KYC verification, short for Know Your Customer, is the identity check a financial institution must complete before letting you open an account, move money, or use most financial services. Federal law requires banks, credit unions, money transmitters, cryptocurrency exchanges, broker-dealers, casinos, and similar businesses to confirm you are who you say you are, primarily to prevent money laundering, terrorist financing, and fraud. The rules come from the Bank Secrecy Act and were expanded after 2001 by Section 326 of the USA PATRIOT Act, which directed the Treasury Department to set minimum identity-verification standards.1Financial Crimes Enforcement Network. USA PATRIOT Act For most people, clearing KYC takes a few minutes and a few documents.
What You Need to Provide
The federal minimum for an individual customer is four pieces of information, collected before the account opens: your full legal name, your date of birth, your address, and an identification number. For U.S. citizens and residents, that number is your Social Security number or Individual Taxpayer Identification Number.2eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
Your address has to be a residential or business street address, not a P.O. box. If you genuinely don’t have one, the regulation accepts an APO or FPO military box number, or the street address of a next of kin or other contact person.2eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
To verify what you’ve entered, the institution will ask for an unexpired government-issued photo ID, typically a driver’s license or passport.2eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks Many also request a secondary document confirming your address, such as a recent utility bill or bank statement. If you’re uploading photos, make sure the full document is visible, text is readable, and there’s no glare over key details. Your name on the application has to match your ID exactly, middle names and suffixes included. A mismatch either delays the application or sends it to manual review.
If You’re Not a U.S. Citizen
Lacking a Social Security number does not disqualify you. A non-U.S. person can provide a passport number and country of issuance, an alien identification card number, or the number on another government-issued document that shows nationality or residence and carries a photograph.3Federal Deposit Insurance Corporation. Customer Identification Program A Taxpayer Identification Number works too, as does evidence you’ve applied for one.
Accounts Opened for a Child
When a parent or guardian opens an account on behalf of a minor, the institution’s customer for KYC purposes is the adult, not the child. The bank collects and verifies the parent’s or guardian’s name, date of birth, address, and taxpayer identification number under the same rules that apply to any individual account.4Financial Crimes Enforcement Network. Guidance to Encourage Youth Savings and Address FAQs You generally don’t need a government-issued photo ID for the child.
How the Check Actually Runs
Most KYC today happens through a secure portal or mobile app. After you enter your information and upload your documents, automated software compares what you submitted against multiple databases in real time. Many institutions now add a liveness check: you take a selfie or follow prompts to move your head while the camera is active, and the system compares that live image to the photo on your ID to confirm you’re physically present.
That biometric step matters more every year. In November 2024, FinCEN issued an alert about fraud schemes using deepfake media, meaning AI-generated images and videos, to defeat identity verification at financial institutions.5Financial Crimes Enforcement Network. FinCEN Issues Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions Detection tools now look for signs of synthetic media during the liveness capture.
Every check also screens your name against federal watchlists, most importantly the Specially Designated Nationals and Blocked Persons List maintained by the Treasury Department’s Office of Foreign Assets Control, along with its other sanctions lists.6U.S. Department of the Treasury. Sanctions List Search A direct or close name match sends the file to a compliance officer for manual review.
Why Verification Gets Rejected
Most rejections come from problems you can prevent. The frequent causes are blurred or unreadable images, mismatched information between the application and the ID (a nickname instead of a legal name, or an old address), and expired identification. Automated systems are sensitive to glare, shadows, and cropped edges, so retake the photo if any of those are present.
Beyond document errors, screening algorithms sometimes generate false positives on sanctions or watchlist checks. A human compliance officer then reviews the file. Approvals from fully automated systems can arrive in minutes; flagged files can take several business days. You’ll typically hear back by email or app notification with an approval, a denial, or a request for more documentation.
If a Bank Denies Your Account
If the denial relies on information from a checking-account screening company such as ChexSystems or Early Warning Services, federal law requires the bank to send you an adverse action notice listing the screening company’s name and contact information.7Consumer Financial Protection Bureau. Denied for a Bank Account – Heres What You Should Know You can then request a free copy of the report from that company and dispute inaccurate entries with both the screening company and the bank that furnished the data, using the same Fair Credit Reporting Act rights that apply to traditional credit reports. It’s also worth asking the bank whether it offers a second-chance or lower-risk account.
