Customer identity verification is the process federal law requires banks, credit unions, brokerages, cryptocurrency exchanges, and other financial institutions to run before they open an account for you. At a minimum, you have to give four pieces of identifying information, and the institution has to confirm you are who you say you are. The rules come from the Bank Secrecy Act and Section 326 of the USA PATRIOT Act, and they apply the same way whether you walk into a branch or sign up on an app.
The Law That Requires It
The Bank Secrecy Act sits at the base of the framework. After September 11, 2001, Congress expanded it through the USA PATRIOT Act. Section 326 of that law, codified at 31 U.S.C. § 5318(l), directed the Treasury Department to set minimum standards for verifying the identity of anyone opening a financial account.1Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority
Treasury’s Financial Crimes Enforcement Network (FinCEN) turned that mandate into the Customer Identification Program rules. Every bank must maintain a written CIP describing how it collects and confirms identifying information from new customers.2eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks The purpose is to confirm you exist, that you are who you claim to be, and that you don’t appear on government terrorism or sanctions watchlists.
What You Have to Provide
Federal regulations set four minimum data points before a financial institution can open your account:
- Full legal name, as it appears on your government-issued identification.
- Date of birth (for individual accounts, not business entities).
- Residential or business street address. A P.O. Box alone will not work for most people. Military personnel can use an APO or FPO address, and someone without a fixed address can provide a next-of-kin’s address instead.
- Taxpayer identification number. For U.S. citizens and residents, this is your Social Security Number.
Those four are the regulatory floor.2eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks Most institutions also ask for an unexpired government-issued photo ID: a driver’s license, state ID, or passport. Scanning software often reads the barcode or machine-readable zone to check the document’s embedded security features against known formats. If the address on your ID doesn’t match the one on your application, expect to be asked for a utility bill or bank statement to fill the gap.
If You Are Not a U.S. Person
Non-citizens have more flexibility on the identifying number. Instead of a Social Security Number, you can provide a taxpayer identification number (including an ITIN), a passport number with the country of issuance, an alien identification card number, or the number from any other government-issued document showing nationality or residence with a photograph.2eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
If you need a taxpayer identification number and don’t qualify for an SSN, you can apply for an ITIN by submitting Form W-7 to the IRS with a federal income tax return and supporting identity documents.3Internal Revenue Service. Individual Taxpayer Identification Number Some banks will let you open an account while your ITIN application is pending; policies vary.
When Verification Is Triggered
Opening a new account is the obvious trigger. It is not the only one.
Adding a person to an existing account, such as a new authorized user on a credit card or a joint owner on a bank account, requires fresh verification for that person. Ownership changes to a business account or the appointment of a new trustee require updated identification. And once your account is active, automated monitoring systems may flag transactions that don’t match your patterns and prompt a manual identity check.
Funds Transfers of $3,000 or More
For funds transfers of $3,000 or more, federal regulations impose specific record-keeping and identity duties. When someone who is not already an established customer walks in to send a wire or money order at that threshold, the institution must verify their identity by examining a document, preferably one with a name, address, and photograph, and retain a record of the ID type and number along with the sender’s taxpayer identification number.4eCFR. 31 CFR 1010.410 – Records to Be Made and Retained by Financial Institutions
All-Cash Real Estate Purchases
FinCEN uses Geographic Targeting Orders to require identity verification in certain all-cash residential real estate deals. When a legal entity buys residential property without traditional financing (cash, cashier’s check, money order, or virtual currency), the title insurance company must collect photo identification for the individual representing the entity and for every person owning 25 percent or more of it.5FinCEN. Geographic Targeting Order for Certain Residential Real Estate Transactions Price thresholds range from $50,000 in some areas to $300,000 in others, and FinCEN renews the orders on a rolling basis, so covered areas and details shift.
How the Institution Verifies You
Verification methods fall into two categories, and most institutions use both.
Documentary
The institution compares a physical or digital copy of your government-issued ID against the information on your application. If you’re uploading documents online, make sure the images are legible and complete. Blurry uploads and partially obscured information are the most common reason applications stall.
Non-Documentary
When a document alone isn’t enough, or when you are opening an account entirely online, the institution cross-references your information against third-party databases: credit bureau records, public records, and utility data confirming your name, address, and SSN have a consistent history. Non-documentary methods are required when an applicant can’t present documents in person, when documents presented raise doubts, or when authenticity can’t be confirmed.2eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
Biometric verification is standard at many digital platforms. A live facial scan is matched against the photo on your submitted ID, often with a “liveness” check (blinking, turning your head) to defeat someone holding up a printed photo. A code sent to a verified phone number adds a second factor.
Cryptocurrency Exchanges
FinCEN treats cryptocurrency exchanges and virtual currency administrators the same as any other money transmitter. A business that accepts virtual currency from one person and transmits it to another, or exchanges virtual currency for traditional currency, qualifies as a money services business. It must register with FinCEN, run anti-money-laundering controls, and follow the same identity verification requirements that apply to any other financial institution under the Bank Secrecy Act.6FinCEN. Application of FinCEN’s Regulations to Persons Administering, Exchanging, or Using Virtual Currencies
If you simply buy cryptocurrency to purchase goods or services, without operating an exchange yourself, you’re classified as a “user” and aren’t subject to registration and reporting obligations.
