What Is KYC in Banking: Requirements, Verification, and Denials

Know Your Customer, or KYC in banking, is the federally required process a bank uses to confirm your identity before it opens an account for you and to monitor that account for suspicious activity afterward. At a minimum, you give the bank your full legal name, date of birth, address, and taxpayer identification number, and the bank verifies that information through documents, database checks, or both. The requirement applies to every U.S. bank and to every customer, and it continues for the life of your account.

Why Banks Are Required to Do This

KYC exists because federal law requires it. The Bank Secrecy Act of 1970 created the original framework directing financial institutions to keep records and file reports that help detect money laundering and other financial crimes.¹ After September 11, 2001, the USA PATRIOT Act added section 5318(l) to Title 31 of the U.S. Code, which directs the Treasury Department to set minimum identity-verification standards for every financial institution and requires each bank to run a Customer Identification Program (CIP).²

Treasury implemented those requirements in a regulation at 31 CFR 1020.220 that spells out what banks must collect, how they can verify it, and how long they must keep the records.³ A separate Customer Due Diligence Rule from FinCEN requires banks to build a risk profile for each customer and keep monitoring the relationship over time.⁴ Your bank isn’t asking for your ID out of caution. It’s asking because it has to.

What You Have to Provide

Federal regulations require the bank to collect four pieces of identifying information from every individual before opening an account:³

Your full legal name, matching your government-issued ID exactly.
Your date of birth.
A residential or business street address. If you don’t have a street address, the rule permits an APO or FPO box, or the street address of a next of kin or another contact person.
A taxpayer identification number. For U.S. residents, this is usually your Social Security number.

If you are not a U.S. citizen and don’t have an SSN, you can still open an account. The rule allows non-U.S. persons to supply a passport number and country of issuance, an alien identification card number, or the number from another government-issued document showing nationality or residence with a photograph.⁵ An Individual Taxpayer Identification Number (ITIN) also qualifies. Banks typically ask non-U.S. citizens for a valid foreign passport plus a secondary ID such as a visa or consular identification card, and the exact combination they accept varies, so ask before your appointment.

Business accounts follow a different checklist. Instead of a date of birth, the bank collects the entity’s principal place of business, and it verifies the entity’s existence using documents such as certified articles of incorporation, an unexpired government-issued business license, a partnership agreement, or a trust instrument.⁶ The entity provides a taxpayer identification number, usually an Employer Identification Number. Beneficial ownership rules for business customers are in flux: in February 2026, FinCEN granted covered financial institutions relief from collecting beneficial ownership information at each new account opening, following a March 2025 interim final rule that exempted U.S.-created entities from reporting beneficial ownership to FinCEN under the Corporate Transparency Act.⁷ Confirm the current requirements with your bank.

How the Bank Verifies You

Collecting the information is only the first half. The bank then has to verify it.

Documents

The most common method is a document check. You present an unexpired government-issued photo ID such as a driver’s license or passport, and some banks ask for a secondary document like a recent utility bill or lease to confirm your address.³ The federal rule does not require any specific secondary document. Many banks let you upload digital copies through an encrypted portal instead of visiting a branch.

Non-Documentary Methods

Federal rules also allow banks to verify you without documents. Approved non-documentary methods include checking your information against a consumer reporting agency, searching public databases, contacting references at other financial institutions, or obtaining a financial statement.³ Banks lean on these methods when you can’t present a valid photo ID, when you’re opening the account remotely, or when document review alone isn’t enough. Online applications often add digital techniques such as facial recognition and liveness detection, which confirm that the person submitting a selfie or video is a live human rather than a photo or recording.

Watchlist Screening

Every applicant’s name is checked against government lists of known or suspected terrorists and against the Office of Foreign Assets Control (OFAC) sanctions list, which names individuals and entities barred from the U.S. financial system.⁸ Larger banks run this screening through automated software that catches name variations; smaller banks may do it manually. A match, or even a close match, will delay your account opening while the bank investigates.

