KYC Requirements in 2026: What US, EU and UK Rules Actually Require

KYC requirements are the rules that make a regulated firm identify its customers, verify who they are, understand who owns them and keep watching the relationship afterwards. There is no single KYC law. In the US the duties are spread across several Bank Secrecy Act regulations, in the EU they are being pulled into one regulation that applies from July 2027, and in the UK they sit in the Money Laundering Regulations 2017.

This area has also moved quickly. Several rules changed in 2025 and 2026, and in two US cases the codified text no longer tells the whole story because a FinCEN order now sits on top of it. This guide is written from the primary sources and separates what is in force from what is only proposed.

KYC requirements at a glance

What KYC is made of

Most KYC programs combine four layers, and it helps to keep them apart because they come from different provisions and fail in different ways.

• Customer identification (CIP). Collect the required identifying data and verify it. This is what most people mean by KYC.
• Customer due diligence (CDD). Understand who the customer is in substance, including beneficial owners of a company and the purpose of the relationship.
• Enhanced due diligence (EDD). Apply more scrutiny where the rules or your own risk assessment call for it.
• Ongoing monitoring. Keep the customer's information and risk profile current, and watch transactions against them.

For more depth, see our guides to KYC requirements for banks, KYC requirements for corporates and the KYC verification process.

KYC requirements in the United States

What a bank must collect and verify

Under 31 CFR 1020.220, a bank's Customer Identification Program must obtain at least four things before opening an account, with narrow exceptions for customers who have applied for a TIN and for credit card accounts:

• name
• date of birth, for an individual
• address
• an identification number: a taxpayer identification number for a US person, and for a non-US person a taxpayer identification number, a passport number and country of issuance, an alien identification card number, or the number and country of issuance of another government-issued document that evidences nationality or residence and bears a photograph or similar safeguard

Verification has a different clock: the rule requires it "within a reasonable time after the account is opened", using documents, non-documentary methods or both. The program must also keep identifying information for five years after the account is closed, give customers adequate notice that their identity is being verified, and include procedures for checking customers against any list of known or suspected terrorists that Treasury designates for this purpose.

The 2025 TIN change

The rule's text still says the information comes "from the customer". Outside the rule's existing credit card exception, since 2025 that is no longer the only route for the TIN. The OCC, FDIC and NCUA, with FinCEN's concurrence, issued an order that lets banks under their jurisdiction obtain Taxpayer Identification Number information from a third party instead, and the Federal Reserve issued a matching order on 31 July 2025 for the banks it supervises. The first order is explicit that its use "is optional", and the bank must still have written, risk-based procedures that enable it to obtain the TIN before the account is opened. For product teams this matters because a flow that gets the TIN from a third party can now be compliant, provided the procedures are written for it. Name, date of birth and address still follow the rule as written.

Beneficial owners of companies

For legal entity customers, 31 CFR 1010.230 requires covered financial institutions to identify and verify two kinds of people: each individual who owns 25 percent or more of the equity interests, and a single individual with significant responsibility to control, manage or direct the company. Some customers, such as regulated financial institutions, are excluded, and some accounts are exempt. FinCEN's FAQs define covered institutions as federally regulated banks and federally insured credit unions, mutual funds, brokers or dealers in securities, futures commission merchants and introducing brokers in commodities.

The codified rule still says this happens "at the time a new account is opened". In practice that changed on 13 February 2026, when FinCEN issued order FIN-2026-R001. Institutions may now limit identification and verification of beneficial owners to three situations:

1. when a legal entity customer first opens an account with the institution
2. when the institution knows facts that would reasonably call the reliability of the existing information into question
3. as needed under its risk-based procedures for ongoing customer due diligence

The order leaves the choice to the institution, and all other AML obligations continue. If your onboarding asks a repeat business customer to re-certify owners for every new account, that is now a policy decision and no longer something FinCEN strictly requires, for as long as the order stands.

Ongoing due diligence

The ongoing due diligence requirement, often called the fifth pillar of an AML program, sits in the AML program rule, 31 CFR 1020.210, not in the CIP rule. Banks need risk-based procedures for understanding the nature and purpose of customer relationships in order to develop a customer risk profile, and for ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information.

