligence (CDD) Rule, banks must identify every individual who directly or indirectly owns 25 percent or more of the entity’s equity interests, plus at least one person with significant managerial control, typically a CEO, CFO, or someone performing a similar role.2eCFR. 31 CFR 1010.230 – Beneficial Ownership Requirements for Legal Entity Customers Each of those individuals is verified with the same identity procedures that apply to individual customers.
Expect to be asked for the entity’s formation documents, operating agreement, or partnership agreement so the bank can map the ownership structure. The person opening the account must certify that the beneficial ownership information is accurate.3Financial Crimes Enforcement Network. CDD Final Rule
One point of confusion is worth clearing up. FinCEN’s Corporate Transparency Act originally required most domestic companies to report beneficial ownership information directly to the government, and that requirement was later suspended for all entities created in the United States.4Financial Crimes Enforcement Network. Frequently Asked Questions The CDD Rule is a separate obligation that applies to banks, not to the companies themselves. So even if your LLC no longer needs to file a BOI report with FinCEN, the bank still has to identify your beneficial owners when you open the account.
Why Banks Have To Do This
KYC obligations trace back to the Bank Secrecy Act of 1970, which authorized the Treasury Department to impose reporting and recordkeeping requirements on financial institutions to detect and prevent money laundering.5Financial Crimes Enforcement Network. Bank Secrecy Act Section 326 of the USA PATRIOT Act, enacted in 2001, built on that foundation by directing FinCEN to require every financial institution to establish a written Customer Identification Program (CIP) that verifies the identity of anyone opening an account, keeps records of the information used, and checks applicants against government lists of known or suspected terrorists.6Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority FinCEN, a bureau within Treasury, oversees compliance, and institutions that fail to maintain adequate anti-money laundering programs face civil penalties that can reach into the hundreds of thousands or millions of dollars per violation.7Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties
How Verification Actually Works
Handing over your documents is only step one. The institution then cross-references what you submitted against independent databases, credit bureau records, and government watchlists. The most important check is screening against the Specially Designated Nationals (SDN) list maintained by the Treasury Department’s Office of Foreign Assets Control, which flags individuals and entities under U.S. sanctions.8U.S. Department of the Treasury. Sanctions List Search Tool A match or near-match can halt an application outright.
Much of this now happens electronically. So-called eKYC systems use liveness checks that ask you to move your head, blink, or take a real-time selfie to prove you’re a living person and not someone holding up a printed photo or using a deepfake. Biometric matching then compares your live image against the photo on your ID. Institutions also screen applicants against adverse media, meaning publicly available information about criminal charges, fraud allegations, regulatory sanctions, or financial misconduct. A hit doesn’t automatically mean denial, but it can push the file into a deeper review.
If a name doesn’t match, an address can’t be confirmed, or a watchlist result flags, the file goes to manual review. The bank may ask for more documentation, delay the account, or refuse to open it. Institutions are required to have written procedures for cases where they cannot form a reasonable belief about a customer’s true identity, including when to decline the application and when to file a suspicious activity report.
When You Get Extra Scrutiny
Some accounts and customers trigger enhanced due diligence (EDD), which is a deeper look at the source of your funds, the purpose of the account, and expected transaction patterns. This isn’t the bank being nosy. Federal regulations require it for specific categories.
Private banking accounts are one. Institutions must take reasonable steps to identify all nominal and beneficial owners of a private banking account, determine whether any owner is a senior foreign political figure, ascertain where the money comes from, and monitor the account for activity consistent with its stated purpose.9eCFR. 31 CFR 1010.620 – Due Diligence Programs for Private Banking Accounts When a senior foreign political figure is involved, the institution has to apply enhanced scrutiny designed to catch proceeds of foreign corruption.
Politically exposed persons more broadly, including government officials, high-ranking military officers, senior executives of state-owned enterprises, and their close associates, carry elevated risk because their positions create openings for bribery and corruption. Institutions typically apply ongoing monitoring with lower alert thresholds for these accounts.
Geography matters too. The Financial Action Task Force maintains lists of jurisdictions with serious anti-money laundering deficiencies, and as of early 2026 North Korea and Iran are subject to the most severe countermeasures, while Myanmar is subject to enhanced due diligence.10Financial Crimes Enforcement Network. Financial Action Task Force Identifies Jurisdictions with Anti-Money Laundering Deficiencies Transactions touching those jurisdictions receive heightened review automatically.
