"KYC" is the name banks use for the checks they run before they let you open an account. For a business account, two federal rules do most of the work. The first requires the bank to identify the customer opening the account. The second requires the bank to identify the human beings who own and control the company.
Both rules are short. Neither one asks for a signed office lease, a business plan, a minimum deposit, or a visit to a branch. Banks ask for those things anyway, because each bank writes its own risk policy on top of the legal minimum.
Telling the two apart is the whole point of this page. The legal minimum is fixed and identical at every bank. The policy layer is not, which means a rejection at one bank is not a rejection everywhere.
What the rules actually require
1. Customer identification: 31 CFR § 1020.220
Every bank must run a written Customer Identification Program, usually called a CIP. Before opening an account, the bank has to obtain four pieces of information at a minimum:
- Name.
- Date of birth, for an individual.
- Address.
- Identification number.
The address requirement is worth reading closely. For an individual, the regulation asks for "a residential or business street address." For a customer that is not an individual, which includes your LLC or corporation, it asks for "a principal place of business, local office, or other physical location."
The identification number is where the rule treats two groups differently. For a U.S. person, the regulation requires "a taxpayer identification number." For a non-U.S. person, it allows "one or more of the following: A taxpayer identification number; passport number and country of issuance; alien identification card number; or number and country of issuance of any other government-issued document evidencing nationality or residence and bearing a photograph or similar safeguard."
After collecting that information, the bank has to verify your identity within a reasonable time. It can do this with documents, such as a government-issued ID for a person or formation documents for a company. It can also use non-documentary methods, such as comparing what you gave it against a database, or checking references from another financial institution.
2. Beneficial ownership: 31 CFR § 1010.230
When the customer is a company rather than a person, the bank has a second job. It has to find out which human beings are behind the company. The regulation says covered financial institutions must "identify and verify beneficial owners of legal entity customers," and it defines a beneficial owner in two parts.
The ownership prong. Each individual who "directly or indirectly ... owns 25 percent or more of the equity interests" of the company. Because the threshold is 25 percent, there can be at most four such people. There can also be none, if the equity is split so widely that nobody reaches 25 percent.
The control prong. One individual "with significant responsibility to control, manage, or direct" the company. The regulation gives examples: a Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, Managing Member, General Partner, President, Vice President, or Treasurer.
So the bank collects information on at most five individuals: up to four owners, plus one control person. The control person is always required, even when no owner reaches 25 percent, and even when the control person is the same human being as the owner. For a single-member LLC with one founder, that founder fills both slots.
For each of these individuals, the bank collects the same categories of information it collects for an individual customer: name, date of birth, address, and an identification number. The bank must do this "at the time a new account is opened."
The rule was finalized on 11 May 2016, and banks had to comply from 11 May 2018. That is why the beneficial ownership form feels standard everywhere. Every bank has been running the same rule for years.
The citation people get wrong
You will often see this described as "the 31 CFR § 1020.210 rule." That citation is wrong.
Section 1020.210 is titled "Anti-money laundering program requirements for banks." It is the umbrella provision that says a bank must have an anti-money laundering program at all. The beneficial ownership requirement lives in a different part of the regulations, at 31 CFR § 1010.230, and it applies to financial institutions generally rather than to banks alone.
The distinction matters when you are trying to check what a bank is allowed to ask for. If you look up 1020.210 expecting to find the 25 percent rule, you will not find it, and you may conclude the bank is inventing requirements when it is not.
🇺🇸 If the IRS counts you as a U.S. person
The two rules apply to you exactly as written above. The differences are these.
Your identification number must be a taxpayer identification number. The passport alternative in § 1020.220 is written for non-U.S. persons. It is not open to you. In practice the bank asks for the company's EIN as the customer's identification number, and for your own tax number as the beneficial owner's identification number.
You will fill both beneficial ownership slots yourself if you are the only member of an LLC. You are the 25 percent owner and you are the control person. This is normal and it is not a sign that something is wrong with your application.
The policy layer is light for you. A street address in the United States, a domestic phone number, and an in-person branch visit are all things you can produce without difficulty, so the bank's internal policy rarely becomes the thing that stops you.
Do not confuse the bank's rule with the reporting rule. The beneficial ownership information a bank collects under § 1010.230 goes to the bank. It is a separate system from beneficial ownership information reported directly to FinCEN under the Corporate Transparency Act, which lives at § 1010.380. Different regulation, different recipient. Whatever your obligation is under the reporting rule, the bank still has to run its own check.
🌏 If it does not
The legal minimum is the same. This surprises people who have been told that non-residents face a special KYC regime. There is no special regime in the regulation.
