KYC Process Explained: Steps, Checks, and Where Banks Lose Time

30 sec read

TLDR

• The KYC process is how a US bank confirms who a customer is before opening an account and keeps checking after.
• It runs in seven steps, from intake to ongoing monitoring, each tied to the CIP or CDD rule.
• Most waiting comes from how the steps are wired, like retyped data, checks run in a line, and flags sent to people.
• In 2026, FinCEN stopped requiring owner rechecks at every new account, and an AML program rewrite is still only a proposal.
• Unmeshed runs KYC as one durable workflow with parallel screening, decision tables, and reviewer steps, using your own providers.

The KYC process is why a new bank account sometimes takes days instead of minutes, and the answer you usually get is, "It's just KYC."

That answer isn't wrong. It's just not helpful. So we walked through the KYC steps in the order a US bank does them, matched each one to the federal rule behind it, and looked for the spots where a case sits and waits.

Think of boarding a flight. Someone checks your ID. Someone checks a list. Someone checks your bag. Then a person waves you through. Most of the delay isn't any one check. It's the one counter where everything waits on a single agent.

A few quick notes. This is general information about US banks, not legal advice. We make workflow software, so we'll tell you where we fit and where we don't. And we couldn't find reliable public numbers on how long KYC takes, so we won't make any up.

Okay, let's get into it.

1. What Is the KYC Process?

The KYC process is how a bank confirms who a customer is before it opens an account and keeps checking afterward. KYC stands for Know Your Customer. It covers collecting identifying details, verifying them, screening against government lists, rating risk, and monitoring. In the US, FinCEN sets the rules.

In kid terms, the bank has to be sure you are who you say you are. And it has to keep an eye out after that, too.

Two federal rules do most of the work. The Customer Identification Program rule covers who you are. FinCEN's customer due diligence rule covers who owns a company and how risky the relationship looks.

People mix up KYC and AML. KYC is the customer side. AML, short for anti-money laundering, is the bigger job of spotting and reporting financial crime, and KYC feeds it. This post sticks to US banks, since other countries have their own rules.

2. What Are the Steps in the KYC Process?

The KYC process has seven steps. A bank takes in the customer, collects required information, verifies identity, checks government lists and screens for risk, identifies owners of company customers, scores risk and decides, then keeps records and keeps monitoring. Each step maps to a federal rule.

You'll often see guides that say five stages of KYC. Those group the same work more loosely, usually identify, verify, screen, assess risk, and monitor. We split it into seven because the federal rules list more pieces than that. Same road, more signposts.

1. Intake and Customer Notice

Intake is where a customer applies, and the bank tells them it will verify their identity. The rule requires adequate notice before the account opens, such as a lobby sign, a website notice, or text on the application. Good intake also catches missing fields before anything expensive runs.

The notice part is easy, and the rule even includes sample wording banks can use. The part people skip is the second one. Catch a missing date of birth here, and you save a paid identity check later. It's like making sure you have your passport before you join the queue.

2. Collect the Required Information

Before opening an account, a US bank must collect four things. Name, date of birth for an individual, address, and an identification number. For a U.S. person, that number is a taxpayer identification number. Non-U.S. persons can give a passport number or another government-issued ID number.

That's the floor. Banks can ask for more, but those four are the minimum the rule sets. For an individual, the address has to be a residential or business street address, with exceptions like military post office boxes.

3. Verify the Customer's Identity

Verification means checking that the details are true. A bank can use documents such as a driver's license or passport, non-documentary methods such as comparing data against a public database or consumer reporting agency, or both. The rule allows this within a reasonable time after the account opens.

Non-documentary methods can also include contacting the customer, checking references with other financial institutions, or getting a financial statement. This is where "can I do KYC without visiting the branch?" gets answered. The rule says a bank's non-documentary procedures must cover customers who don't appear in person.

4. Check Government Lists and Screen for AML Risk

The bank must check whether the customer appears on government lists of known or suspected terrorists, within a reasonable time after opening or earlier if another rule requires. Many banks also run their own sanctions and AML screening here. These checks don't depend on each other, so they can run side by side.

That last point matters a lot later. If the checks don't depend on each other, nothing forces them to run in a line.

5. Identify the Beneficial Owners

When the customer is a company, the bank must identify and verify the people behind it. That means any individual who owns 25 percent or more, plus one individual who controls the entity. FinCEN's customer due diligence rule sets this requirement for banks and several other financial institutions.

Do the math, and a company can bring up to five people to check. Four owners at 25 percent each, plus one person who runs the show. It's the bank asking who's behind the ticket, beyond whose name is on it.

6. Score the Risk and Make a Decision

The bank builds a risk profile from the customer's relationship and picks an outcome. Approve, send to manual or enhanced review, or reject. The CIP must also say what happens when identity can't be verified, including when to refuse an account, when to close one, and when to file a Suspicious Activity Report.

The risk profile comes from understanding the nature and purpose of the relationship. Is this a small business checking account or a high-volume payment account? The answer changes how closely the bank watches.

7. Keep Records and Keep Watching

KYC doesn't end at approval. Banks keep identity information for five years after the account closes, and keep verification records for five years after they were made. They also monitor accounts to report suspicious transactions and, on a risk basis, keep customer information current.

So KYC isn't a gate you walk through once. It's more like the staff who keep an eye on the terminal after you board.

3. What Checks Does a Bank Run During KYC?

A bank runs seven kinds of checks during KYC. Identity information, identity verification, a government list comparison, beneficial ownership, a customer risk profile, ongoing monitoring, and recordkeeping. Two federal rules cover them: the Customer Identification Program rule and FinCEN's customer due diligence rule.

Here's the quick map of the KYC requirements for a bank.

