Know your customer (KYC) is the routine a financial company follows to establish who it is dealing with, both when an account is opened and for as long as it stays open. The company collects identifying details, checks them against documents or independent records, screens the person against government sanctions lists and builds a picture of how the account is likely to be used, so that activity which doesn't fit stands out. In the US the phrase is industry shorthand rather than the name of one law: the duties come from the Bank Secrecy Act and the Treasury rules issued under it. The money transfer hub shows where these checks sit in the wider process of sending money abroad.
What does a KYC check involve?
A KYC check has five parts: collecting identity details, verifying them, screening against government lists, learning what the account is for and watching activity afterwards.
| Part | What happens | US rule |
|---|---|---|
| Identify | Name, date of birth, street address and an ID number are collected at sign-up | Customer identification rule, 31 CFR 1020.220 |
| Verify | The details are checked against an ID document or independent records | Same rule |
| Screen | The customer, and later each payment, is compared with government sanctions and terrorist lists | Sanctions regulations, plus a list check in the identification rule |
| Understand | The account's purpose and expected activity are recorded and, for a company, its owners identified | Customer due diligence rule, 31 CFR 1010.230 |
| Monitor | Transactions are watched for activity that does not fit the profile, and suspicious cases are reported | Suspicious activity report rules |
The ID number depends on who the customer is. A US person gives a taxpayer identification number, usually a Social Security number. A customer from abroad can instead give a passport number and the issuing country, an alien ID card number, or the number of another government photo ID that shows nationality or residence. The address must be a residential or business street address. An individual without one may give an Army or Fleet Post Office box or the street address of a relative or other contact, but an ordinary post office box does not qualify.
Verification can rely on documents, such as an unexpired driver's license or passport, or on non-documentary methods such as contacting the customer or comparing the details with a consumer reporting agency or public database. A bank's procedures must cover accounts opened without the customer present, which includes every app sign-up. Since orders issued in June and July 2025, banks may also get a customer's taxpayer identification number from a third-party source rather than from the customer, as long as they have it before the account opens.
For a company, the bank also has to identify the people behind it. Under the customer due diligence rule, which banks, brokers and some other financial firms have had to follow since May 11, 2018, the beneficial owners are each person holding 25% or more of the equity, which can be as many as four people, plus one person with significant control, such as the chief executive.
Worked example: Counting a company's beneficial owners
- A small import business opens an account to pay suppliers abroad. Ana owns 40%, Ben 30%, Chen 20% and Dana 10%, and Chen is chief executive.
- Ownership test: Ana and Ben are at or above 25%; Chen and Dana are not.
- Control test: one person with significant control, here Chen.
- People the bank identifies and verifies: Ana, Ben and Chen, so three.
- With four owners at 25% each, all four would pass the ownership test, and the control person could be one of them or a hired manager.
What US laws require KYC?
The Bank Secrecy Act is the foundation: it lets the Treasury require records, reports and anti-money-laundering programs from financial institutions.
Its formal name is the Currency and Foreign Transactions Reporting Act of 1970, and the Treasury's Financial Crimes Enforcement Network (FinCEN) writes and enforces the rules under it. The pieces that make up KYC today arrived in stages:
- 2001 and 2003. Section 326 of the USA PATRIOT Act required minimum identity standards for people opening accounts, and FinCEN and the bank regulators wrote them into the customer identification program rules two years later.
- 2016. The customer due diligence rule added beneficial owners and made two continuing duties explicit: understanding what each customer relationship is for and monitoring it.
- 2019. FinCEN guidance confirmed that businesses exchanging crypto for money, or administering it, generally count as money transmitters, with the same obligations as other transfer services.
- 2025. The GENIUS Act made permitted stablecoin issuers financial institutions under the Bank Secrecy Act, required to run customer identification and sanctions compliance programs.
Money transmitters such as remittance companies sit outside the bank identification rule, but the anti-money-laundering program each must keep has to include procedures for verifying customer identification. A separate rule covers every funds transfer of $3,000 or more, whether a bank or a money transmitter sends it: the sender's institution keeps a record of the payment and must put the sender's name, address and account number in the payment order, so each bank along the route receives them. This hand-off is called the travel rule.
Sanctions screening rests on separate laws, run by the Treasury's Office of Foreign Assets Control (OFAC), and it has no dollar threshold: OFAC states that no minimum or maximum amount applies. A US company that finds a sanctioned person in a payment must block the funds or reject the payment, depending on the sanctions program, and a rejected transaction must be reported to OFAC within 10 business days.
How do banks, money transmitters and crypto exchanges apply KYC?
The core checks are the same everywhere, but the moments that trigger them and the reporting thresholds differ by type of business.
| Business | When identity is checked | Thresholds worth knowing |
|---|---|---|
| Bank or credit union | Details collected before an account opens and verified within a reasonable time after | Cash over $10,000 reported; suspicious activity reported from $5,000; wires of $3,000 or more carry sender details |
| Money transmitter | When its risk-based program calls for it, and before accepting an in-person order of $3,000 or more from a non-customer | Suspicious activity reported from $2,000; cash over $10,000 reported; a lower cash trigger in some border ZIP codes until March 1, 2027 |
| Crypto exchange | Under the program it keeps as a money transmitter | The same money transmitter thresholds, with the $3,000 transfer rules applied to crypto of equal value |
Brokerages follow a parallel rule, which is why opening a US brokerage account as a nonresident starts with a passport. On crypto platforms, the level of verification a customer completes also sets withdrawal limits, as the guide to selling crypto and withdrawing describes. KYC tells an exchange who its customers are; it says nothing about whether the exchange actually holds their coins, which is the question proof of reserves tries to answer.
