KYC Verification Process: 8 Steps, Timing Rules and What Happens When It Fails

The KYC verification process is the sequence a regulated firm follows to establish who a customer is and whether it can take on the relationship. It starts with collecting data and ends, in a sense, never, because the firm has to keep the information current for as long as the customer stays.

This guide lays out the process in eight steps, then covers what the rules say about timing, remote verification and failed checks. Which checks apply to you depends on your license and country. For the rules themselves, see our overview of KYC requirements.

The process at a glance

The order can vary. Many flows run screening and verification together, and the steps are risk based: both the EU's AMLR (Article 20) and the UK's regulation 28 tie the extent of the measures to the risk of the particular case.

Step 1: Collect identifying data

For a US bank, 31 CFR 1020.220 generally requires name, date of birth for an individual, address and an identification number before opening an account. The EU's AMLR (Article 22) will ask for more from July 2027, including place of birth and nationalities for individuals. Collect only what you need for your jurisdictions, and treat the list as configuration.

Step 2: Verify identity

There are three broad routes.

• Documents. In the US, for example, an unexpired government-issued ID with a photograph or similar safeguard, such as a driver's license or passport.
• Non-documentary checks. These include comparing what the customer provides against a consumer reporting agency, public database or other source. The US rule requires procedures for when these apply, including when a customer opens an account without appearing in person.
• Electronic identification. From July 2027, the AMLR (Article 22) accepts electronic identification means meeting the eIDAS "substantial" or "high" assurance levels, and relevant qualified trust services. UK regulation 28 allows information from an electronic identification process to count, where the process is secure from fraud and misuse and gives enough assurance that the person is who they claim to be, given the risks.

The UK requires verification from a reliable source that is independent of the customer. Where documents and data substantively disagree, the US rule requires a description of how the discrepancy was resolved.

What about selfies and liveness checks?

Liveness detection is common in vendor products, but it is worth being precise about what the rules say. In the EU today, the EBA's guidelines on remote customer onboarding say that credit and financial institutions using unattended remote solutions should perform liveness detection. AMLA's draft EU technical standards, dated 30 September 2026 and meant for the AMLR regime, do not use the words "liveness", "biometric" or "selfie". For alternative remote methods used where a customer cannot use the main routes, they require, among other things, controls to ensure that the person presenting the document is its holder, integrity and confidentiality of the communication, images and video of sufficient quality, stopping the process on technical problems or doubts about identity, and time-stamped copies. The firm must also be able to justify why the main routes could not be used. In our view, liveness is one way to meet the first of those. The standards remain drafts awaiting adoption.

Step 3: Identify beneficial owners

Companies add a layer: confirm the entity exists, identify who owns and controls it, and verify those individuals. Thresholds and calculations differ by country, so we cover them in our guide to KYC requirements for corporates.

Step 4: Screen

Sanctions screening is usually run at onboarding and repeated later. From July 2027, the AMLR (Article 20) lists checking for targeted financial sanctions and determining whether the customer or beneficial owner is a politically exposed person among its due diligence measures. In the US, sanctions are a separate regime administered by OFAC, and the CIP rule has its own step for any government list Treasury designates. The system should make screening impossible to skip, and a potential match should hold the flow until it is cleared.

Step 5: Assess purpose and risk

Identity is not the whole job. 31 CFR 1020.210 requires banks to understand the nature and purpose of customer relationships in order to develop a customer risk profile, and the AMLR and UK regulation 28 have similar requirements. The firm then assigns a level of risk.

One enforcement case shows how this can fall short. In its order against broker-dealer Canaccord Genuity, which covered its AML program, correspondent account due diligence and unfiled suspicious activity reports, FinCEN also criticized written procedures that "only set forth a requirement to collect documents" without requiring further evaluation of them.

Step 6: Decide

Many customers pass. Others need another attempt, manual review or enhanced due diligence, and some are refused. Higher-risk cases may need more information, such as source of funds and senior approval, depending on the rules that apply. Whoever makes the decision, the firm has to be able to explain it later. Under the EU's AMLR (Article 76), from July 2027, automated decisions to enter, refuse or keep a relationship, to carry out an occasional transaction, or to change the extent of due diligence need meaningful human intervention, and the customer can ask for an explanation and challenge the decision, except in relation to a suspicious transaction report.