How Your Data Is Protected and Shared
The Gramm-Leach-Bliley Act requires every financial institution to explain its information-sharing practices to customers and to safeguard sensitive data.11Federal Trade Commission. Gramm-Leach-Bliley Act In practice that means encryption during transmission, restricted internal access controls, and routine security audits. Stored KYC data typically sits on servers isolated from general network traffic, with multi-factor authentication required for employee access.
GLBA also gives you some control. Institutions must provide clear privacy notices explaining what they collect, how they use it, and who they share it with, and you have the right to opt out of certain data-sharing arrangements with unaffiliated third parties.12Consumer Financial Protection Bureau. Privacy Notices (GLBA) The opt-out has limits. Sharing between affiliates and sharing needed to process your transactions generally can’t be blocked, but you can stop the institution from selling or sharing your personal information for outside marketing without your consent.
How Long the Bank Keeps It
Federal rules require institutions to retain your KYC data well past the life of your account. The core identity information collected during the CIP process — name, date of birth, address, and identification number — must be kept for five years after your account is closed. Verification records, including copies of documents used to confirm your identity and descriptions of the methods used, must be retained for five years after the record is made.13eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks Two different clocks run simultaneously: one starts when you leave, the other started when the record was created.
Most other Bank Secrecy Act records follow the same five-year framework, including transaction records, suspicious activity reports, and currency transaction reports. There’s no mechanism to request early deletion. Law enforcement and regulators rely on that retention window to trace financial activity during investigations, which is the whole point. If an institution knows it’s under investigation or facing an enforcement action, it must preserve records beyond the standard period until the matter is resolved.
KYC Isn’t a One-Time Event
Institutions are expected to keep customer information current and update risk profiles as circumstances change. This process, often called a KYC refresh or periodic review, re-verifies identity documents, re-runs sanctions and watchlist screenings, and recalibrates the customer’s risk rating against current behavior.
High-risk customers get reviewed more often than low-risk ones. There’s no single federal regulation setting exact refresh intervals, so institutions set their own schedules based on risk, with a high-risk account potentially reviewed annually and a standard retail account going three to five years between refreshes. Certain events trigger an immediate review regardless of the schedule: large unexplained transactions, changes in account ownership, or a customer appearing on a newly updated sanctions list.
When your bank contacts you out of the blue asking you to confirm your address, re-submit your ID, or update your employment information, that’s a KYC refresh. Ignoring the request can lead to account restrictions or closure, because the institution can’t keep the account open if it can’t verify that its customer information is still accurate.
If You’re Denied
If a bank can’t verify your identity, it may refuse to open the account, allow temporary use while verification continues, or close an account after verification attempts fail. In some cases it will also file a suspicious activity report with FinCEN.
When a denial is based in whole or in part on information from a consumer reporting agency, that counts as an adverse action. Federal law requires the institution to send you a written notice identifying the reporting agency whose information was used, stating that the agency didn’t make the decision, and informing you of your right to a free copy of the report and to dispute any inaccuracies.14Office of the Law Revision Counsel. 15 USC 1681m – Requirements on Users of Consumer Reports That dispute right matters. Errors in consumer reporting databases are more common than most people realize, and correcting one can resolve a denial that had nothing to do with actual risk.
Even after a denial, the institution still has to keep what it collected. For consumer credit applications, the retention period is 25 months from the date you’re notified of the decision. For business credit applications, it’s generally 12 months.15Consumer Financial Protection Bureau. Regulation B – 1002.12 Record Retention
If You Lie on the Application
Giving false information to a bank is a federal crime. Knowingly making a false statement to influence the action of a federally insured bank, credit union, mortgage lender, or similar institution can result in a fine of up to $1,000,000, a prison sentence of up to 30 years, or both.16Office of the Law Revision Counsel. 18 USC 1014 – Loan and Credit Applications Generally Those maximums aren’t typical sentences for simple misrepresentations, but the statute reaches a broad range of conduct, from inflating income on a mortgage application to fabricating identity documents.
The statute applies per count, so each false statement on each application can be charged separately. Prosecutors don’t need to prove the bank actually relied on the false information or that anyone lost money. The act of making the statement with intent to influence is enough. People get tripped up on things that feel minor: using a family member’s address because theirs is “complicated,” or fudging employment details after a recent job change. Those still meet the statutory definition.