Why do transfers get held for KYC review?
A transfer is held when something about the payment or the customer's file needs a person to review it before the money can lawfully move. The usual triggers:
- A possible sanctions match. Screening software flags names that resemble entries on OFAC's lists, and the provider has to rule out a true match before paying. Common names, and names spelled differently when carried over from another alphabet, are more likely to trip the filter.
- Identity details that don't line up. A name that differs from the one on the ID, an expired document, an address that can't be confirmed or a taxpayer number that doesn't match records.
- Activity outside the expected pattern. A first transfer far larger than the stated purpose suggests, a burst of payments to new recipients, or money that arrives and leaves almost at once.
- Cash near a reporting line. Cash over $10,000 produces a currency transaction report, and deliberately keeping each cash payment under a reporting or recordkeeping line is structuring, a federal crime punishable by up to five years in prison even if the money is clean. A FinCEN order in force until March 1, 2027 adds identity checks and reports for cash transactions of $1,000 to $10,000 at money services businesses in listed ZIP codes in Texas and New Mexico.
- Missing sender details on a wire. A transfer of $3,000 or more should carry the sender's name, address and account number, and a correspondent bank or the receiving bank may stop to ask for them when they are absent. The guide to receiving money from abroad covers the checks on incoming payments.
What happens next depends on what the review finds. If the provider needs more information, it asks for it, often a clearer ID image or the recipient's date of birth. A payment involving a sanctioned person must be blocked or rejected and reported to OFAC, and blocked money stays frozen until OFAC authorizes its release. If the activity looks suspicious, the provider may file a suspicious activity report, and federal rules forbid it from revealing that a report exists, one reason support teams often say only that a payment is under compliance review.
For remittances sent from the US, the CFPB's rule normally treats money that arrives after the promised date as an error the provider must put right. Delays caused by fraud screening or by a review the Bank Secrecy Act or OFAC requires are an exception, provided the provider could not have foreseen them when it issued the receipt; the CFPB's own commentary gives the example of a recipient whose name resembles that of a blocked person. Compliance reviews are one of several reasons international transfers take longer than quoted, and the remittance transfer rights guide covers how to dispute a genuine error.
Worked example: Following a $3,200 cash transfer through review
- A first-time sender pays $3,200 in cash at a money transmitter's counter for a transfer to a cousin's bank account in Mexico, identified by its 18-digit CLABE.
- Because the order is $3,000 or more and placed in person by someone who is not an established customer, the clerk examines an ID document before accepting it and records the sender's name, address, ID type and number, and taxpayer or passport number.
- Paying in cash also brings the federal remittance tax: 1% of the amount sent, on transfers paid with cash, a money order, a cashier's check or a similar physical instrument. On $3,200 that is $32.
- Screening flags the cousin's name as similar to an entry on a sanctions list. The provider asks for the cousin's date of birth, rules out a match and pays out a day late, which the CFPB rule does not count as an error because the alert could not have been foreseen when the receipt was issued.
- Splitting the $3,200 into two $1,600 payments to skip the ID check would have backfired: payments designed to evade Bank Secrecy Act requirements are what money transmitters must report once they reach $2,000 in total, and the split itself could be prosecuted as structuring.
How is KYC different from AML, CDD and sanctions screening?
KYC is one part of a wider anti-money-laundering program, and the neighboring terms describe other parts of that program or deeper versions of the same checks.
| Term | What it covers | How it relates to KYC |
|---|---|---|
| Anti-money-laundering (AML) program | The whole system: written policies and controls, a compliance officer, staff training, independent testing and reporting | KYC is one of its components |
| Customer identification program (CIP) | The US minimum for identifying and verifying people who open accounts at banks and securities firms | The legal core of KYC at account opening |
| Customer due diligence (CDD) | Beneficial owners, the purpose of the relationship and ongoing monitoring | KYC after the first day, kept up to date |
| Enhanced due diligence (EDD) | Extra scrutiny, such as where the money comes from, for higher-risk customers | Required by US rules for some accounts held for foreign banks, such as those with offshore licenses |
| Sanctions screening | Checking customers and payments against OFAC's lists | Runs alongside KYC and covers one-off payments of any size |
| Travel rule | Passing sender and recipient details along with transfers of $3,000 or more | Carries KYC data from one institution to the next |
The selfie-and-ID step in an app's sign-up flow is only the verification part of KYC; screening, the questions about purpose and the monitoring carry on long after it.
What slows down a KYC check?
Most delays come from small differences between what a customer types and what their documents or records show.
- Name variations. A nickname in the app against a full legal name on the passport, a missing second surname or accents typed differently can fail an automated match; entering the name exactly as printed on the ID avoids it.
- An expired document. Banks that verify by document rely on unexpired government IDs, so a passport that lapsed last month can be refused.
- Sending for someone else without saying so. On orders of $3,000 or more, a provider that knows the person at the counter is not the real sender must also record the real sender's taxpayer or passport number, so the relationship is best stated at the start.
- Letting a request sit. A bank's procedures set what a customer may do while verification is pending and when the account is closed if it fails, so an ignored request can end with a closed account.
Answering verification requests only inside the provider's own app or website, rather than through links in unexpected texts or emails, also protects against impostors posing as a compliance team; the money transfer scams guide describes the common schemes. Once the checks are done, the money transfer cost calculator and the study of what sending $200 costs by corridor show what the transfer itself will cost.