Know Your Customer (KYC) compliance is the set of checks a regulated business must run to confirm who its customers are, understand the risk each one poses and keep monitoring them. It covers identity verification, beneficial ownership, risk assessment and ongoing monitoring, and it ends in a documented decision that an examiner can review.
In the United States, the rule that sets customer due diligence requirements is FinCEN’s Customer Due Diligence (CDD) Rule, an amendment to the Bank Secrecy Act regulations. FinCEN, the Financial Crimes Enforcement Network, says it applies to these covered financial institutions:
Businesses outside that list often run the same checks anyway. Their banks, insurers and trading counterparties expect it, and they need to manage sanctions exposure. Energy and commodity traders, manufacturers with global suppliers and fintech firms all fall in this group. The same work has other names: Know Your Business (KYB) for business customers, Know Your Supplier (KYS) for vendors, and counterparty due diligence on trading desks.
Banks and credit unions apply the rule to the business as the customer. Whether the account holders are customers or members, the business applicant, its owners and the people who control it are what get verified.
No rule lists five stages by name. Programs commonly organize the work this way, and each stage maps to the four core requirements FinCEN’s CDD Rule sets: identify and verify customers, identify and verify the beneficial owners of companies, understand the nature and purpose of the relationship, and monitor on an ongoing basis.
| Stage | What happens | What the file should show |
|---|---|---|
| 1. Collect | Gather identifying information and company documents, and ask about the nature and purpose of the relationship. | What was requested, what arrived and when. |
| 2. Verify | Check identity and company documents against reliable sources. | The evidence relied on and any mismatch found. |
| 3. Resolve ownership | For a business, identify and verify each individual who owns 25 percent or more and one individual who controls it. | The ownership chart and each owner’s verification. |
| 4. Screen and rate | Screen the business and its owners against sanctions, politically exposed person (PEP) and adverse media sources, then assign a risk rating. | Each hit, the reasoning behind clearing or escalating it and the rating. |
| 5. Monitor and refresh | Watch for suspicious activity and update customer information on a risk basis. | Re-screening dates, refreshed documents and changes since approval. |
When a legal entity opens an account, a covered institution must identify and verify the natural persons behind it. FinCEN states that the institution identifies and verifies any individual who owns 25 percent or more of the legal entity, and an individual who controls it. The institution keeps written policies and procedures reasonably designed to do this.
On February 13, 2026, FinCEN issued exceptive relief (FIN-2026-R001) from the requirement to identify and verify beneficial owners at each new account opening. An institution that uses the relief can limit that step to three situations: when a legal entity first opens an account, when it learns facts that reasonably call into question the reliability of the beneficial ownership information it holds, and as its risk-based customer due diligence procedures require. Using the relief is the institution’s choice, so an institution may keep verifying at every account opening.
Do not confuse this with Beneficial Ownership Information (BOI) reporting. That is a separate FinCEN rule about what companies report to FinCEN. On August 11, 2026, FinCEN finalized it so that U.S. companies are exempt from BOI reporting. The beneficial ownership step in a Know Your Customer (KYC) file is an institution’s own obligation under the CDD Rule.
A red flag is a fact that does not fit the rest of the file. It is not proof of wrongdoing. It is a reason to ask a question and write down the answer. These are common examples that compliance teams escalate.
The legal name on the tax form differs from the articles, or an address changes between documents.
Layers of holding companies, or no individual at the end of the chain who can be named and verified.
An owner matches a sanctions, politically exposed person (PEP) or adverse media entry and the match cannot be cleared with evidence.
An applicant delays or declines requests for documents that policy requires.
The stated purpose of the relationship does not match the business described in its documents.
An ownership change, a new list entry or an expired document turns up while the relationship is open.
FinCEN also publishes advisories on specific risks, such as its June 12, 2018 advisory on corrupt senior foreign political figures and their financial facilitators (FIN-2018-A003).
An examiner or auditor will ask why you approved a customer. A defensible program can answer from the file, without anyone rebuilding the story from email.
The checks above are the same whether a person or software runs them. Software earns its place by keeping each step in one record and by explaining each finding. Compliable.ai’s AI agents read onboarding documents, resolve beneficial ownership, screen every owner and write a decision record. A person makes every final decision. See Know Your Customer (KYC) compliance software for how that works, or use the buyer’s guide to compare vendors.
The checks stay the same. The depth and the sources change with the business.
Every regulatory statement on this page comes from FinCEN. Read the source for the current text.
The set of checks a regulated business runs to confirm who its customers are, understand the risk each one poses and keep monitoring them. It covers identity verification, beneficial ownership, risk assessment and ongoing monitoring, and it ends in a documented decision.
Programs commonly organize the work in five stages: collect customer information, verify identity, identify the beneficial owners of a business, screen and risk-rate, then monitor and refresh. FinCEN’s customer due diligence rule sets four core requirements that these stages put into practice.
A fact that does not fit the rest of the file and needs an explanation. Examples: a name that differs between documents, an ownership structure that hides who controls the business, an owner who matches a sanctions or politically exposed person (PEP) list, or an applicant who will not provide requested information.
In the United States, FinCEN’s customer due diligence rule covers federally regulated banks, federally insured credit unions, mutual funds, brokers or dealers in securities, futures commission merchants and introducing brokers in commodities. Other businesses often run the same checks because their banks and counterparties expect them.
Yes. When the customer is a legal entity, the institution identifies and verifies the individuals who own or control it. Many teams call the business-level version Know Your Business (KYB).
FinCEN’s rule requires ongoing monitoring and, on a risk basis, keeping customer information up to date. It does not set one calendar interval for every customer, so your written procedures decide, based on risk.
Bring a real onboarding file. We will process it live and show you where your policy sets each step, from the first document to the decision record.