Overall, verification can be nearly instant when automated systems clear you electronically, or it can take several business days if the bank has to review documents by hand or resolve discrepancies. If something doesn’t line up, expect a request for additional documentation before approval.

What Happens After Your Account Is Open

KYC doesn’t end at approval. Banks are required to conduct ongoing monitoring of your account for the entire life of the relationship, watching transaction patterns and refreshing your information on a risk-adjusted basis.⁴

Reports the Bank May File

If your bank spots a transaction that could involve money laundering, fraud, or another legal violation, federal law authorizes the Treasury Secretary to require the bank to file a Suspicious Activity Report (SAR).² You won’t be told if a SAR is filed about your account; the law prohibits the bank from disclosing it.

Separately, banks must file a Currency Transaction Report for every cash transaction over $10,000, whether it’s a deposit, withdrawal, exchange, or transfer.⁹ This is routine paperwork, not a signal that the bank suspects you of anything. Deliberately breaking a large cash transaction into smaller amounts to stay under the $10,000 threshold, known as structuring, is itself a federal crime.

Enhanced Scrutiny for Some Customers

Customers judged to present a higher risk of money laundering or terrorist financing receive Enhanced Due Diligence: more detailed information at opening, more frequent transaction review, and documentation about the source of their funds and wealth.¹⁰ One trigger is status as a Politically Exposed Person, which covers individuals who hold or have held prominent government roles such as heads of state, senior officials, high-ranking judges, or military officers. Close family and associates of PEPs may draw the same heightened scrutiny.

Recordkeeping

The bank must keep records of the information it used to verify you for at least five years after your account closes.³ It also runs periodic updates so expired IDs get replaced and your contact information stays current.

How Your Information Is Protected

The personal data you hand over during KYC is protected under the Gramm-Leach-Bliley Act, which requires financial institutions to safeguard sensitive customer data and to disclose their information-sharing practices.¹¹ Under the GLBA, you have the right to opt out of certain information sharing with third parties. The FTC’s Safeguards Rule fills in the security details, requiring covered institutions to maintain a written information security program with administrative, technical, and physical safeguards appropriate to their size and the sensitivity of the data they hold.¹²

If Your Application Is Denied

KYC-related denials happen, and you have some tools. If the bank turned you down based partly on information from a checking account reporting company such as ChexSystems or Early Warning Services, it must give you an adverse action notice identifying the reporting company. You then have 60 days to request a free copy of your report from that company.¹³ Review the report for errors, such as wrong personal information, inaccurate balances, or signs of identity theft, and dispute mistakes with both the reporting company and the bank that supplied the incorrect information. The reporting company must investigate and tell you the result.

Not every rejection comes from your banking history. A denial can also flow from a sanctions-list hit, missing documentation, or a determination that you’re a Politically Exposed Person warranting enhanced scrutiny. In those cases, ask the bank what additional information or documents would resolve the issue. A false-positive sanctions match caused by a common name can often be cleared once you provide extra identifying details.

1
Financial Crimes Enforcement Network. The Bank Secrecy Act
2
Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority
3
eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
4
Financial Crimes Enforcement Network. Customer Due Diligence Final Rule
5
Financial Crimes Enforcement Network. CIP TIN Exemption Order
6
Federal Financial Institutions Examination Council. Customer Identification Program
7
Financial Crimes Enforcement Network. FinCEN Removes Beneficial Ownership Reporting Requirements for US Companies
8
Federal Financial Institutions Examination Council. Office of Foreign Assets Control
9
Federal Financial Institutions Examination Council. Currency Transaction Reporting
10
Federal Financial Institutions Examination Council. Customer Due Diligence
11
Federal Trade Commission. Gramm-Leach-Bliley Act
12
eCFR. 16 CFR Part 314 – Standards for Safeguarding Customer Information
13
Consumer Financial Protection Bureau. Helping Consumers Who Have Been Denied Checking Accounts