Business Accounts and Beneficial Owners
Opening a business account adds layers. The institution must collect the entity’s legal name, its principal place of business or physical office address, and an employer identification number. Articles of incorporation, partnership agreements, or operating agreements are commonly requested.
On top of verifying the entity, FinCEN’s Customer Due Diligence rule requires covered institutions to identify and verify any individual who owns 25 percent or more of a legal entity, along with anyone who controls it.7FinCEN. CDD Final Rule These beneficial owners go through the same identity verification process as any individual customer.
The Corporate Transparency Act’s separate FinCEN filing requirement has changed. A March 2025 interim final rule exempted all domestic reporting companies and their beneficial owners from filing beneficial ownership reports with FinCEN. As of 2026, only foreign entities registered to do business in the United States must file, and even those entities are not required to report any U.S. persons as beneficial owners.8FinCEN. Beneficial Ownership Information Reporting The CDD rule requiring banks to collect beneficial ownership information at account opening is unchanged.
What Happens If You Provide False Information
Submitting false identity information to a financial institution is a federal crime. Under 18 U.S.C. § 1014, anyone who knowingly makes a false statement to influence a financial institution’s decision on an account, loan, or other transaction faces up to 30 years in prison, a fine of up to $1,000,000, or both.9Office of the Law Revision Counsel. 18 USC 1014 – Loan and Credit Applications Generally
Producing or using fraudulent identification documents falls under a separate statute, 18 U.S.C. § 1028, with penalties that scale with the offense:
- Producing or transferring a false driver’s license, birth certificate, or federal ID: up to 15 years.
- Other fraud involving identification documents: up to 5 years.
- Identity fraud connected to drug trafficking or a violent crime: up to 20 years.
- Identity fraud connected to terrorism: up to 30 years.
These penalties reach attempts and conspiracies as well. Success is not required for charges to stick.10Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents
On the institution’s side, when a bank detects suspected identity fraud meeting certain thresholds, it must file a Suspicious Activity Report with FinCEN. The filing thresholds are $5,000 when a suspect can be identified and $25,000 regardless of whether a suspect is known. SARs are due within 30 calendar days of detection, or 60 days if no suspect has been identified.11FFIEC BSA/AML InfoBase. Assessing Compliance With BSA Regulatory Requirements – Suspicious Activity Reporting
Your Rights If Verification Goes Wrong
Verification failures are common: a name mismatch in a credit bureau database, an address that hasn’t been updated, a thin credit file for someone new to the country. When an institution denies you an account, or takes any other adverse action, based on information from a consumer reporting agency, the Fair Credit Reporting Act gives you specific protections.
The institution must notify you of the adverse action. The notice, which can be written, electronic, or verbal, must include the name and contact information of the credit bureau that supplied the report, a statement that the bureau didn’t make the decision, and notice of your right to a free copy of your report within 60 days.12Consumer Financial Protection Bureau. Appendix C to Part 1002 – Sample Notification Forms You also have the right to dispute inaccurate information with the bureau.
How to Dispute Errors
If the report contains incorrect information, dispute it with both the credit bureau and the business that supplied the data. Send the dispute in writing by certified mail, explain what’s wrong, and include copies of documents that support your position. The bureau has 30 days to investigate. If the investigation results in a correction, the bureau must give you a free updated copy of your report and, if you ask, notify anyone who received the inaccurate version in the past six months.13Federal Trade Commission. Disputing Errors on Your Credit Reports
Institutions that fail to provide the required adverse action notice face penalties under the FCRA. As of early 2025, the maximum civil penalty the FTC can seek is $4,983 per violation.14Federal Trade Commission. Using Consumer Reports for Credit Decisions – What to Know About Adverse Action and Risk-Based Pricing Notices
How Your Information Is Kept and Protected
Financial institutions have to hold onto the records they create during verification. Federal regulations require retention for at least five years after the account is closed.15eCFR. 31 CFR 1010.430 – Nature of Records and Retention Period For credit card accounts, the clock starts when the account is closed or becomes dormant.16FFIEC BSA/AML InfoBase. Appendix P – BSA Record Retention Requirements Retained records must include a description of any document used to verify your identity and the results of any database checks.
The Gramm-Leach-Bliley Act’s Safeguards Rule governs how that data must be protected. Financial institutions under FTC jurisdiction must develop and maintain a written information security program with administrative, technical, and physical safeguards against unauthorized access.17eCFR. 16 CFR Part 314 – Standards for Safeguarding Customer Information In practice, that means encrypted storage, access controls that limit who can see your data, and regular security assessments.
If There’s a Breach
When a security breach exposes the unencrypted personal information of 500 or more consumers, the institution must notify the FTC within 30 days of discovering it. The trigger is an “acquisition of unencrypted customer information without the authorization of the individual,” and if the encryption key was compromised, the data is treated as unencrypted.18Federal Trade Commission. Safeguards Rule Notification Requirement Now in Effect Most states also have breach notification laws requiring direct notice to affected consumers, often within 30 to 60 days.