Regulated companies in the USA, such as banks, fintechs, crypto platforms, iGaming firms, and similar online platforms that juggle many users and financial transactions, are required to have a Customer Identification Program (CIP). In practice, this means collecting and verifying the user’s personal details. The most common approach nowadays to achieve this goal is to either build or implement a sort of automation tool for a proper, multi-layer Know Your Customer (KYC) verification process. It helps automatically extract the user’s name and address, as well as cross-match important details like an address or a Social Security number (SSN).
First of all, why is it really important to verify users? While it might seem like an unnecessary, overly burdensome task for some clients, US regulations are complex, but the issue is that AI and fraudulent tactics are getting out of hand. Deepfakes are getting really hard to spot for less-skilled users or poorly made KYC services that don’t rely on proper liveness checks. This results in account takeovers, unwanted chargebacks, or worse, millions of losses due to non-compliance and poorly managed KYC processes, including the lack of ongoing due diligence and risk management or reporting.
In this blog post, we break down the key elements of KYC in the US and explain in a simple way what you need to know about legal aspects and practical KYC implementation.
What is the KYC Process for the US?
KYC, or the Know Your Customer process, is a legal requirement for companies to verify new and existing users, often through measures like government-issued ID verification and selfie verification with biometric checks.
Aside from regulatory requirements, businesses around the world and in the United States use the KYC process to:
- Prevent fraud, such as identity theft or money laundering
- Protect the general financial system using other, bigger/additional measures, as part of anti-money laundering AML compliance.
KYC is the primary and one of the most commonly used fraud prevention measures, even in less strictly regulated industries, such as e-commerce marketplaces that have listings of age-restricted goods, such as vapes, and need a KYC solution to confirm the buyer’s age before checkout, since age gating can be easily bypassed.
Which Companies Use KYC in the United States?
In the US, KYC compliance covers a bunch of different industries and is required in many use cases, since many businesses now operate either only online or have a digital system and accept online payments. This automatically often requires KYC before the user can open an account as a way to prevent impersonation or issues like stolen credentials used by a different person for insurance fraud and other scams, depending on the particular scenario.
Some examples of businesses that use KYC in the US include:
- Banks and credit unions
- Fintech firms and neobanks
- Crypto exchanges
- Insurance companies
- Payment processors and MSBs
- E-commerce platforms
- Software service providers
- Real estate and PropTech firms
- Healthcare services and telemedicine
- Automotive and logistics companies
- iGaming and gambling platforms
- Legal advisory services
- Business consulting firms
Often, any business that handles large transactions and is considered to be more “high-risk” in terms of the industry, due to handling financial data and having monetized user accounts, will need to do KYC on its customers.
Who Regulates KYC in the US?
FinCen, or the Financial Crimes Enforcement Network (FinCEN), is responsible for enforcing KYC and AML regulations in the USA. The regulatory body constantly reviews and updates its guidelines, and, for example, recently, extended AML requirements to registered investment advisers.
Other notable mentions in this context include the Office of Foreign Assets Control (OFAC) and the Securities and Exchange Commission (SEC). OFAC administers and enforces U.S. economic sanctions, while the SEC oversees the integrity of the securities markets and enforces related KYC/AML compliance requirements.
What are the KYC Regulations in the US?
KYC regulations, along with anti-money laundering (AML) compliance in the United States, are governed by the Bank Secrecy Act (BSA), enacted in 1970. The BSA has been amended multiple times to keep pace with changes in the financial system and the evolving tactics used by criminals. Today, it works alongside the USA PATRIOT Act to strengthen efforts against money laundering and terrorist financing.
The BSA requires US-based regulated firms to:
- File reports of cash transactions above $10,000
- Verify the identities of individuals conducting financial transactions
- Maintain detailed financial records to create a clear audit trail
- Report suspicious activity that might signify money laundering, tax evasion, or other crime
Other KYC/AML Regulations that Shape the US Regulatory Framework
There are important AML regulations or rules for the risk-based approach that require both KYC and other due diligence measures for the US.
Key ones include:
The Anti-Money Laundering Act of 2020 (AMLA)
AMLA modernized the AML framework in the US and introduced new provisions, such as updated rules for digital asset service providers, increased penalties for violations, an obligation to report beneficial ownership, and stricter Know Your Business (KYB) checks, as well as strengthened information sharing between private and public sectors.
The FATF Recommendations
As a founding member of the Financial Action Task Force, the U.S. aligns its AML policies with FATF standards, which are built around the importance of risk-based approaches, cryptocurrency regulations, and global transparency efforts. FATF has its main guidelines, also known as the 40 Recommendations. They provide the USA and other countries on a global level with guidance on building effective AML programs.
The Corporate Transparency Act (CTA)
The Corporate Transparency Act (CTA) is a US regulation enacted as part of AMLA. It requires reporting companies to file Beneficial Ownership Information (BOI) reports with the Financial Crimes Enforcement Network (FinCEN), a division of the Treasury Department. The Act aims to help detect and prevent illicit activities like money laundering through shell companies and tax evasion by collecting information about corporate structures of entities (like corporations and LLCs) operating within the US market.
What are the Components in a Compliant US KYC Process?
