Quick answer
KYC (know your customer) is the set of checks a financial company must run to confirm who you are before and while you use its services. In the US, banks must collect at least your name, date of birth, address and an ID number, then verify them[2].
Key points
- KYC (know your customer) is the identity step in anti-money-laundering rules: the firm identifies you, then verifies it.
- A US bank has to collect at least four details from you: name, date of birth, address and an ID number.
- Verification can finish after the account opens, which is why a new account may start with limits.
- Digital ID checks are acceptable to the global standard setter when the systems are reliable and independent.
- KYC does not stop at sign-up: firms keep monitoring activity and refreshing your details for as long as you are a customer.
On this page
- Why does a payment app need your passport before you can send money?
- What will the sign-up screens ask you for?
- What happens between tapping submit and a fully working account?
- How does the selfie check decide it is really you?
- What if you are opening a business account?
- Why might the app ask for more, or ask again later?
- Who actually runs these checks inside a fintech app?
- FAQ
- Sources
#Why does a payment app need your passport before you can send money?
Download a neobank or payment app and the first real screen asks for a photo of your ID and a short selfie. That step is KYC, short for know your customer. It is the identity part of anti-money laundering rules, and regulators tend to call it customer due diligence. Our one-line KYC glossary entry has the short definition; this page follows the check from the customer's side of the screen.
The reason is practical. The FATF, the intergovernmental body behind the global anti-money-laundering standards, describes laundering as processing criminal proceeds so their illegal origin is disguised[1]. That needs accounts, and an account tied to a verified person is a poor hiding place.
#What will the sign-up screens ask you for?
Each country writes its own list, but the US Customer Identification Program rule for banks is a clear example. Before an account is opened, the bank needs at least your name, your date of birth (for individuals), your address and an identification number — a taxpayer ID for US persons, or for example a passport number for non-US persons[2].
| You are asked for | In practice | What it does for the bank |
|---|---|---|
| Name | Your full legal name | Ties the account to one real person |
| Date of birth | Needed for individuals | Tells apart two people with the same name |
| Address | A residential or business street address, with some exceptions | Links the person to a physical place |
| ID number | Taxpayer ID for US persons; for others, e.g. a passport number | Connects you to an official record |
Source: 31 CFR 1020.220[2]. Other countries set their own lists, usually covering similar basics.
Expect a question about what the account is for, too. UK rules ask a regulated firm to identify the customer, verify that identity, and assess — and where appropriate get information on — the purpose and intended nature of the relationship[3]. Your answer becomes the yardstick: it tells the firm what normal activity on your account should look like.
#What happens between tapping submit and a fully working account?
Sign-up KYC as the customer sees it
Enter your details
Name, date of birth, address, an ID number and what you plan to use the account for.
Show your ID
Photograph a passport or other document, or let the firm check your details against independent data.
Prove it is you
Take a selfie or short video so your face can be matched with the photo on the document.
Background screening
Your name is checked against sanctions lists and lists of politically exposed persons.
Account opens
The firm sets a risk level, which decides how closely the account is watched from then on.
The order is not always that neat. In the US, a bank may verify your identity within a reasonable time after the account is opened, using documents, other methods or both, as long as it can form a reasonable belief that it knows who you really are[2]. So an app may let you in at once but hold back features until the check is done. The screening step has its own rules, covered in sanctions screening.
#How does the selfie check decide it is really you?
The FATF's 2020 guidance on digital identity splits the job in two: identity proofing and enrolment, where attributes such as name and date of birth are collected, the evidence is checked and tied to one unique person, and authentication, where a later login is matched to the person who enrolled[4]. It says reliable, independent digital ID systems with suitable risk controls may count as standard risk, or even lower risk, for identification and verification[4].
On a phone, that typically means a live photo or clip of your face matched with the document picture, plus a test that a real person is present. Fraudsters aim at this step, for instance with synthetic identities that mix real and invented details.
#What if you are opening a business account?
A company has no face to match, so the check reaches the people behind it. Covered US financial institutions must identify and verify the beneficial owners of legal entity customers[5]: each individual who directly or indirectly owns 25 percent or more of the equity, plus one individual with significant responsibility to control, manage or direct the company, such as a chief executive or chief financial officer[5].