Enhanced due diligence and sanctions

The regulations contain specific due diligence requirements for correspondent accounts for certain foreign banks and for private banking accounts. For other higher-risk customers, extra scrutiny generally flows from the institution's own risk-based procedures.

Sanctions screening usually runs in the same onboarding flow, but it belongs to a different regime, administered by OFAC. OFAC, in guidance to insurers, describes civil liability as "based on strict liability", which means a person subject to US jurisdiction may be held civilly liable even without knowing the transaction was prohibited. That is why the screening step should be impossible to skip, and a potential match should hold the flow until it is cleared.

Who else is covered

Requirements differ by type of institution, so a fintech should confirm its own category with counsel before copying a bank's checklist.

• Broker-dealers have their own CIP rule, 31 CFR 1023.220.
• Money services businesses must maintain an effective AML program under 31 CFR 1022.210. Part 1022 has no dedicated CIP section, although the AML program rule itself requires procedures for verifying customer identification.
• Investment advisers: the AML rule has been delayed to 1 January 2028.
• Payment stablecoin issuers: the GENIUS Act directs that they be treated as financial institutions, but FinCEN's AML and CIP rules are, as of this writing, proposals.

Corporate Transparency Act: a separate track

Beneficial ownership reporting to FinCEN is a different obligation from the checks a bank performs. The March 2025 interim rule exempted domestic companies, and a final rule effective 14 August 2026 adopted it with limited changes. A US company's exemption from reporting to FinCEN does not switch off a bank's duties under the CDD Rule, which remains in the regulations.

KYC requirements in the European Union

The Anti-Money Laundering Regulation (EU) 2024/1624 applies from 10 July 2027 (10 July 2029 for two specific categories of obliged entity) and sets most obligations in one directly applicable text, which reduces national variation. Until July 2027, firms work under national laws implementing Directive (EU) 2015/849, alongside directly applicable EU rules such as the Funds Transfer Regulation (EU) 2023/1113. Those laws have different baseline triggers: occasional transactions of EUR 15,000 or more, and beneficial ownership at more than 25%. Member States can set stricter rules. AMLA notes that existing EBA guidelines, including those on risk factors and remote onboarding, continue to apply until its own instruments on the same subject enter into force.

Under the AMLR, customer due diligence applies when establishing a business relationship, on occasional transactions of at least EUR 10,000 and, for credit and financial institutions other than crypto-asset service providers, on occasional transfers of funds of at least EUR 1,000 (Article 19). Crypto-asset service providers have a lower trigger of EUR 1,000 and must at least identify and verify the customer below it, occasional cash transactions from EUR 3,000 require at least identification and verification, and lower values can be set for higher-risk sectors. Due diligence also applies regardless of amount where there is a suspicion of money laundering or terrorist financing, or doubts about previously obtained identification data.

Article 20 lists the measures, which go further than identity alone. They include:

• identifying and verifying the customer
• identifying beneficial owners and taking reasonable measures to verify them
• understanding the purpose and intended nature of the relationship
• checking whether the customer or beneficial owners are subject to targeted financial sanctions
• understanding the nature of the customer's business
• ongoing monitoring of the relationship
• determining whether the customer or beneficial owner is a politically exposed person

Article 22 sets the data to collect, including nationalities and place of birth for individuals, and allows verification through an identity document or through electronic identification meeting the eIDAS "substantial" or "high" assurance levels. Article 52 sets the beneficial ownership threshold at 25% or more.

One document to watch: AMLA's final report on draft technical standards for customer due diligence, dated 30 September 2026, is not law yet. The standards still have to go to the European Commission for adoption. As drafted, it would apply six months after entering into force, so treat it as the likely shape of the detailed rules.

KYC requirements in the United Kingdom

The UK rules are in the Money Laundering Regulations 2017, and the Money Laundering and Terrorist Financing (Amendment) Regulations 2026 changed them from 30 June 2026, with some crypto correspondent provisions following on 1 February 2027.

• Thresholds are now in sterling. Regulation 27 generally applies customer due diligence to occasional transactions of £12,000 or more and to occasional transfers of funds above £800. Some sectors, such as casinos and high value dealers, have their own triggers.
• Content of CDD. Regulation 28 requires identifying the customer and any beneficial owner, assessing the purpose and intended nature of the relationship, and ongoing monitoring, including scrutiny of transactions.
• Enhanced due diligence. Regulation 33 now refers to a "FATF call for action country", meaning a country on the FATF list of high-risk jurisdictions subject to a call for action. It also covers politically exposed persons and unusually complex or large transactions.

