A KYC form is the “know your customer” questionnaire that a bank, credit union, brokerage, or other financial institution uses to collect your personal information and confirm your identity before opening your account. At a minimum it asks for your full legal name, date of birth, residential address, and a taxpayer identification number, and you back those answers with an unexpired government-issued photo ID and a recent document proving where you live. Federal law requires every covered institution to run this check, so refusing or failing it means the institution cannot legally do business with you.
Why the Form Exists
Section 326 of the USA PATRIOT Act directs financial institutions to run a Customer Identification Program, or CIP, that sets minimum standards for verifying who their customers are when accounts are opened.1Financial Crimes Enforcement Network (FinCEN). USA PATRIOT Act The point is to keep the financial system from being used to launder money or fund terrorism. A companion regulation, the Customer Due Diligence Rule, adds four obligations: identify and verify each customer, identify the beneficial owners of any company opening an account, understand the nature and purpose of the relationship, and monitor for suspicious activity going forward.2Financial Crimes Enforcement Network (FinCEN). Information on Complying with the Customer Due Diligence (CDD) Final Rule
Banks, credit unions, broker-dealers, mutual funds, futures commission merchants, and introducing brokers in commodities all fall under these rules.3eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks Many fintech apps and cryptocurrency platforms run KYC as well, though the specific regulatory framework for some of those businesses is still developing. The practical experience is the same wherever you go: fill out the form, hand over your documents, get verified, then get access.
What the Form Asks You for
Federal regulations set a floor for the personal data an institution must collect before opening an account for an individual. The four required data points are:
- Full legal name, exactly as it appears on your government-issued ID.
- Date of birth.
- A residential street address, not a P.O. Box. If you don’t have a fixed address, an APO or FPO box or the address of a close relative or contact person can substitute.
- A taxpayer identification number. For U.S. persons that’s typically your Social Security Number. Non-U.S. persons can provide a passport number with country of issuance, an alien identification card number, or another government-issued ID number.
These four come directly from the CIP regulation and represent the minimum.3eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks Most institutions collect more. Expect questions about your occupation, employer, the source of the funds you plan to deposit, and the general purpose of the account. That information lets the compliance team build a risk profile and set a baseline for what normal activity on your account should look like.
If You’re Opening a Business or Entity Account
When a company, partnership, or trust opens an account, the institution has to identify both the entity and the real people behind it. Entity verification calls for documents like articles of incorporation, a government-issued business license, a partnership agreement, or a trust instrument.3eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
On top of that, the institution has to identify each beneficial owner. Under the CDD Rule, a beneficial owner is any individual who owns 25 percent or more of the equity interests, plus at least one person with significant management responsibility, such as a CEO, CFO, or managing member.4eCFR. 31 CFR 1010.230 – Beneficial Ownership Requirements for Legal Entity Customers Each of those people goes through the same personal identification process as any individual customer. If a trust holds a stake of 25 percent or more, the trustee is treated as the beneficial owner for that interest.
Documents to Bring or Upload
Proof of Identity
The CIP regulation lets banks verify identity through documents, non-documentary methods, or both. In practice, almost every institution starts by asking for an unexpired government-issued photo ID. The rule names a driver’s license and passport as examples, though any government-issued identification showing your nationality or residence and bearing a photograph qualifies.3eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks A state ID card or military ID works at most institutions.
Some institutions require a second form of identification, particularly when you open the account in a branch. Common secondary IDs include a debit or credit card, an employee or student ID, a Social Security card, or any ID issued by a recognized business, school, or government agency. Requirements vary, so check before you go.
Proof of Address
If your photo ID shows your current residential address, that may be enough. If not, you’ll need a separate document linking your name to your physical address. Accepted documents typically include a recent utility bill, a bank or credit card statement, a current lease or rental agreement, or a government-issued letter. These usually need to be no more than three months old. Blurry scans, cropped images, and screenshots are common reasons for rejection during digital uploads.
When You Can’t Present a Standard Document
The CIP regulation requires banks to have procedures for verifying identity through non-documentary methods when a customer can’t present an unexpired photo ID, opens an account remotely, or presents documents the bank isn’t familiar with. Those methods include cross-referencing your information against consumer reporting agencies, public databases, or other financial institutions.3eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks This is how most digital-only banks and fintech apps verify you: they pull data from credit bureaus and government databases in the background, sometimes asking you to confirm details from your credit history as an additional check.
If You’re Not a U.S. Person
The rules still let you open an account, but the identification piece shifts. Instead of a Social Security Number, you can provide a passport number and country of issuance, an alien identification card number, or the number from any other government-issued document that shows nationality or residence and includes a photograph.3eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks An Individual Taxpayer Identification Number (ITIN) is accepted but not always required if you haven’t been issued one.
Most banks ask non-U.S. persons for two forms of identification, a primary ID like a foreign passport or consular ID card and a secondary ID such as a foreign driver’s license or credit card. You’ll also need proof of both your home country address and your U.S. physical address. The exact combination of acceptable documents varies by institution, so call ahead to avoid making the trip twice.
How the Institution Verifies What You Submit
Most people now complete KYC through a secure online portal or mobile app. You upload photos of your ID, enter your details, and in many cases the system runs an automated check within minutes. Behind the scenes the app compares your document against databases, confirms the ID hasn’t been reported stolen, and sometimes uses facial recognition to match a selfie against the photo on your ID. In-person verification is still available and is sometimes required for higher-value accounts.
The compliance team reviews flagged submissions manually. The most common reasons for rejection are straightforward: a name spelled differently on the form than on the ID, an expired document, an address that doesn’t match, or an image too blurry to read. If your submission is rejected, you’ll get a notification explaining the issue and a chance to resubmit. Once verification succeeds, the account becomes fully operational.
What Happens If You Refuse or Fail
This part has real teeth. If the institution cannot verify your identity within a reasonable time after the account is opened, the CIP regulation requires it to have procedures for that situation, and those procedures can include closing the account.3eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks In practice, most institutions simply won’t let you open the account at all until verification is complete.
If you’re already a customer and the institution requests updated KYC documents during a periodic review, ignoring the request leads to escalating consequences. The bank may restrict your transactions, block outgoing transfers, or freeze the account entirely while the review is pending. Banks are also required to file Suspicious Activity Reports when they see red flags such as customers using falsified identification, changing a transaction after being told ID is required, or structuring transactions just below reporting thresholds. Once a SAR is filed, the bank is legally prohibited from telling you about it.5Financial Crimes Enforcement Network (FinCEN). Suspicious Activity Reporting Requirements
Keeping the Information Current After You Open the Account
KYC doesn’t stop when the account opens. Institutions are required to conduct ongoing monitoring and periodically refresh customer information so records stay accurate and risk assessments stay current.6FFIEC BSA/AML InfoBase. FFIEC BSA/AML Manual – Introduction – Customers How often depends on your risk rating. A typical institutional policy might review high-risk customers annually, medium-risk customers every two years, and low-risk customers every three years, though timelines vary.
Between reviews, update your profile whenever something significant changes: a new legal name after marriage, a new residential address, a different employer, or a major shift in your financial situation. Ignoring a refresh request is one of the fastest ways to trigger account restrictions, because the institution has no way to tell whether you’re just busy or deliberately hiding something, and regulators expect banks to treat silence as a risk signal.