What Is Account Verification and How Does It Work?

Account verification is the process a bank or online platform uses to confirm you are who you say you are before letting you open or fully use an account. Federal law requires financial institutions to run every new customer through a Customer Identification Program that collects, at minimum, your name, date of birth, address, and a taxpayer or other identification number.¹ Depending on the institution and how cleanly your information matches public records, verification can clear in a few minutes or stretch across several business days.

Why Banks Are Required to Verify You

The Bank Secrecy Act and the USA PATRIOT Act require every financial institution to operate a Customer Identification Program, and 31 U.S.C. § 5318(l) directs the Treasury Department to set the minimum standards.¹ The implementing regulation spells out what banks must collect and how they must verify it.² The purpose is to prevent money laundering, terrorist financing, and identity fraud.

The level of scrutiny scales with risk. A personal checking application and a business account moving large international sums won’t get the same treatment, but both start from the same baseline identity check.³

What You’ll Need to Provide

Federal regulation sets four required pieces of information for an individual account: your legal name, date of birth, residential or business street address, and an identification number.² That’s the floor. Many institutions ask for more.

Government-Issued Photo ID

When a bank verifies you through documents, the rule calls for an unexpired government-issued ID showing nationality or residence and bearing a photograph. In practice that’s a driver’s license, state ID card, or passport.² If you don’t have one on hand, you aren’t automatically turned away. The regulation requires institutions to maintain non-documentary verification procedures, which can include cross-referencing your information against consumer reporting agencies, public databases, or another financial institution.

Replacing a driver’s license for verification typically costs between $11 and $44 depending on the state. A certified birth certificate as backup identification generally runs $15 to $53.

Your Identification Number

For U.S. persons, the required number is a taxpayer identification number: a Social Security number, an Individual Taxpayer Identification Number (ITIN), or an Employer Identification Number.⁴ If you’re not eligible for a Social Security number, you can apply for an ITIN through the IRS regardless of immigration status, as long as you have a federal tax filing need.⁵

For non-U.S. persons, the regulation accepts a passport number with country of issuance, an alien identification card number, or the number from another government-issued document showing nationality or residence and bearing a photo.²

Address and Proof of Residency

The rule requires a residential or business street address. If you don’t have one, a military APO/FPO box or the address of a next of kin or contact person is acceptable.² Federal rules don’t specifically require a utility bill or lease, but many banks ask for one as part of their own procedures. If you’re asked for proof and don’t have a utility bill in your name, a current driver’s license, lease agreement, mortgage statement, insurance card, or voter registration card often works.

Preparing Documents for Upload

Most platforms host an upload section or verification link inside your account settings. When you scan or photograph a document, keep all four corners visible, make sure the text is legible, and avoid glare on key fields. A flat, neutral background helps. Match every name, address, and number you type into the form to what the document shows. Even a small mismatch between your typed entry and the ID can delay the process or push you into manual review.

What Happens During Verification

Once you submit your information, most platforms layer in a couple of extra security checks before the review itself begins.

Multi-Factor Authentication

Many institutions require a second step at submission, usually a code sent by text message or produced by an authenticator app. This confirms the submission is coming from a device you control. Federal banking regulators have long recommended multi-factor authentication whenever the transaction warrants it, and most major institutions now treat account opening as one of those moments.⁶

Liveness and Biometric Checks

A growing number of platforms use your phone or computer camera to run a liveness check. You might be asked to blink, turn your head, or follow a moving dot. The point is to confirm a real person is present rather than someone holding up a printed photo or playing manipulated video. These checks help counter synthetic identity fraud, where criminals combine stolen details with fabricated information to build an identity that doesn’t match any real individual.

If a liveness check captures biometric data, your rights depend on where you live. Illinois, Texas, Washington, and Colorado have biometric privacy laws. Illinois has the most aggressive version: companies must publish a retention and destruction schedule, explain the purpose of collection, and get your written consent before capturing biometric information. Not every state has these protections, so check whether your state has a biometric privacy statute if you want to know how your facial data is stored.

After You Submit

Once every step is complete, your packet goes to the institution’s servers. You’ll usually get an immediate confirmation that the data was received. From there, it’s a waiting game, and the main thing to watch is your email.

How Long It Takes

Automated systems that cross-reference your submission against public records often clear straightforward applications within minutes. If something doesn’t line up cleanly, say a recently changed address, a name that doesn’t quite match between your ID and the form, or a low-quality document scan, the application gets routed to a human reviewer and the wait stretches to roughly three to five business days. High-traffic periods and holidays can push that further.