What is proposed but not in force

These items often appear in summaries as if they were settled. As of this writing they are not.

• AML/CFT program reform. FinCEN's April 2026 proposal would "fundamentally reform" program requirements.
• GENIUS Act rules for stablecoin issuers, both proposed in 2026.
• The EU's detailed CDD standards, which are still drafts awaiting adoption.

What getting it wrong costs

Recent penalties are less about one missed passport check and more about programs that did not work.

• Bank of America. FinCEN's consent order 2026-03 imposed a $1.2 billion penalty, crediting $750 million paid to the OCC, so the bank pays $450 million to the Treasury. FinCEN found, among other failures, that the bank did not develop customer risk profiles that adequately reflected the nature and purpose of its relationships with certain higher-risk customers.
• Canaccord Genuity. FinCEN imposed $80 million in March 2026, citing suspicious activity monitoring failures and deficiencies in customer due diligence. After credits and a suspended portion, the firm pays $35 million to the Treasury.
• Nationwide. The UK's FCA fined the society £44m in December 2025 for conduct between 2016 and 2021, including ineffective systems for keeping due diligence and risk assessments up to date for personal current account customers.

Turning KYC requirements into a working product

For a team building onboarding, the rules translate into a handful of engineering decisions. These are our recommendations from delivery work, not legal requirements.

• Treat rules as configuration. Thresholds, document lists and triggers differ by country and change often, as the UK's June 2026 switch to sterling shows. Keeping them in configuration means many rule changes do not need a release.
• Model the triggers, not just the first check. The February 2026 FinCEN order lets an institution make re-verification depend on events and risk. Your system needs to know why it is asking, and it should be able to skip a step when policy allows.
• Keep an audit trail per decision. Store which data was checked, by which provider, under which rule version, and who overrode what.
• Separate providers from policy. Identity, sanctions and business verification often come from different vendors. A thin integration layer lets you replace one without rewriting onboarding.

We have built this kind of flow at Itexus. A Top-7 US credit union's onboarding platform automates KYC and KYB checks and integrates with a legacy AS400 core, and a MENA wealth platform cut onboarding from 5-7 days to under 24 hours using Sumsub with automated KYC/KYB and biometrics. For the technical side, see our guides on KYC integration into financial software and building your own KYC from scratch, or our API integration services. To compare vendors, see our lists of KYC service providers and KYC software.

This article is general information and not legal advice. Requirements depend on your license, products and jurisdictions, so confirm your obligations with qualified counsel. Regulatory status was checked on 6 November 2026.

Frequently Asked Questions

What are the basic KYC requirements?

Firms must identify the customer, verify that identity, understand who owns or controls a company customer, understand the purpose of the relationship and keep monitoring it. The exact data and triggers depend on the country and type of institution. A US bank, for example, must generally obtain a name, a date of birth for an individual, an address and an identification number before opening an account.

Is KYC a legal requirement?

For regulated firms such as banks, yes, although the obligation comes from anti-money laundering law and "KYC" is rarely the legal term. In the US the duties sit in Bank Secrecy Act regulations, in the EU in national laws implementing the AML Directive and in the AMLR from July 2027, and in the UK in the Money Laundering Regulations 2017.

Do US banks have to re-verify beneficial owners for every new account?

Not any more, if they choose to use the relief. FinCEN's February 2026 order lets covered institutions limit this to the first account, to situations where they know facts that call the existing information into question, and to what their risk-based procedures require.

What is the difference between KYC and KYB?

KYC usually refers to verifying individuals, while KYB applies the same idea to companies, including confirming the business and identifying the people who own and control it. The US threshold for beneficial owners is 25% or more, as is the EU's under the AMLR from July 2027. The UK's is more than 25%.

When does the new EU KYC regime start?

Regulation (EU) 2024/1624 applies from 10 July 2027, with a later date of 10 July 2029 for two specific categories of obliged entity. AMLA's detailed technical standards were still drafts as of November 2026.