Know Your Customer, or KYC, is the set of federal requirements that force your bank to verify who you are, judge how risky your account might be, and watch your transactions for as long as the account stays open. The rules apply to every checking account, loan, and brokerage relationship in the United States, and they apply to you as much as to the bank: if you can’t or won’t provide what the bank asks for, your application gets denied, or an existing account gets frozen or closed. Under KYC, the Know Your Customer bank requirements come from the Bank Secrecy Act and the USA PATRIOT Act, and they’re administered by the Financial Crimes Enforcement Network (FinCEN) inside the Treasury Department.1Financial Crimes Enforcement Network. The Bank Secrecy Act2Office of the Law Revision Counsel. 31 U.S.C. 5311 – Declaration of Purpose
What Your Bank Must Collect Before Opening an Account
The first stage of KYC is the Customer Identification Program (CIP). Before a bank opens any account for you, federal regulations require it to collect four pieces of identifying information:
- Your full legal name.
- Your date of birth (individuals only, not entities).
- A residential or business street address. If you don’t have one, a military APO/FPO box or the address of a next-of-kin or other contact is acceptable.
- An identification number. For U.S. persons this is a taxpayer identification number, usually a Social Security Number. For non-U.S. persons, the regulation accepts a taxpayer identification number, a passport number with country of issuance, an alien identification card number, or another government-issued document showing nationality or residence.3eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
The bank then verifies that information. The usual method is a current government-issued photo ID: a passport, driver’s license, or state ID. Many banks also want separate proof of address such as a utility bill, lease, or bank statement dated within the last 90 days, especially when the ID address doesn’t match the application.
If You Don’t Have a Social Security Number
You do not need a Social Security Number to open a bank account in the United States. The CIP regulation explicitly allows alternatives, and in practice banks commonly accept an Individual Taxpayer Identification Number (ITIN), a passport, or a consular identification card.3eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks If you’re a non-citizen or non-resident, the bank may also ask you to complete an IRS Form W-8 at account opening. Which documents any specific bank will accept varies, so call before you visit.
How the Bank Decides How Risky You Are
Customer Due Diligence (CDD) is the step where KYC moves past your ID and starts evaluating the account itself. The bank asks about your occupation, the purpose of the account, and the kinds of transactions you expect to run through it. From that, it builds a risk profile and assigns a rating, typically low, medium, or high.
A salaried employee opening a personal checking account with direct deposit lands in the low-risk bucket. Frequent international wire activity or a cash-intensive business pushes the rating up. The rating drives how closely the bank watches the account and how often it refreshes your information. The bank has little discretion here. FinCEN requires the assessment, and examiners check whether banks actually perform it.
Business Accounts and Beneficial Ownership
Opening an account for a corporation, LLC, or partnership adds a layer. FinCEN’s CDD rule requires banks to identify and verify the beneficial owners of the entity: any individual who owns 25 percent or more of the equity, plus at least one individual with significant control such as a CEO, CFO, or managing member.4eCFR. 31 CFR 1010.230 – Beneficial Ownership Requirements for Legal Entity Customers The bank collects a name, date of birth, address, and identification number for each qualifying individual, along with the entity’s Employer Identification Number and formation documents.5FinCEN. Information on Complying with the Customer Due Diligence (CDD) Final Rule
This obligation sits on the bank and applies at account opening regardless of any changes to separate reporting programs like the Corporate Transparency Act.
Ongoing Monitoring and Suspicious Activity Reports
KYC does not end when your account opens. Banks continuously monitor transactions against the risk profile they built during due diligence. Automated systems flag activity that falls outside your expected pattern: a sudden jump in volume, a large incoming wire from an unusual country, or a series of deposits sitting just under the reporting threshold (a tactic called structuring).
When a flag survives the bank’s internal review, the compliance team files a Suspicious Activity Report (SAR) with FinCEN. The filing deadline is 30 calendar days from the date the bank first detects facts suggesting a reportable transaction. If no suspect has been identified by then, the bank gets another 30 days to try, but the report cannot be delayed beyond 60 days after initial detection.6eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions Situations that need immediate attention also trigger a phone call to law enforcement.
You will not be told a SAR was filed. Federal “tipping off” rules prohibit the bank from mentioning it, because SARs are law-enforcement intelligence, not dispute paperwork. Asking the bank directly won’t produce an answer.