The regulation explicitly accommodates you. Section 1020.220 lets a non-U.S. person be identified by a passport number and country of issuance, by an alien identification card number, or by another government-issued document showing nationality or residence and carrying a photograph. You do not need a U.S. tax number to satisfy the CIP rule.
What actually blocks you is bank policy. A bank may require a U.S. street address, a U.S. phone number, an in-person meeting at a branch, a signed lease, a minimum opening deposit, or a business relationship it can understand. None of these come from § 1020.220 or § 1010.230. They come from the bank's own risk appetite, and banks are permitted to set that appetite wherever they like.
A rejection is a policy decision, not a legal ruling. Two banks can look at the identical company and reach opposite conclusions. Neither is breaking the law. When a bank tells you "we cannot do this because of regulations," the accurate translation is usually "our policy does not allow this," and the two sentences have very different consequences for what you should do next. The first suggests giving up. The second suggests asking a different bank.
Address the address problem honestly. The rule asks for "a principal place of business, local office, or other physical location" for the company. It does not say the location must be leased office space. But the bank's policy may say more than the rule does, and a mail-forwarding address is where many applications quietly fail. Ask a bank what it accepts before you file anything.
What is the same, and what is not
| Item | 🇺🇸 U.S. person | 🌏 Not a U.S. person |
|---|---|---|
| Which rules apply | § 1020.220 and § 1010.230 | The same two rules |
| Information the bank must collect | Name, date of birth, address, identification number | Identical |
| Identification number accepted | Taxpayer identification number | Taxpayer identification number, or passport number and country of issuance, or alien ID card number, or another photo government document showing nationality or residence |
| Beneficial ownership disclosure | Owners at 25% or more, plus one control person | Identical |
| Company address the rule asks for | Principal place of business, local office, or other physical location | Identical |
| What usually decides the outcome | The bank's fraud and credit checks | The bank's internal policy on non-resident customers |
The legal column is identical almost all the way down. The last row is where the two experiences separate, and it is not the regulation doing the separating.
Common mistakes
🇺🇸 If the IRS counts you as a U.S. person
- Treating the bank's beneficial ownership form as the same thing as a FinCEN report. They are separate systems under separate regulations, and satisfying one does not satisfy the other.
- Listing only owners on the beneficial ownership form and leaving the control person blank. The rule requires one control person regardless of who owns what.
- Assuming that because nobody owns 25 percent, the form does not apply. The control prong still applies.
🌏 If it does not
- Believing you need a U.S. tax number to pass KYC. The regulation names a passport number and country of issuance as an accepted identification number for a non-U.S. person.
- Reading one bank's rejection as a legal verdict. It is a policy decision by one institution.
- Handing over documents nobody asked for, in the hope of looking cooperative. It does not change the bank's policy, and it puts more of your information in more places.
- Assuming a mail-forwarding address will satisfy the bank because the regulation only says "physical location." The regulation is the floor. The bank's policy sits above it.
FAQ
What is the legal minimum a bank must collect from my company?
Name, address, and an identification number for the company, under 31 CFR § 1020.220. Plus name, date of birth, address, and an identification number for each beneficial owner, under 31 CFR § 1010.230.
Who counts as a beneficial owner?
Each individual who owns 25 percent or more of the company's equity interests, which is at most four people, plus one individual with significant responsibility to control, manage, or direct the company. The maximum is five individuals.
Nobody in my company owns 25 percent. Do we skip the form?
No. The ownership prong may produce zero names, but the control prong still requires one individual. The bank will ask who runs the company.
Can I open a U.S. business bank account without a Social Security number?
The customer identification rule does not require one from a non-U.S. person. Section 1020.220 accepts a passport number and country of issuance, an alien identification card number, or another government-issued document showing nationality or residence and carrying a photograph. Whether a particular bank will proceed on that basis is a question about that bank's policy, not about the rule.
The bank asked for a lease and a business plan. Is that a legal requirement?
No. Neither § 1020.220 nor § 1010.230 mentions a lease, a business plan, a minimum deposit, or a branch interview. Those requests come from the bank's own risk policy, which each bank writes for itself.
Is the bank's beneficial ownership form the same as reporting to FinCEN?
No. The bank collects beneficial ownership information under § 1010.230, and the information goes to the bank. Reporting beneficial ownership directly to FinCEN is a separate system under § 1010.380. Your position under one does not decide your position under the other.
Why do I keep seeing 31 CFR § 1020.210 cited for this?
It is a common miscitation. Section 1020.210 is the anti-money laundering program requirement for banks. The beneficial ownership requirement is § 1010.230.
One bank rejected my application. Does that mean no bank will take me?
Not necessarily. The legal minimum is identical at every bank, but the policy layer is not. Banks differ in how they treat non-resident owners, foreign phone numbers, and mail-forwarding addresses. Ask what a bank accepts before you apply, rather than after.