Know your customer checklist for small businesses and credit unions

A know your customer checklist — a KYC checklist for short — is the list of steps you follow to confirm who a customer is, judge how much risk they bring, and keep watching the relationship after they sign up. For banks and credit unions, the core steps are set by law: the Customer Identification Program (CIP) rule requires a name, date of birth, address and identification number before an account is opened, plus verification, records and a customer notice.

Most small businesses aren’t “financial institutions” under those bank rules. They verify customers to stop fraud, not because a federal KYC mandate tells them to. But some rules reach everyone: the Office of Foreign Assets Control (OFAC) says all U.S. persons must comply with its sanctions. The checklist below works for both kinds of readers and is organized as before, at and after onboarding.

Who needs a know your customer checklist?

Banks and credit unions have legal KYC duties under the Bank Secrecy Act (BSA). The Financial Crimes Enforcement Network (FinCEN), a Treasury bureau, defines “bank” to include “a credit union organized under the law of any State or of the United States,” and its anti-money laundering (AML) program rule for banks names credit unions expressly. The National Credit Union Administration (NCUA) requires each federally insured credit union to keep a written BSA compliance program, approved by its board, that includes a CIP. Our banks and credit unions page shows where remote identity checks fit in that program.

Other financial businesses — broker-dealers, money services businesses, casinos and card clubs above set revenue levels, and mutual funds — are also “financial institutions” under FinCEN’s definitions, so they should check the rules written for their industry.

Most small businesses — online stores, rental companies, service firms — aren’t on that list, so they generally have no bank-style KYC mandate. A marketplace that takes payments from buyers and passes them on to sellers should look more closely: under FinCEN’s definitions, whether a business is a money transmitter (a type of money services business) is “a matter of facts and circumstances.” Three federal rules can still apply:

• Sanctions. OFAC’s frequently asked questions (FAQ) page on compliance covers U.S. citizens and permanent residents, anyone in the United States, and U.S.-incorporated companies.
• Identity theft. The Federal Trade Commission (FTC) Red Flags Rule applies to “financial institutions” and certain “creditors” that have covered accounts — and, the FTC notes, simply accepting credit cards doesn’t make a business a creditor.
• Large cash payments. A business that receives more than $10,000 in cash in one transaction or related transactions must file Internal Revenue Service (IRS) Form 8300, generally within 15 days, get the payer’s taxpayer identification number (TIN), and keep records for at least five years.

Your state, industry and payment partners may add requirements of their own, so confirm your list with counsel.

What a know-your-customer program should include

For banks and credit unions, the KYC requirements come from a few rules that work together:

• A written CIP, part of the AML program, with risk-based procedures that enable the institution to “form a reasonable belief that it knows the true identity of each customer.”
• Customer due diligence (CDD). The bank AML program rule requires “understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile,” plus ongoing monitoring to report suspicious transactions and, on a risk basis, to keep customer information current.
• Beneficial ownership. For business customers, FinCEN’s beneficial ownership rule requires you to identify and verify each person who directly or indirectly owns 25 percent or more of the company, plus one person with significant control, such as a chief executive officer or managing member.
• Sanctions checks. The Federal Financial Institutions Examination Council (FFIEC) BSA/AML Examination Manual says checking customers against OFAC lists remains a “separate and distinct” requirement — and that no government lists have been designated for the CIP’s own list check.

The manual also stresses a risk-based approach: its customer due diligence section says “there are no required risk profile categories,” and that their number and detail “will vary based on the bank’s size and complexity.”

One thing not to confuse: beneficial ownership collected at account opening is different from the beneficial ownership information reports FinCEN collects under the Corporate Transparency Act. As of October 16, 2026, FinCEN’s beneficial ownership information page says U.S. companies are exempt from that reporting, under a final rule effective August 14, 2026.

The know your customer checklist

Items marked (banks and credit unions) come from rules written for those institutions. The rest are good practice for any business that onboards customers.

Before onboarding

• Decide which rules apply. Use the section above, write the answer down, and name an owner for each rule.
• Assess your risks. The CIP rule bases procedures on the types of accounts, how they’re opened, the identifying information available, and your size, location and customer base. An online-only signup carries different risks than a branch visit.
• Set the information you’ll collect. (Banks and credit unions) At minimum: name, date of birth, address and an identification number — a TIN for U.S. persons, or for non-U.S. persons a TIN, passport number and country, or another government-issued document number. Under a June 27, 2025 order that FinCEN issued with the NCUA, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation (the Federal Reserve followed with a matching order on July 31, 2025), institutions may choose to get TIN information from a third-party source instead of from the customer, as long as they otherwise follow the CIP rule.
• Choose verification methods. The CIP rule allows documents (an unexpired government-issued photo identification, or ID, such as a driver’s license or passport), non-documentary methods (such as comparing information with a consumer reporting agency or public database), or both, and its non-documentary procedures must cover customers who don’t appear in person. For more, see our CIP basics for remote account opening.
• Write a “can’t verify” plan. (Banks and credit unions) The CIP rule asks you to spell out when you won’t open an account, how the customer may use it while you verify, when you’ll close it, and when you’ll file a Suspicious Activity Report (SAR).
• Prepare the customer notice. (Banks and credit unions) The rule requires notice before the account is opened — for example in the lobby, on your website or on the application — and includes sample wording.
• Set retention periods. (Banks and credit unions) Keep CIP identifying information for five years after the account closes, and verification records for five years after they’re made. Separately, OFAC’s rules require anyone engaging in a transaction subject to its regulations to keep records for at least 10 years.