When Enhanced Due Diligence Applies
Enhanced Due Diligence (EDD) is a heavier version of the standard process. It means more documentation, deeper investigation into where your money comes from, and more frequent account reviews. Two categories drive most EDD cases.
Politically Exposed Persons
A Politically Exposed Person (PEP) is someone who holds or has held a prominent government role, such as a head of state, senior legislator, military commander, or executive of a state-owned enterprise. Since 2012, the Financial Action Task Force (FATF) has extended mandatory PEP treatment to both foreign and domestic officials and to leaders of international organizations.7FATF. Politically Exposed Persons (Recommendations 12 and 22) Close family and known associates of PEPs get the same heightened scrutiny, because corruption tends to move through people adjacent to power.
For a PEP account, banks generally require senior management approval before opening, want to understand the source of wealth and source of funds, and review the account more frequently, often annually.
High-Risk Countries
The FATF publishes lists of countries with weak anti-money-laundering controls, and FinCEN passes those designations through to U.S. banks. As of February 2026, Iran, North Korea, and Burma sit in the most severe designation; the FATF calls for countermeasures against Iran and North Korea, while Burma is subject to enhanced due diligence rather than full countermeasures.8Financial Crimes Enforcement Network. Financial Action Task Force Identifies Jurisdictions with Anti-Money Laundering, Combating the Financing of Terrorism, and Counter-Proliferation Finance Deficiencies A separate “increased monitoring” list covers countries working through identified deficiencies. If you send money to or receive money from individuals or businesses in any of these jurisdictions, expect more questions and more frequent reviews.
Source of Wealth Verification
EDD accounts require the bank to document where your money comes from, not just where it goes. A high-net-worth customer might need to produce tax returns, audited financial statements, or sale agreements for a business or real estate. The compliance team compares stated source of wealth against actual account activity. Claim consulting income while the account clears real estate purchases and the bank will follow up. Those consistency checks recur through the life of the account, not just at opening.
What Happens If You Give False or Incomplete Information
Lying on a bank application is not a gray area. Knowingly using false information to defraud a financial institution or obtain its assets is bank fraud, punishable by up to 30 years in prison and fines up to $1,000,000.9Office of the Law Revision Counsel. 18 U.S. Code 1344 – Bank Fraud That covers fabricated ID documents and misrepresentations on a loan application alike.
Even without a criminal case, refusing to provide updated KYC documentation or giving inconsistent answers can get your account frozen or closed. Banks under their own regulatory pressure have little patience for it. A freeze triggered by a KYC deficiency usually lasts until you supply the missing paperwork and compliance verifies it, which can run from a few days to several weeks. You lose access to your funds during that period. If the bank concludes the risk is too high, it closes the account and mails a cashier’s check for the balance.
If Your Account Application Is Denied
Banks sometimes deny applications based on information from specialized consumer reporting agencies like ChexSystems or Early Warning Services. These databases track prior overdrafts, suspected fraud, and involuntary closures. When a denial rests on one of these reports, you have rights under the Fair Credit Reporting Act.
The bank must tell you which reporting agency supplied the information. You’re entitled to a free copy of that report within 60 days of the adverse action notice. Read it carefully. If something is wrong, dispute it with both the reporting agency and the bank that furnished the data. The agency has to investigate and report back to you.10Consumer Financial Protection Bureau. Helping Consumers Who Have Been Denied Checking Accounts
If the bank won’t resolve the issue, escalate to the Consumer Financial Protection Bureau. The CFPB takes complaints online, sends them to the company, and generally requires a response within 15 days.11Consumer Financial Protection Bureau. Submit a Complaint You get 60 days to review the response. A complaint doesn’t guarantee a favorable outcome, but it creates a record and applies regulatory pressure.
How Long Your KYC Records Are Kept
Everything the bank collects during KYC, including copies of your identification, verification notes, and transaction monitoring records, must be retained for five years after the account closes.12FFIEC BSA/AML InfoBase. Appendix P – BSA Record Retention Requirements Law enforcement investigations or Treasury orders can extend that further on a case-by-case basis. Your information persists well beyond the end of the relationship, which matters if you ever need to dispute past activity or respond to a government inquiry about an account you closed years ago.