What Happens After You’re Approved
Passing KYC at the door isn’t the end of it. Federal regulations require institutions to conduct ongoing customer due diligence throughout the life of the account, monitoring activity for patterns that depart from what your profile would predict.8eCFR. 31 CFR 1020.210 – Anti-Money Laundering Program Requirements for Banks
Routine life events can trigger a re-verification request. An expired driver’s license or passport, a legal name change, a move, or a job change that shifts your expected transaction pattern can all prompt the bank to ask for updated documents. Ignoring those requests isn’t harmless; the institution can restrict access to the account or close it if your records fall out of date.
Reports That Run in the Background
Two reporting obligations operate behind the scenes. A bank must file a Suspicious Activity Report when a transaction involves $5,000 or more and the bank suspects the funds are tied to illegal activity, that the transaction is structured to evade reporting, or that it has no apparent lawful purpose. Filing is required within 30 days of detection, with up to 60 days allowed if the bank still needs to identify a suspect.9eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions The law prohibits the bank from telling you a SAR was filed.
Separately, every financial institution other than a casino must file a Currency Transaction Report for any transaction involving more than $10,000 in cash.10eCFR. 31 CFR 1010.311 – Filing Obligations for Reports of Transactions in Currency The report is automatic and does not imply wrongdoing. Deliberately breaking a cash transaction into smaller amounts to stay below $10,000 is itself a federal crime.
Enhanced Due Diligence
Some accounts draw a closer look. When an institution’s risk procedures flag a customer as higher risk, it applies enhanced due diligence: unusually large or complex transactions, connections to high-risk regions, or facts that contradict earlier information can all be triggers.11Financial Crimes Enforcement Network. FinCEN Issues Exceptive Relief to Streamline Customer Due Diligence Requirements Expect requests for additional documentation on the source of funds, the purpose of specific transactions, or updated personal details.
One common assumption to set aside: there is no federal regulatory requirement that banks screen for politically exposed persons at account opening. Banks may do it as part of their own risk assessment, but it’s a business choice, not a legal mandate.12FFIEC BSA/AML Manual. Risks Associated With Money Laundering and Terrorist Financing – Politically Exposed Persons
Which Businesses Have to Verify You
Banks and credit unions are the clearest case. The Customer Identification Program regulation requires any bank with an anti-money laundering program to verify every customer who opens an account.2eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
The reach goes well beyond banking. Casinos maintain their own anti-money laundering programs with procedures for verifying names, addresses, and Social Security numbers when transactions trigger reporting thresholds.13eCFR. 31 CFR 1021.210 – Anti-Money Laundering Program Requirements for Casinos Money services businesses, including money transmitters, check cashers, currency exchangers, and sellers of prepaid access products, follow parallel rules.14eCFR. 31 CFR Part 1022 – Rules for Money Services Businesses Cryptocurrency exchanges that act as money transmitters fall under the same umbrella. Broker-dealers, mutual funds, and insurance companies each have their own CIP regulations under the Bank Secrecy Act framework.
How Your Documents Are Protected
Handing over a Social Security number, a passport scan, and a home address raises reasonable questions about what happens next. Federal law addresses this through retention limits and security standards.
Banks must keep the identifying information you provided for five years after the account closes. Records of how the bank verified your identity, including which documents it reviewed, the methods used, and how any discrepancies were resolved, must be retained for five years from the date the record was created.15eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
For security, the Gramm-Leach-Bliley Act’s Safeguards Rule requires financial institutions to maintain a written information security program with specific controls:16eCFR. 16 CFR Part 314 – Standards for Safeguarding Customer Information
- Customer information must be encrypted both at rest and when transmitted over external networks.
- Only authorized personnel may access your information, and only the specific data their job requires.
- Anyone accessing the institution’s information systems must use multi-factor authentication.
- The institution must run annual penetration tests and vulnerability assessments at least every six months.
- Customer information must be securely disposed of no later than two years after it was last used to provide a product or service, unless a legal obligation requires keeping it longer.
Each institution must also designate a qualified individual responsible for the information security program and conduct periodic written risk assessments of threats to customer data. The same protections apply to the KYC documents you submitted along with everything else held about you.