While verification is pending, institutions commonly restrict what you can do with the account. You may be able to receive deposits, but withdrawals, transfers, and payments are often blocked until the check clears. Automatic bill payments linked to the account can fail during this window, so consider pausing scheduled payments or arranging a backup until you get the confirmation email.

Check your inbox regularly for either a confirmation or a request for more documents. Status usually appears somewhere in your account settings or security dashboard. Common reasons for rejection include an expired ID, blurry or cropped images, and a mismatch between the address on your form and the address on your proof of residency. When a platform rejects a submission, the notice typically identifies the specific problem so you can correct and resubmit.

What to Do If You’re Denied

A denial isn’t necessarily the end of the road, but you need to act quickly and understand what triggered it.

Get the Reason in Writing

If a bank or credit union denies your application based on information from a consumer report or checking account report, federal law requires an adverse action notice. That notice must identify the consumer reporting agency that supplied the information, state that the agency didn’t make the denial decision, and tell you about your right to a free copy of the report and to dispute inaccurate information.⁷ If you don’t receive this notice, ask for it.

Review Your Reports and Dispute Errors

Request a copy of whatever report the institution used. Some banks rely on specialty checking account reporting agencies rather than the three major credit bureaus, so ask specifically which company provided the data.⁸ Read the report for errors: accounts that aren’t yours, wrong personal information, or negative marks that should have aged off.

If you find an error, file a dispute directly with the reporting agency. Under the Fair Credit Reporting Act, the agency must conduct a free reinvestigation within 30 days of receiving your dispute. That deadline extends to 45 days if you submit additional supporting information during the initial 30-day window. If the item turns out to be inaccurate or can’t be verified, the agency must delete or correct it and notify the company that originally furnished the data.⁹

Explore Alternatives

You’re not stuck while a dispute is pending. Some institutions offer lower-risk account products designed for people who’ve had trouble with traditional applications, including accounts that prevent overdrafts entirely. Prepaid cards work for basic payment needs in the interim.⁸ A different bank may also approve you, since each institution applies its own risk criteria.

How Your Verification Data Is Protected

Handing over your Social Security number, a photo of your license, and a facial scan is a lot of trust. Federal law places specific obligations on what institutions do with that information afterward.

Under the Gramm-Leach-Bliley Act, financial institutions must maintain administrative, technical, and physical safeguards to protect the security and confidentiality of your records, guard against anticipated threats, and prevent unauthorized access that could cause you substantial harm.¹⁰ Institutions must also explain their information-sharing practices, including what they collect, who they share it with, and your right to opt out of certain third-party sharing.¹¹

If a privacy notice shows up during account opening and you’re tempted to skip it, at least check whether the institution shares data with non-affiliated third parties and whether you can opt out. That one piece of information determines how widely your verification data travels after the process is done.

Business Accounts

Opening an account for a business entity involves the same personal identity check for the account opener plus documentation proving the entity exists. Acceptable documents under the CIP rule include certified articles of incorporation, a government-issued business license, a partnership agreement, or a trust instrument.² The institution needs the entity’s principal place of business or other physical location rather than a P.O. box.

Separately, the Corporate Transparency Act created a beneficial ownership reporting requirement administered by FinCEN. As of March 2025, all entities created in the United States are exempt from that filing obligation. The requirement now applies only to foreign entities registered to do business in a U.S. state or tribal jurisdiction, and those foreign entities aren’t required to report U.S. persons as beneficial owners.¹² If you’re forming a domestic business, you won’t file a beneficial ownership report with FinCEN, though the bank itself may still ask about ownership structure as part of its own due diligence.

1
Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority
2
eCFR. 31 CFR 1020.220 – Customer Identification Program
3
FFIEC BSA/AML InfoBase. Risks Associated with Money Laundering and Terrorist Financing – Introduction
4
FFIEC BSA/AML InfoBase. Regulatory Requirements – Customer Identification Program
5
Internal Revenue Service. Individual Taxpayer Identification Number (ITIN)
6
Federal Financial Institutions Examination Council. Authentication and Access to Financial Institution Services and Systems
7
Office of the Law Revision Counsel. 15 USC 1681m – Duties of Users Taking Adverse Actions on the Basis of Information Contained in Consumer Reports
8
Consumer Financial Protection Bureau. Why Was I Denied a Checking Account?
9
Office of the Law Revision Counsel. 15 USC 1681i – Procedure in Case of Disputed Accuracy
10
Office of the Law Revision Counsel. 15 USC 6801 – Protection of Nonpublic Personal Information
11
Federal Trade Commission. Gramm-Leach-Bliley Act
12
Financial Crimes Enforcement Network. Beneficial Ownership Information Reporting