Know Your Customer, or KYC, is the federally required process a bank uses to confirm who you are before it lets you open an account, and then to keep tabs on that account for as long as it stays open. At a minimum, you have to give the bank your full legal name, date of birth, address, and taxpayer identification number, and the bank has to verify that information using documents or other reliable methods. KYC in banking exists because federal law makes it mandatory, not because any individual bank chose to ask.
The Laws That Require It
Two federal statutes do most of the work. The Bank Secrecy Act of 1970 first required financial institutions to keep records and file reports that help detect money laundering, tax evasion, and other financial crimes.1Financial Crimes Enforcement Network. The Bank Secrecy Act After September 11, 2001, Title III of the USA PATRIOT Act added 31 U.S.C. 5318(l), which tells the Treasury Department to set minimum identity-verification standards for every financial institution. Under that section, banks must run a Customer Identification Program (CIP) that verifies each new customer’s identity, keeps records of what was used to verify it, and checks the applicant’s name against government lists of known or suspected terrorists.2Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority
Treasury’s implementing regulation at 31 CFR 1020.220 spells out the specifics: what information banks must collect, which verification methods they can use, and how long they must keep the records.3eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks A separate Customer Due Diligence (CDD) Rule then requires banks to build a risk profile for each customer and monitor the relationship over time.4Financial Crimes Enforcement Network. Customer Due Diligence Final Rule
What You Have to Provide
Federal rules require four pieces of information from every individual opening an account:3eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
- Your full legal name, matching your government-issued ID exactly.
- Your date of birth.
- A residential or business street address. If you don’t have a street address, the regulation permits an APO or FPO box number, or the street address of a next of kin or another contact person.
- A taxpayer identification number, which for U.S. residents is typically a Social Security Number.
Non-U.S. persons without an SSN can give a passport number and country of issuance, an alien identification card number, or a number from another government document showing nationality or residence and carrying a photograph. An Individual Taxpayer Identification Number (ITIN) also works.5Financial Crimes Enforcement Network. CIP TIN Exemption Order Most banks ask non-U.S. citizens for a valid foreign passport plus a secondary form of ID such as a visa or consular identification card. The exact combination varies by bank, so ask before your appointment.
How the Bank Verifies You
Verification is separate from collection. The most common method is documents: an unexpired government-issued photo ID such as a driver’s license or passport, sometimes paired with a utility bill or lease to confirm the address.3eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks The regulation doesn’t mandate any particular secondary document, and many banks now let you upload digital copies through an encrypted portal instead of coming to a branch.
Documents are not the only route. Federal rules also allow non-documentary verification, which can include checking your information against a consumer reporting agency, searching public databases, contacting references at other financial institutions, or obtaining a financial statement. Banks are expected to use non-documentary methods when you can’t present a valid photo ID, when you’re opening an account remotely, or when documents alone aren’t enough.3eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks For online applications, that increasingly means facial recognition and liveness detection, which confirm that the person submitting a selfie or video is a live human rather than a photo or recording.
There’s one step you may not see. Banks must screen every applicant’s name against the Office of Foreign Assets Control (OFAC) sanctions list before opening the account, or shortly after. Larger banks do this with automated software that catches name variations; smaller institutions with lower volumes may do it manually.6Federal Financial Institutions Examination Council. Office of Foreign Assets Control A match, or even a close match, typically pauses your application while the bank investigates.
All told, verification can be almost instantaneous when systems confirm you electronically, or it can take several business days if a person has to review your documents or resolve a discrepancy.
Business Accounts Work Differently
If you’re opening an account for a corporation, partnership, or trust rather than yourself, the entity replaces some of the individual data points. Instead of a date of birth, the bank collects the entity’s principal place of business. Acceptable proof of the entity’s legal existence includes certified articles of incorporation, an unexpired government-issued business license, a partnership agreement, or a trust instrument, along with a taxpayer identification number such as an EIN.7Federal Financial Institutions Examination Council. Customer Identification Program
Beneficial ownership rules for business accounts have been shifting. In February 2026, FinCEN granted covered financial institutions relief from the requirement to collect beneficial ownership information at each new account opening. That followed a March 2025 interim final rule exempting all U.S.-created entities from reporting beneficial ownership under the Corporate Transparency Act and limiting that filing obligation to entities formed under foreign law that have registered to do business in a U.S. state or tribal jurisdiction.8Financial Crimes Enforcement Network. FinCEN Removes Beneficial Ownership Reporting Requirements for US Companies Because this area is moving, confirm the current requirements with your bank before you apply.
What Happens After Your Account Is Open
KYC doesn’t end at approval. Banks are required to monitor accounts for the length of the relationship, watch for suspicious activity, and periodically refresh customer information on a risk-adjusted basis.4Financial Crimes Enforcement Network. Customer Due Diligence Final Rule Records of the information used to verify your identity have to be kept for at least five years after the account is closed.3eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
Two reports are worth knowing about. A Suspicious Activity Report (SAR) is filed when a bank spots a transaction that could involve money laundering, fraud, or another violation of law. The law prohibits the bank from telling you a SAR was filed, so you won’t be notified.2Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority A Currency Transaction Report (CTR) is different: banks must file one for every cash transaction over $10,000, whether it’s a deposit, withdrawal, exchange, or transfer. A CTR is routine and doesn’t mean the bank suspects wrongdoing.9Federal Financial Institutions Examination Council. Currency Transaction Reporting Deliberately splitting a large cash transaction into smaller amounts to stay under the threshold, known as structuring, is itself a federal crime.
Higher-Risk Customers
Some customers get Enhanced Due Diligence (EDD): more detailed information at account opening, closer transaction review, and documentation about the source of funds and wealth.10Federal Financial Institutions Examination Council. Customer Due Diligence Politically Exposed Persons (PEPs), meaning individuals who hold or have held prominent government roles such as heads of state, senior officials, high-ranking judges, or military officers, are one category that triggers EDD. Close family and associates of PEPs may also see heightened scrutiny.
How Your Information Is Protected
The personal information you share during KYC is covered by the Gramm-Leach-Bliley Act, which requires financial institutions to safeguard sensitive customer data and disclose their information-sharing practices. Under the GLBA, you have the right to opt out of certain sharing with third parties.11Federal Trade Commission. Gramm-Leach-Bliley Act The FTC’s Safeguards Rule at 16 CFR Part 314 requires covered institutions to maintain a written information security program with administrative, technical, and physical safeguards appropriate to their size and the sensitivity of the data they hold.12eCFR. 16 CFR Part 314 – Standards for Safeguarding Customer Information
If Your Application Is Denied
If a bank denies you based partly on information from a checking account reporting company such as ChexSystems or Early Warning Services, it must send you an adverse action notice identifying the company. You then have 60 days to request a free copy of your report.13Consumer Financial Protection Bureau. Helping Consumers Who Have Been Denied Checking Accounts Review the report for wrong personal information, inaccurate balances, or signs of identity theft. You can dispute errors with the bank that furnished the information and with the reporting company, which must investigate and notify you of the results.
Denials also happen for reasons that have nothing to do with your banking history: a name that triggers a sanctions-list match, documentation the bank can’t accept, or a PEP determination requiring more scrutiny. Ask the bank what it needs to resolve the issue. A false positive from a common name can often be cleared once you submit additional identifying information.