There are three pillars of KYC compliance that must be taken into account when you build your KYC strategy:
1. Customer Identification Program (CIP)
In practice, CIP requires companies to verify both individuals and corporate clients (other companies) when starting a new business relationship. This is the very first verification step, which companies use at the account opening stage (compared to other KYC and ongoing due diligence measures).
CIP requirements for US companies include steps like:
- Collecting the user’s name, address, date of birth and the number of their government-issued ID document (common documents in the USA are passports, driver’s licenses, or Social Security cards).
- Verifying the collected KYC details using reliable verification methods, such as document verification, biometric verification and other non-doc checks, like database verification, where certain details, such as the user’s SSN/entity’s EIN, can be screened against official government sources.
- Adding ongoing risk-based controls that adapt to the customer’s profile and other risk factors, like geographical location, regulatory exposure, or product risk. Tools like iDenfy’s AI-powered Risk Assessment help detect changes in real-time, identifying the key points linked to the customer and their behavior, which can be suspicious and require extra manual verification.
2. Customer Due Diligence (CDD)
In essence, CDD is the process of assessing the customer’s level of risk in terms of the links they have to potential risks or financial crime. Government by FinCEN’s CDD Final Rule, customer due diligence measures help US-based firms understand who their customers are, how they operate, and the risks they present, even after the onboarding stage.
In general, CDD includes screening PEPs and sanctions lists, conducting criminal background checks, looking up adverse media, among other processes, like:
- Adjusting the level of due diligence. This helps identify risks and determine the level of due diligence linked to each customer. EDD is applied for high-risk customers and SDD, or simplified due diligence, is used for low-risk customers.
- Corporate structure verification for business clients. This includes verifying beneficial owners of legal entities, depending on the structure (for example, sole proprietorship verification is typically considered less complex).
- Conducting ongoing due diligence. This includes measures like transaction monitoring and updating customer profiles, since even low-risk customers can switch to high-risk customers eventually.
Modern companies automate customer due diligence by building different KYC/AML workflows using no-code integrations or third-party KYC service providers. For example, if a user is deemed as high-risk due to identified Politically Exposed Person (PEP) status, they are required to be checked using stricter/extra CDD measures, also known as Enhanced Due Diligence (EDD).
Related: What is the Difference Between CDD and EDD?
3. Ongoing Monitoring
The last element in KYC, or ongoing monitoring, carries the same level of importance as verification at the account opening stage. It works like a post-onboarding phase of US KYC and involves reviewing customer activity to identify unusual transactions, suspicious behavior, or changes in risk patterns that can indicate financial crime.
For example, a company’s transaction monitoring software can detect AML red flags, like sudden volume spikes or transactions coming from high-risk jurisdictions. If suspicious activity is detected, regulated entities in the US need to file a Suspicious Activity Report (SAR), which was also established by the BSA. If suspicious activity is detected, regulated entities in the US need to file a Suspicious Activity Report (SAR), which was also established by the BSA.
Related: KYC Verification [3 Main Components & More]
What are Common Risk Signals in KYC Processes?
Risk signals in KYC compliance include suspicious signs/red flags that indicate the user’s potential links to fraudulent activity, which ranges from financial misconduct or money laundering to sanctions breaches. For example, atypical transaction patterns can result in an actual case of financial crime. An illustration of that is a newly opened US account that immediately starts processing large international transactions with no clear business purpose.
In general, common KYC red flags include:
- The use of nominee shareholders or shell companies
- Customers operating from high-risk jurisdictions
- Inconsistencies between customer documentation and observed behavior
It depends on the client type. If it’s an individual customer, a risk signal can be trying to avoid certain personal information during the KYC process, like refusal to upload the requested documents. For companies, the principle is the same: a risk factor can be when an entity is reluctant to disclose beneficial ownership, or submits ownership structure info that changed without explanation.
What are the Penalties for KYC Non-Compliance in the US?
Non-compliance with KYC/AML rules in terms of violations of the BSA can result in damaging consequences for US companies. Civil penalties range from five years in prison to up to $250,000 in fines. For businesses, the fines are even higher, but they depend on the level of committed crimes. For example, a breach of AML compliance can result in ten years of prison and fines up to $500,000, or, sometimes, twice the value of the illicit transactions.
Final Thoughts
There are other important steps that you shouldn’t forget when it comes to KYC compliance in the US. For example, all compliance notes and KYC/AML checks need to be logged, which means you need to have a history log with all the dates, verification/screening results and reasons for actions, like why EDD was applied or why extra documentation is needed. All documentation should align with the BSA standards. Often, a financial institution will have to collect and verify details, such as a government-issued ID, a utility bill for PoA verification, or bank statements, to verify the Source of Funds (SOF).
The good news is that iDenfy has it all – KYC/KYB and AML compliance – tools designed to onboard and screen both individuals and other companies using efficient, customizable workflows. A recent case study proved that our customers save at least 40 hours weekly using automation. iDenfy also specializes in the US market, providing the right verification, documentation and monitoring measures, as well as local onboarding flows, like CLEAR1’s verification integration.
Book a quick demo to see how the KYC software actually performs.
Try for free 
