KYC documents: what U.S. institutions collect from individuals and companies

KYC stands for know your customer. In U.S. banking, it rests on two rules. The customer identification program is the bank’s written procedure, called CIP, for collecting and verifying identity at account opening under 31 CFR 1020.220 (31 CFR 1020.220, Customer identification programs for banks (LII)). Customer due diligence is the second layer, called CDD, which adds the owners and controllers of a company customer under 31 CFR 1010.230 (31 CFR 1010.230, Beneficial ownership requirements for legal entity customers (LII)).

Broker-dealers, credit unions and other financial institutions follow similar rules, and firms such as advisers and fintech apps often apply the same checklist. Your institution may ask for more than the minimum, because its own risk program sets the final list.

If you are the one being asked, the sections below tell you which document answers each request. If you collect them, they show what the rule requires and what is house policy.

Government agencies issue most KYC documents. The State Department issues U.S. passports, state motor vehicle agencies issue driver’s licenses and ID cards, and the secretary of state issues formation records and good standing certificates for companies. The IRS assigns tax ID numbers. Utilities, banks and landlords issue the bills and statements people use to show an address.

1. Check your ID: it must be unexpired and show your photo.
2. Have your Social Security number or ITIN ready, or your passport number if you are not a U.S. person.
3. Find a recent bill or statement in your name at your street address, if the institution asks for proof of address.
4. For a company, download the certified formation document and a good standing certificate from the secretary of state.
5. List every person who owns 25 percent or more, and one senior manager, with their identity details (31 CFR 1010.230, Beneficial ownership requirements for legal entity customers (LII)).

• An expired driver’s license or passport.
• A P.O. box given as the home address.
• A photo of an ID that cuts off the edges or the number.
• Formation papers without the amendments that changed the company’s name.
• Owner details that leave out a trust holding a large stake.

The rule sets a minimum of four data points. Before opening an account, the bank must obtain your name, date of birth, address and an identification number (31 CFR 1020.220, Customer identification programs for banks (LII)). The table shows what usually proves each one.

• The ID must be unexpired, show nationality or residence, and carry a photograph or similar safeguard (31 CFR 1020.220, Customer identification programs for banks (LII)).
• A person with no street address may give an APO or FPO box, or the street address of next of kin or another contact (31 CFR 1020.220, Customer identification programs for banks (LII)).

Banks can verify identity with documents, with other methods, or with both (31 CFR 1020.220, Customer identification programs for banks (LII)). Non-documentary verification means checking your details against other sources rather than an ID in hand. The rule lists contacting you, comparing your information with a consumer reporting agency or public database, checking references with other banks and obtaining a financial statement (31 CFR 1020.220, Customer identification programs for banks (LII)).

These methods matter when you open an account online. The bank must cover cases where you cannot show a photo ID or do not appear in person (31 CFR 1020.220, Customer identification programs for banks (LII)). The identity verification form guide shows how firms outside banking collect the same details.

For a company, the bank first confirms the entity exists. The rule gives examples: certified articles of incorporation, a government-issued business license, a partnership agreement or a trust instrument (31 CFR 1020.220, Customer identification programs for banks (LII)). Expect a request for the EIN and the names of the people allowed to run the account.

A beneficial owner is, under the CDD rule, each individual who owns 25 percent or more of the company’s equity, plus one individual with significant responsibility to control it (31 CFR 1010.230, Beneficial ownership requirements for legal entity customers (LII)). That control person may be an officer such as the CEO, CFO, managing member, general partner, president or treasurer (31 CFR 1010.230, Beneficial ownership requirements for legal entity customers (LII)).

1. Certified formation document and any amendments.
2. Good standing certificate or business license.
3. EIN and a Form W-9, or Form W-8BEN-E for a foreign entity.
4. Operating agreement or bylaws and the list of authorized signers.
5. Name, date of birth, address and ID number for each beneficial owner and the control person.
6. A signed beneficial ownership certification.

Banks often collect owner details on the form in Appendix A of the CDD rule, signed by the person opening the account (31 CFR 1010.230, Beneficial ownership requirements for legal entity customers (LII)). They may use another format if that person certifies the information is accurate to the best of their knowledge (31 CFR 1010.230, Beneficial ownership requirements for legal entity customers (LII)).

When a trust owns 25 percent or more, the trustee is the beneficial owner for the ownership test (31 CFR 1010.230, Beneficial ownership requirements for legal entity customers (LII)). Some customers, such as many publicly traded companies, are excluded from the definition of a legal entity customer and do not need the certification (31 CFR 1010.230, Beneficial ownership requirements for legal entity customers (LII)).

FinCEN has also granted relief on repeating this step. Its ruling FIN-2026-R001 gives exceptive relief from identifying and verifying beneficial owners at each account opening (FinCEN, CDD Final Rule). Ask your bank how it applies the ruling to a second account.

A bank must keep the identifying information it collected for five years after the account closes (31 CFR 1020.220, Customer identification programs for banks (LII)). So the documents you give at opening stay on file long after you leave.

Do not confuse KYC with BOI reporting. That was a separate filing companies made with FinCEN under the Corporate Transparency Act. FinCEN’s page, updated in August 2026, says U.S. companies are now exempt and no longer need to file BOI reports (FinCEN, Beneficial Ownership Information Reporting). Only certain foreign companies registered to do business in the U.S. still report (FinCEN, Beneficial Ownership Information Reporting). Your bank’s ownership questions still apply, because they come from the CDD rule.

• 31 CFR 1020.220, Customer identification programs for banks (LII): Before opening an account a bank obtains at least name, date of birth for an individual, address and an identification number, verifies identity through documents or non-documentary methods, and keeps identifying information for five years after the account closes.
• 31 CFR 1010.230, Beneficial ownership requirements for legal entity customers (LII): Covered financial institutions identify and verify each individual owning 25 percent or more of a legal entity customer and one individual with significant responsibility to control it, using the Appendix A certification or the same information by other means.
• FinCEN, CDD Final Rule: Financial institutions identify and verify any individual who owns 25 percent or more of a legal entity and an individual who controls it; FinCEN lists exceptive relief rulings, including FIN-2026-R001 on identifying and verifying beneficial owners at each account opening.
• FinCEN, Beneficial Ownership Information Reporting: Updated August 11, 2026: under FinCEN’s final rule, U.S. companies are exempt from BOI reporting and no longer required to file BOI reports; only certain foreign companies registered to do business in the U.S. must report.