Worked example
Worked example: which owners does the bank record?
A four-person company opens a business account at a digital bank. The holdings below add up to 100% (checked with code). Only stakes of 25% or more count under the US test, and one control person is recorded on top.
- Ana holds 30%
- Recorded (30% is at least 25%)
- Ben holds 25%
- Recorded (the rule says '25 percent or more')
- Chloe holds 20%
- Not recorded under the ownership test
- Dev holds 15%
- Not recorded under the ownership test
- Small investors hold 10% in total
- Not recorded under the ownership test
- Control person
- One individual with significant control, e.g. the CEO (Chloe, or someone with no shares)
#Why might the app ask for more, or ask again later?
The checks scale with risk. Taking on a politically exposed person — someone with a prominent public role, such as a minister — needs senior management approval under UK rules, along with measures to establish source of wealth and funds and enhanced ongoing monitoring[6].
For everyone else, the questions come back over time. UK rules require ongoing monitoring of transactions throughout the relationship, including the source of funds where necessary, and keeping due diligence documents and information up to date[3]. US bank anti-money-laundering programmes must likewise include risk-based ongoing customer due diligence, including updating customer information[7]. That is the reason an app can ask you to confirm your address or job years after you joined. The records are kept too: in the UK, generally for five years after the firm knows, or has reasonable grounds to believe, that the relationship has ended[8].
Common beginner mistakes at the KYC step
Treating the check as optional
Regulated firms are required to identify and verify customers; skip the check and the account usually cannot open.
Describing the account one way and using it another
Your activity is compared with what you said at sign-up; a large mismatch can lead to questions or a freeze.
Sending ID photos through a link in a message
Genuine checks run inside the firm's own app or site. A link from a stranger may be a phishing page harvesting documents.
#Who actually runs these checks inside a fintech app?
KYC is the first layer; sanctions screening, payment monitoring and suspicious-activity reports follow. Many apps lean on a partner bank for part of it — see is a fintech app a bank? — and on specialist software covered in what is regtech.
Go deeper: for the legal framework behind these checks and the reporting duties that sit alongside them, read KYC and AML explained on Bitfolio.
The bottom line
For a bank or payment customer, KYC is the identity step at sign-up plus the check-ins that follow: a few details, an ID photo, often a selfie. Business accounts add the owners behind the company. Do it only inside the firm's own app.
Frequently asked questions
Is KYC the same as AML?
No. AML (anti-money laundering) is the whole system of rules for preventing and detecting money laundering. KYC, or customer due diligence, is one part of it: knowing and verifying who the customer is[3].
Why can I use my new account before my ID is verified?
Some rules allow it. US banks, for example, must verify identity within a reasonable time after the account is opened, not necessarily before[2]. The firm may limit what you can do until verification is complete.
Can I open a financial account without ID?
Generally not with a regulated firm, because collecting and verifying identifying information is a legal requirement. Some countries offer simplified accounts with lower limits; the rules vary by country.
How long will the company keep my documents?
It depends on the country. Under the UK rules, records are generally kept for five years after the relationship ends[8].
Sources
- Frequently asked questions: money laundering — Financial Action Task Force (FATF), 2026 Primary
- 31 CFR 1020.220 — Customer identification program requirements for banks — eCFR (US Code of Federal Regulations), 2026 Primary
- The Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017, regulation 28 (Customer due diligence measures) — legislation.gov.uk, 2026 Primary
- Guidance on Digital Identity — Executive Summary — Financial Action Task Force (FATF), 2020 Primary
- 31 CFR 1010.230 — Beneficial ownership requirements for legal entity customers — eCFR (US Code of Federal Regulations), 2026 Primary
- The Money Laundering Regulations 2017, regulation 35 (Politically exposed persons) — legislation.gov.uk, 2026 Primary
- 31 CFR 1020.210 — Anti-money laundering program requirements for banks — eCFR (US Code of Federal Regulations), 2026 Primary
- The Money Laundering Regulations 2017, regulation 40 (Record-keeping) — legislation.gov.uk, 2026 Primary
.jpg){kind=link}