Banks add their own checks on top, and rules differ by institution type. FinCEN's customer due diligence rule also covers broker-dealers, mutual funds, and futures commission merchants.

4. Where Do Banks Lose Time in the KYC Process?

Banks lose time in the KYC process wherever steps wait on each other for no regulatory reason. Common spots are retyped data, checks run in a line, flags sent to people, missing documents, and repeated owner checks. These come from how the steps are wired, not from the rules.

An honest note first. We couldn't find reliable public numbers on onboarding time, so this is our reading of the process, not a measured result. Back to the airport. One counter, one agent, a long line.

Typing the Same Data Into Three Systems

When a case record lives in one system, the identity check in another, and screening in a third, someone retypes the same details. Each copy invites a typo, and a typo can trigger a mismatch that sends the case to a person. One shared case record avoids that.

It sounds boring because it is. But boring is where hours go.

Running Checks One After Another

Identity verification, list checks, and AML screening don't depend on each other, so they can run at the same time. Running them in a line means the last check waits on every earlier one. The rules ask for these checks within a reasonable time, not in a fixed order.

It's like three airport agents who could each check one thing, but you queue for all three in a row. Same checks, three times the waiting.

Sending Every Flag to a Person

A flag doesn't have to mean a human review. Clear matches can be cleared by rules, while true edge cases go to a reviewer. When every flag lands in a queue, reviewers spend time on easy cases, and the hard ones wait behind them.

We wrote about a similar pattern in our post on fraud workflows. Let rules handle the obvious and save people for judgment.

Waiting on Documents and Replies

Cases stall when a customer must upload another document or answer a question, and the bank has no clean way to pause and resume. A case that holds its state while it waits means nothing restarts when the customer finally replies.

That's the idea behind durable execution. The case waits and picks up exactly where it stopped.

Rechecking Owners at Every New Account

Until February 2026, banks had to identify and verify a company's beneficial owners each time that customer opened any new account. FinCEN's ruling now lets banks limit this to first account opening, to cases where information looks unreliable, and to risk-based triggers.

A company that opens three accounts in a week used to mean three owner checks. That's the kind of repeated work the ruling cuts. More on it next.

5. What Changed for the KYC Process in 2026?

Two things changed in 2026. In February, FinCEN gave banks relief from re-verifying beneficial owners at every new account opening. In April, it proposed a rewrite of AML program rules that would build on four pillars. The first is in force. The second is only a proposal.

The February ruling is FIN-2026-R001. Banks can limit owner checks to three cases. A company's first account, any time the bank has facts that call earlier information into question, and when its risk-based ongoing due diligence says so. If the customer confirms the old information is still right, the bank can rely on it and must record that confirmation.

Two details are easy to miss. Banks may keep their current process if they prefer, and FinCEN can revoke the relief. All other AML requirements still apply.

The April item is a proposal. FinCEN's fact sheet describes four pillars, including internal policies, procedures, and controls with risk assessment and, where it applies, ongoing customer due diligence. FinCEN says moving ongoing due diligence there isn't meant to change what it requires. Comments closed June 9, 2026, and the proposal says FinCEN would also look at whether a bank uses innovative tools such as AI. Final rules may look different, so check FinCEN before you change anything.

6. How Does KYC Automation Work?

KYC automation runs the routine checks with software and sends only the unusual cases to a person. A workflow takes in the application, calls identity and screening providers, scores the results with rules, and routes the case. AML automation does the same for screening and monitoring steps.

The trick is knowing what to automate and what to leave alone.

Automation doesn't change what the KYC process requires, and the bank stays responsible for its program. It just stops the same case from waiting on itself. If you're connecting providers, API orchestration handles the calls, retries, and failures. The same pattern shows up in fraud decisioning, where checks fan out, and a decision comes back.

7. How Does Digital Onboarding Work in Banking?

Digital onboarding in banking moves the KYC process online. A customer applies in an app or on a website, uploads documents, and the bank runs its checks through connected providers. Customer onboarding banking teams still follow the same CIP and CDD rules, just with fewer manual handoffs.

So, can you do KYC without visiting the bank? Yes. The CIP rule expects banks to handle customers who open accounts without appearing in person, and it says the bank's procedures must cover that case.

A smooth digital flow follows the same seven steps. The difference is that the data enters once, the checks run together, and the customer sees progress, not silence. It's the same idea behind loan processing, where one case moves through rules and review.

8. How Does Unmeshed Fit Into KYC Automation?

Unmeshed runs the KYC process as one durable workflow. It takes in the request, validates it, calls your identity provider, runs AML and sanctions checks in parallel, scores risk with decision tables, and routes to auto-approve, manual review, or reject. It orchestrates your providers and isn't one.

We don't scan IDs or hold the watch lists. Your providers do that. We run the steps around them, so one case moves through every check without waiting on the others.

• One durable case: The case record starts at intake, so a request is never lost while it waits.
• Parallel screening: AML, sanctions, and related checks run in separate branches and come back as one result.
• Policy in rules: Risk scoring runs on decision tables, so policy changes don't need code changes.
• People where it counts: High-risk cases go to reviewer steps, and the workflow keeps its state while it waits.
• Failures handled: Provider calls get retries and explicit failure paths.

You can see the full model on our KYC flows page.

Now the honest part. We aren't a data provider, a compliance product, or legal advice. You bring your own identity and screening providers, and you own your policies and your program.

Conclusion

The KYC process is seven steps tied to federal rules, and most of the waiting comes from how those steps are wired together. Run independent checks side by side, clear the easy flags with rules, and give people only the cases that need judgment.

That's the part Unmeshed handles, so your team spends its time on the cases that need a person.