Step 7: Record

US banks must keep identifying information for five years after the account is closed, and descriptions of documents, methods and resolved discrepancies for five years after the record is made. UK regulation 40 sets five years from when the firm knows, or has reasonable grounds to believe, that the transaction is complete or the relationship has ended, and then requires personal data to be deleted, with exceptions.

Step 8: Monitor and keep current

Monitoring means watching transactions against what you know about the customer, and keeping that knowledge up to date. How often differs sharply by jurisdiction, as the next section shows.

Timing rules by jurisdiction

The EU column comes from AMLR Articles 23, 26 and 33, the UK column from regulation 30 and regulations 27(8) and 28(11), the US timing from 31 CFR 1020.220, and the US position on reviews from FinCEN's FAQs: "There is no categorical requirement that financial institutions update customer information on a continuous or periodic schedule."

When verification fails

• United States. Bank procedures should describe when not to open an account, how the customer may use an account while verification continues, when to close it after failed attempts, and when to file a Suspicious Activity Report.
• European Union. From 10 July 2027, under AMLR Article 21, a firm that cannot comply must refrain from the transaction or relationship, terminate the relationship, and consider reporting to the Financial Intelligence Unit.
• United Kingdom. Under regulation 31, a firm that cannot apply the measures must not carry out the transaction or establish the relationship, must end any existing relationship, and must consider whether a disclosure is required.

A failed check is not automatically suspicious, but the rules expect you to consider it. Plenty of people photograph a document badly, so design retries and clear messages before escalating.

Designing the process for real customers

These are our recommendations from delivery work, not legal requirements.

• Measure each step. Track completion, retries and manual review by step and country, so you know where people drop off and why.
• Separate policy from providers. Keep the rules that decide what happens next in your own system, so you can change vendors without rewriting onboarding.
• Let low-risk cases finish quickly. Use the time on cases that need judgment. Our guide to KYC automation tools covers what can be automated.
• Give reviewers full context. A reviewer should see the document, the data checks, the screening result and the reason for escalation in one place.

We have seen what this can change. On a MENA wealth platform that Itexus built with Sumsub, automated KYC and KYB with biometrics cut onboarding from 5-7 days to under 24 hours. To plan an integration, see our API integration services.

This article is general information and not legal advice. Requirements depend on your license, products and jurisdictions, so confirm your obligations with qualified counsel. Regulatory status was checked on 6 November 2026.

Frequently Asked Questions

What are the steps in the KYC verification process?

Collect identifying data, verify identity, identify beneficial owners for companies, screen, assess purpose and risk, decide, record what was done, and monitor. The order and depth depend on the firm's risk assessment and the rules that apply.

How long does KYC verification take?

No rule sets one duration. In our experience, automated checks can finish quickly, while cases needing review or corporate documents take longer. In one project of ours, automation cut onboarding from 5-7 days to under 24 hours.

Can an account be opened before KYC is complete?

Sometimes. US banks collect data first and verify within a reasonable time after opening. In the UK, and in the EU under the AMLR from July 2027, credit and financial institutions may open an account if safeguards ensure no transactions take place before verification (in the EU, before the customer and beneficial owners are identified and verified). In lower-risk EU cases, verification can also be postponed for up to 60 days, with procedures setting what the customer can do in the meantime.

Does KYC require a selfie?

Not as a rule of law in the texts we reviewed, though remote flows often need one. The US rule names documents and non-documentary methods. In the EU, the EBA's current guidelines say firms should perform liveness detection in unattended remote onboarding, and AMLA's draft standards ask its alternative remote methods for controls that the person presenting a document is its holder. A selfie with liveness is one way to do that remotely.

What happens if KYC verification fails?

It depends on why and where. In our experience, some failures only need a retry. If identity can't be verified, the rules generally point to refusing or ending the relationship and considering a suspicious activity report.