A US bank's KYC duties come from several regulations working together: the Customer Identification Program rule, the beneficial ownership rule, and the AML program rule with its requirement for ongoing customer due diligence. Specific rules add more for correspondent and private banking accounts.
Itexus is a trusted partner
Itexus delivered the app according to the requirements. The team met all development milestones and deliverables. They were efficient, friendly, and cooperative. Itexus team was very timely with updates, a regular meeting cadence, and ad-hoc questions and answers via Slack. The team was very responsive and still is.
Stive Jackson
RMD, Investing Fund
Itexus’ work positions the business well for an imminent launch. They excel at managing their team, presenting frequent product demos to ensure that the project is aligned with development goals. An affordable price structure coupled with remarkable technical skill makes them an attractive partner.
Phill Osolinski
CEO Ryze Rewards
The assigned team was easy to work with and they are especially strong collaborators and communicators. They demonstrated flexibility, professionalism, and trust in everything they did, and completed the work on time and budget.
Sue Wollan Fan
CEO Mango Connects
Itexus excelled at both experimental AI and sprint-oriented UI/UX tasks. Itexus did strong project management work, too, a necessity in such a complicated project.
Jesse Dubin
Senior PM Standard&Poors
They’re a great group of developers who really understand the reality of business.
Andreea Vanacker
CEO SPARKX5
This guide walks through those requirements from the rule text and flags where a 2025 or 2026 regulatory order now changes how the text applies. For a comparison with the EU and UK, see our overview of KYC requirements in the US, EU and UK.
The requirements at a glance
| Requirement | Rule | What the bank must do |
| Customer identification | 31 CFR 1020.220 | Collect identifying data before opening an account, and verify identity within a reasonable time after |
| Beneficial owners | 31 CFR 1010.230 and order FIN-2026-R001 | Identify and verify owners and one control person of legal entity customers |
| AML program | 31 CFR 1020.210 | Internal controls, independent testing, a responsible individual, training and ongoing customer due diligence |
| Correspondent accounts | 31 CFR 1010.610 | Risk-based due diligence for foreign financial institutions, enhanced for certain foreign banks |
| Private banking | 31 CFR 1010.620 | For accounts of non-US persons with a $1,000,000 minimum: due diligence on owners, source of funds and account activity, with enhanced scrutiny for senior foreign political figures |
Customer Identification Program
Who and what the rule covers
The definitions in 31 CFR 1020.100 decide when the CIP applies. An account is "a formal banking relationship" that includes deposit, transaction, asset and credit accounts, plus safety deposit, cash management, custodian and trust services. Check cashing, wire transfers and the sale of a check or money order are not accounts, and neither are accounts a bank acquires through a merger or similar transaction, or accounts opened to participate in an ERISA employee benefit plan.
A customer is a person who opens a new account, or an individual who opens one for someone who lacks legal capacity, such as a minor, or for an entity that is not a legal person, such as a civic club. Excluded are financial institutions regulated by a federal functional regulator, banks regulated by a state bank regulator, persons described in 31 CFR 1020.315(b)(2) through (b)(4), and a person with an existing account where the bank has a reasonable belief that it knows the person's true identity.
Banks do not read this rule alone. The OCC, FDIC, Federal Reserve and NCUA each have a section tying their institutions to it, and to a written compliance program approved by the board. The Federal Reserve's section still cites the rule's former location, 31 CFR 103.121.
What to collect
31 CFR 1020.220 requires the following before an account is opened, with narrow exceptions for customers who have applied for a TIN and for credit card accounts:
- name
- date of birth, for an individual
- address: for an individual, a residential or business street address, or for someone without one, an APO or FPO box number or the street address of next of kin or another contact; for an entity, a principal place of business, local office or other physical location
- identification number: a taxpayer identification number for a US person, and for a non-US person a TIN, passport number and country of issuance, alien identification card number, or the number and country of issuance of another government-issued document that evidences nationality or residence and bears a photograph or similar safeguard
Outside the credit card exception, the rule's text says this information comes from the customer. Orders issued in 2025 now let banks under those four regulators obtain the TIN from a third party: one from the OCC, FDIC and NCUA and a matching order from the Federal Reserve, both with FinCEN's concurrence. Using either order "is optional", and the bank must still have risk-based procedures that enable it to obtain the TIN before the account is opened.