At onboarding

• Collect the identifying information first. (Banks and credit unions) The CIP rule requires the minimum information “prior to opening an account.”
• Verify the document and the person. Check that the ID is genuine and unexpired, and that the person presenting it is its owner. For remote signups, one way to do this is a live selfie compared with the ID portrait plus a liveness check — here’s how that works in Securely Verify.
• Verify business customers and their owners. Collect documents showing the company exists, then identify and verify its beneficial owners. Under FinCEN’s February 13, 2026 exceptive relief, institutions no longer have to repeat this at every new account — only when a legal entity customer first opens an account, when facts call the earlier information into question, or when their risk-based procedures call for it.
• Screen against sanctions lists. The FFIEC manual’s OFAC section states: “New accounts should be compared with the OFAC lists prior to being opened or shortly thereafter.” Run the same sanctions screening on business owners.
• Record the purpose of the account. Ask what the customer will use the account or service for and what activity to expect. That becomes the baseline for spotting unusual activity later.
• Document what you did. (Banks and credit unions) The CIP rule calls for a description of each document relied on, the methods and results of other checks, and how any discrepancy was resolved.

After onboarding

• Monitor and update on a risk basis. The FFIEC manual says “the requirement to update customer information is event-driven” — triggered by things like unexplained activity or a change in business ownership.
• Re-screen when lists change. Banks should check existing customers when OFAC’s list changes and check funds transfers before they’re executed.
• Act on identity theft red flags. If the FTC rule covers you, your written program must identify relevant red flags, detect them, respond to them, and be updated periodically.
• Report what the rules require. If you block property or reject a transaction for sanctions reasons, OFAC requires a report within 10 business days.
• Test and train. (Banks and credit unions) The AML program rule requires independent testing and training for appropriate staff.

When should the know your customer process be performed?

Before the relationship starts, and again whenever risk changes. For banks and credit unions, the CIP rule sets the order: collect identifying information before opening the account and verify it within a reasonable time after. The FFIEC manual adds that an institution running OFAC checks after opening should not allow transactions other than initial deposits until the check is complete.

For a small business, a sensible pattern is to verify at signup and again before higher-risk moments, such as a first payout, a large order or a change of account owner. Sanctions screening is never one-and-done, because lists change.

This checklist summarizes the rules; it isn’t a substitute for your own written policies. Confirm the details with your compliance team or counsel.

If you want to try this on your own customers, start a 7-day free trial — 20 verifications, no card required.

Related guides

• Customer identification program (CIP) for remote account opening
• Enhanced due diligence (EDD): what U.S. rules require
• Proof of address: what documents count and how to verify them
• Merchant onboarding: how to verify a merchant and its owners

Sources: Code of Federal Regulations (CFR), 31 CFR 1020.220, Customer identification program requirements for banks (Electronic Code of Federal Regulations, or eCFR, current as of October 14, 2026); 31 CFR 1020.210, Anti-money laundering program requirements for banks (eCFR, October 14, 2026); 31 CFR 1010.230, Beneficial ownership requirements for legal entity customers (eCFR, October 14, 2026); 31 CFR 1010.100, General definitions (eCFR, October 14, 2026); 12 CFR 748.2, Procedures for monitoring Bank Secrecy Act compliance (NCUA rule, eCFR, October 7, 2026); FinCEN Issues Exceptive Relief to Streamline Customer Due Diligence Requirements (FinCEN, February 13, 2026); FinCEN Permits Banks to Use Alternative Collection Method for Obtaining TIN Information (FinCEN, June 27, 2025); Beneficial Ownership Information Reporting (FinCEN, accessed October 16, 2026); Customer Identification Program, Customer Due Diligence and Office of Foreign Assets Control sections (FFIEC BSA/AML Examination Manual, accessed October 16, 2026); FAQ 11: Who must comply with OFAC sanctions? (OFAC, updated August 21, 2024); Assessing OFAC Name Matches (OFAC, updated September 9, 2026); 31 CFR 501.601, Records and recordkeeping requirements (eCFR, October 14, 2026); Fighting Identity Theft with the Red Flags Rule: A How-To Guide for Business (FTC, May 2013); IRS Form 8300 Reference Guide (IRS, updated July 27, 2026). This article is general information, not legal or compliance advice.