Last reviewed October 7, 2026 · By the NYBACS advisory team
Short answer
KYC for a US business bank account is the bank's legally required process for knowing who it is dealing with: verifying the company, identifying and verifying every individual who owns 25% or more and one person who controls it, screening them against sanctions lists, and understanding what the account will be used for. It is required under the Bank Secrecy Act and continues after opening through ongoing monitoring.
Key takeaways
- Bank KYC combines the Customer Identification Program rule with FinCEN's customer due diligence (CDD) rule, which banks have had to comply with since May 11, 2018.
- A company has between one and five beneficial owners for CDD purposes: up to four individuals owning 25% or more, plus one individual with significant control.
- Banks may collect ownership information below 25% when their risk assessment calls for it.
- Bank CDD is separate from FinCEN beneficial ownership information (BOI) reporting under the Corporate Transparency Act; changes to BOI reporting do not remove a bank's own obligations.
- Under 2026 exceptive relief, banks need not repeat beneficial-owner verification at every new account if it was done at the first account, subject to their risk-based procedures.
The building blocks: CIP, CDD and beneficial ownership
"KYC" is industry shorthand for several distinct legal requirements:
- Customer Identification Program (CIP). Before opening an account, the bank collects and verifies minimum identifying information — for a company, its name, a physical location and its taxpayer identification number (the EIN).
- Beneficial ownership. The bank identifies and verifies each individual who directly or indirectly owns 25% or more of the company (the ownership prong) and one individual with significant responsibility to control, manage or direct it, such as a CEO, managing member or general manager (the control prong). Each is recorded with name, date of birth, address and an identification number — a passport number for non-US persons.
- Nature and purpose. The bank must understand what the relationship is for, so it can build a customer risk profile.
- Ongoing monitoring. The bank watches activity to identify and report suspicious transactions and, on a risk basis, keeps customer information, including beneficial ownership, up to date.
FinCEN's own guidance describes the last three, together with customer identification, as the core elements of customer due diligence.
KYC versus KYB
Banks and fintech platforms often split the process into KYC (know your customer, for the individuals) and KYB (know your business, for the company). In practice both happen in one application.
| KYB checks on the company | KYC checks on the individuals |
|---|---|
| Existence and status in state records | Passport or other photo identification |
| EIN and legal name match IRS records | Date of birth and residential address |
| Ownership structure and ownership percentages | Proof of address and, often, live identity checks |
| Industry, website and business model | Role in the company: owner, controller, signer |
| Expected activity and countries involved | Sanctions and adverse-media screening |
For foreign-owned companies, KYB is often the harder half: tracing ownership through a foreign parent and explaining the business model to an institution that has never seen it before.
Sanctions screening and risk rating
Every company and individual in the application is screened against US sanctions lists maintained by the Treasury's Office of Foreign Assets Control (OFAC). Under OFAC's 50 Percent Rule, an entity owned 50% or more in aggregate by blocked persons is itself treated as blocked, which is why banks look closely at ownership chains.
The bank then assigns a risk rating. Factors include the countries involved, the industry, the complexity of ownership, the expected transaction volume and the products requested. Higher-risk relationships receive enhanced due diligence, which can mean questions about the owners' source of wealth, more documents and more frequent reviews. A higher rating is not a rejection; it changes how much the bank needs to know.
Bank KYC is not the same as BOI reporting
Founders often confuse bank beneficial-ownership checks with beneficial ownership information (BOI) reports filed with FinCEN under the Corporate Transparency Act. They are different obligations:
- BOI reporting is a filing made by the company to FinCEN. Under FinCEN's final rule effective August 14, 2026, companies created in the US and their beneficial owners who are US persons are exempt, while foreign companies registered to do business in a US state remain in scope. Monitor FinCEN for further changes.
- Bank CDD is an obligation on the bank. It applies to US-formed and foreign companies alike, whatever happens to BOI reporting.
In February 2026 FinCEN granted exceptive relief (FIN-2026-R001) so that covered institutions need not identify and verify beneficial owners again at each new account. They verify at the customer's first account, when they learn facts that call earlier information into question, and as their risk-based procedures require.
What KYC looks like after the account opens
KYC is a continuing relationship, not a single gate. Expect:
- Periodic refreshes — more frequent for higher-risk customers — asking you to confirm ownership, addresses and activity.
- Event-driven reviews after an ownership change, new signer, address change or unusual transaction.
- Requests for information with deadlines, asking for invoices, contracts or source-of-funds evidence.
Tell the bank when ownership or control changes rather than waiting to be asked. Failing to respond to KYC requests is a common route to account restrictions and closure, even for businesses with nothing to hide.
Common mistakes to avoid
- Listing only the majority owner when another individual also owns 25% or more.
- Naming a figurehead as the control person instead of the individual who actually runs the company.
- Stopping at the foreign parent company instead of tracing ownership to individuals.
- Assuming that because BOI reporting no longer applies to a US-formed company, the bank will not ask about beneficial owners.
- Not telling the bank after a shareholder exits or a new investor joins.
- Treating a KYC refresh email as spam and missing its deadline.
NYBACS 360° support
How NYBACS helps
- Identifies who counts as a beneficial owner and control person in your structure, including through foreign holding companies.
- Prepares a clear ownership chart and supporting records that satisfy KYB questions on a foreign parent.
- Organizes identity and address documents for each owner, controller and signer.
- Helps you respond to KYC refreshes and requests for information, and keeps ownership records current after changes.
Frequently Asked Questions
Who is the control person if the founder is also the 100% owner?
The same individual can satisfy both prongs. A sole founder who owns the company and runs it is usually both the only ownership-prong beneficial owner and the control person.
Do investors with less than 25% need to provide KYC documents?
Not under the federal minimum, but banks may set a lower threshold for their own risk reasons, and any investor who is also a signer or officer will be verified in that role.
Is KYC different at fintech platforms?
The platform and its partner bank apply the same underlying rules, but the experience differs: more automated checks, live identity verification and fewer paper documents at the start, with document requests if monitoring flags something.
How often will the bank repeat KYC?
It depends on the risk rating and on events. Low-risk customers may be refreshed infrequently; higher-risk relationships are reviewed more often, and any material change can trigger a review.
Can a bank decline an account even if all my KYC documents are complete?
Yes. Complete documents show the bank who you are; the decision on whether the relationship fits its risk appetite remains the bank's own.