How to verify
The standard is that the bank can "form a reasonable belief that it knows the true identity of each customer". Verification must happen within a reasonable time after the account is opened, and the rule sets no fixed number of days. The bank's procedures must say when it uses documents, non-documentary methods or both. For some customers that are not individuals, the program must also address when the bank obtains information about individuals with authority or control over the account.
| Method | Examples named in the rule |
| Documents, individuals | Unexpired government-issued identification evidencing nationality or residence and bearing a photograph or similar safeguard, such as a driver's license or passport |
| Documents, entities | Documents showing the entity exists, such as certified articles of incorporation, a government-issued business license, a partnership agreement or a trust instrument |
| Non-documentary | Contacting the customer, comparing information against a consumer reporting agency, public database or other source, checking references with other financial institutions, obtaining a financial statement |
Non-documentary procedures must address specific situations, including a customer who cannot present an unexpired government ID, documents the bank is not familiar with, an account opened without documents, and a customer who opens the account without appearing in person. That last one matters for any digital bank.
When verification fails
The procedures should describe when the bank should not open an account, the terms under which a customer may use an account while verification continues, when to close an account after attempts have failed, and when to file a Suspicious Activity Report. For product teams, each of those is a state your system needs to represent.
Records and notice
The bank must keep all identifying information for five years after the account is closed, and for credit cards five years after the account is closed or becomes dormant. It must also keep a description of any document relied on, the methods and results of any other verification, and how any substantive discrepancy was resolved, for five years after the record is made. The text asks for a description of the document, including its type, number, place of issuance and dates. Customers must receive adequate notice that the bank is requesting information to verify their identities. The program must also include procedures for checking any federal list of known or suspected terrorists that Treasury designates for this purpose.
Beneficial owners of company customers
For legal entity customers, 31 CFR 1010.230 requires identifying and verifying each individual who owns 25 percent or more of the equity interests, and one individual with significant responsibility to control, manage or direct the company. Some customers are excluded, and some accounts are exempt.
The rule text says this happens when a new account is opened. FinCEN's order FIN-2026-R001 of 13 February 2026 lets institutions instead limit it to the first account, to cases where they know facts that reasonably call the existing information into question, and to what their risk-based procedures require. Using this relief is at the institution's discretion. We cover the detail, including the certification form and ownership calculations, in our guide to KYC requirements for corporates.
The five pillars of an AML program
31 CFR 1020.210 requires a program that includes, at a minimum:
- a system of internal controls to assure ongoing compliance
- independent testing, by bank personnel or an outside party
- a designated individual or individuals responsible for day-to-day compliance
- training for appropriate personnel
- risk-based procedures for ongoing customer due diligence
"Five pillars" is industry shorthand, and the program must also meet 31 CFR 1010.610 and 1010.620 and the bank's regulator's rule. The fifth pillar covers understanding the nature and purpose of customer relationships in order to develop a customer risk profile, and ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information.
These requirements may change. FinCEN's April 2026 proposal would "fundamentally reform" program requirements, but as of this writing it is a proposal.
How often must a bank refresh customer data?
Under the CDD rule, on a risk basis rather than a fixed calendar. FinCEN's FAQs say: "There is no categorical requirement that financial institutions update customer information on a continuous or periodic schedule." The update is risk based and arises from normal monitoring, and when the institution learns of a relevant change, it must update the information. The same FAQs say institutions do not have to solicit or update beneficial ownership information as a matter of course during regular or periodic reviews, absent specific risk-based concerns.
This is a real difference from the EU, where the AMLR will set maximum periods between updates from July 2027: one year for higher-risk customers and five years for all others. A bank's own policy can still set fixed review cycles.
Enhanced due diligence
Two sets of rules name specific extra steps.
Correspondent accounts. 31 CFR 1010.610 requires appropriate, specific, risk-based and, where necessary, enhanced policies for correspondent accounts for foreign financial institutions, including assessing money laundering risk. For certain foreign banks, enhanced due diligence includes enhanced scrutiny, obtaining and considering information about the foreign bank's AML program, and monitoring transactions through the account, as appropriate. The bank must also determine whether the foreign bank serves other foreign banks through the account and, if so, take reasonable steps to obtain information on the risks, including, as appropriate, their identity. For banks that are not publicly traded, it must identify each owner of 10 percent or more.
Private banking. 31 CFR 1010.620 applies to a defined private banking account: one with a minimum aggregate deposit of at least $1,000,000, held for one or more non-US persons, and managed through a bank officer, employee or agent acting as a liaison. The bank must take reasonable steps to ascertain the identity of all nominal and beneficial owners, whether any of them is a senior foreign political figure, the source of funds and the purpose and expected use of the account, and must review account activity. Senior foreign political figures get enhanced scrutiny.
For other higher-risk customers, extra scrutiny generally flows from the bank's own risk-based procedures. Sanctions screening is a separate regime administered by OFAC, though it is often built into the same onboarding flow.
What enforcement shows
Recent orders show that due diligence fails on substance, not only on paperwork. Both cases below cover more than KYC, so the amounts are not fines for CDD alone.
- Bank of America. In consent order 2026-03, FinCEN imposed a $1.2 billion penalty across several violations, crediting $750 million paid to the OCC. On due diligence, it found that the bank "failed to develop customer risk profiles that adequately reflected the nature and purpose of its relationships with certain higher risk customers".
- Canaccord Genuity, a broker-dealer and not a bank. In an $80 million consent order covering its AML program, correspondent account due diligence and unfiled suspicious activity reports, FinCEN also found that the firm's written procedures "only set forth a requirement to collect documents" without requiring further evaluation of them.
What this means for a banking product team
These are our recommendations from delivery work, not legal requirements.
- Model the failure states. "Not opened", "in use on defined terms while verification continues", "closed after failed verification" and "SAR review" need to exist in the system, because the rule expects procedures covering each.
- Store the description of what was checked. Keep document type, number, place and dates, the method used and how discrepancies were resolved, with timestamps.
- Make non-documentary fallbacks explicit. Digital onboarding is exactly the case the rule calls out, so write down when each method applies.
- Feed monitoring back into the profile. A risk profile that does not absorb what monitoring and staff have flagged is the pattern FinCEN criticized.
At Itexus we have built digital onboarding and KYC flows for a Top-7 US credit union, with automated KYC and KYB checks and an integration into a legacy AS400 core, and for a white-label mobile banking app with KYC and document upload, and Socure as the identity verification provider. If you are planning similar work, see our banking app development services.
This article is general information and not legal advice. Requirements depend on your charter, regulator and products, so confirm your obligations with qualified counsel. Regulatory status was checked on 6 November 2026.
Frequently Asked Questions
What information does a bank need for KYC?
Under the CIP rule, generally a name, a date of birth for an individual, an address and an identification number, collected before an account is opened. For company customers, the bank also needs to identify and verify beneficial owners and one control person.
How long does a bank have to verify a customer's identity?
The rule says "within a reasonable time after the account is opened" and sets no fixed number of days. The bank's procedures define what that means in practice, including how the account can be used in the meantime.
Do banks have to refresh KYC every few years?
The CDD rule sets no fixed schedule for updating customer information. FinCEN says updating is risk based and arises from normal monitoring, and the information must be updated when the institution learns of a relevant change. A bank can still set review cycles in its own policy, and the EU will set maximum periods from July 2027.
Does a bank have to keep a copy of the customer's ID?
The rule requires a description of any document relied on, noting its type, any identification number, the place of issuance and any issue and expiry dates. It does not state a duty to keep a copy. Whether to keep one is a policy and privacy decision to confirm with counsel.
What are the five pillars of AML?
Internal controls, independent testing, a designated compliance individual, training, and risk-based ongoing customer due diligence. For banks they are set out in 31 CFR 1020.210.
