Know Your Customer

Know Your Customer

Regulatory status current as of June 2026 — verify effective dates, dollar thresholds, and pending rulemakings against current SEC/FINRA/FinCEN sources before advising.

Core Concepts

FINRA Rule 2090 — Know Your Customer

Every FINRA member must use reasonable diligence, with regard to the opening and maintenance of every account, to know and retain the essential facts concerning every customer and concerning the authority of each person acting on behalf of the customer. "Essential facts" are those required to: (a) effectively service the account, (b) act in accordance with any special handling instructions, (c) understand the authority of each person acting on behalf of the customer, and (d) comply with applicable laws, regulations, and rules.

Customer Identification Program (CIP)

Required under USA PATRIOT Act Section 326 and implementing regulations. The broker-dealer CIP rule is 31 CFR 1023.220; the bank CIP rule is 31 CFR 1020.220. (SEC Rule 17a-8 separately requires broker-dealers to comply with BSA recordkeeping and reporting.) The CIP must include:

• Identity verification for each customer opening an account: name, date of birth (for individuals), address, and identification number (SSN for US persons; passport number/country or other government ID for non-US persons)
• Verification procedures using documentary methods (government-issued ID), non-documentary methods (credit bureau checks, public database searches, financial statement review), or a combination
• Recordkeeping — retain identifying information and verification methods for 5 years after account closure
• Comparison with government lists — check customer names against OFAC and other government terrorist/sanctions lists
• Customer notice — inform customers that information is being collected to verify identity

Customer Due Diligence (CDD) Rule

FinCEN's CDD Rule (31 CFR 1010.230, effective May 2018) requires covered financial institutions to:

1. Identify and verify the identity of customers (overlaps with CIP)
2. Identify and verify the identity of beneficial owners of legal entity customers — any individual who owns 25% or more of the equity interests, plus one individual with significant responsibility for managing the entity (a control person)
3. Understand the nature and purpose of customer relationships to develop a customer risk profile
4. Conduct ongoing monitoring to identify suspicious transactions and, on a risk basis, maintain and update customer information

The 25% beneficial ownership threshold applies to legal entities (corporations, LLCs, partnerships). Certain entities are exempt: publicly traded companies, regulated financial institutions, government entities, and others listed in the rule.

Enhanced Due Diligence (EDD)

Higher-risk customers require additional scrutiny beyond standard CDD:

• Politically Exposed Persons (PEPs) — senior foreign political figures and their families/associates. No US regulatory definition mandates PEP screening for domestic customers, but FinCEN guidance and FATF standards expect it for foreign PEPs. Firms should understand the source of wealth and funds.
• Foreign correspondent accounts — BSA Section 312 requires EDD for correspondent accounts maintained for foreign financial institutions, with heightened requirements for institutions in jurisdictions of concern
• High-risk jurisdictions — countries identified by FATF, FinCEN advisories, or firm risk assessments as presenting elevated ML/TF risk
• Complex ownership structures — multi-layered entities, trusts with opaque beneficiary structures, nominee arrangements
• Unusual account activity — customers whose transaction patterns deviate significantly from expected activity based on their profile

EDD measures include: senior management approval for account opening, source of wealth/funds verification, more frequent account reviews, enhanced transaction monitoring, and ongoing negative media screening.

Documentary vs Non-Documentary Verification

Documentary methods: Unexpired government-issued photo ID (driver's license, passport, state ID), documents showing formation of a legal entity (articles of incorporation, partnership agreement, trust instrument).

Non-documentary methods: Credit bureau inquiries, public database verification (Lexis-Nexis, etc.), financial statement verification, references from other financial institutions. Required as a backup when documentary verification is unavailable, inconclusive, or the customer is not physically present (e.g., online account opening).

Firms must use non-documentary methods in at least the following situations: (1) the customer opens an account without appearing in person, (2) the firm is not familiar with the documents presented, (3) other circumstances that increase risk.

Ongoing Monitoring and Profile Updates

KYC is not a one-time event. Customer profiles must be updated when:

• Material life events occur (retirement, marriage/divorce, inheritance, job loss, significant health changes)
• Account review triggers fire (periodic reviews, risk-based reviews, transaction-triggered reviews)
• Transaction patterns deviate significantly from the established profile
• The customer provides new information that changes their investment profile
• Regulatory changes require additional information (e.g., new beneficial ownership requirements)

FINRA does not mandate a specific refresh cycle, but firms typically establish risk-based review schedules (e.g., annual review for high-risk accounts, every 3 years for standard risk).

SEC Requirements for Investment Advisers

Investment advisers have a fiduciary duty to understand their clients, which creates KYC-like obligations independent of FINRA rules. Form ADV Part 2A describes the adviser's services and client relationships. The SEC expects advisers to gather sufficient information to fulfill their fiduciary duty of care — including financial situation, investment objectives, risk tolerance, and any constraints. FinCEN's 2024 final rule (31 CFR Part 1032) would extend BSA/AML program and SAR requirements to SEC-registered investment advisers, but its effective date was postponed from January 1, 2026 to January 1, 2028, and FinCEN has said it will revisit the rule's substance (and the companion proposed adviser CIP rule, jointly with the SEC) before then — verify current status.

Recordkeeping Requirements

• CIP records: Identifying information, verification documents/methods, and resolution of discrepancies must be retained for 5 years after account closure
• CDD/beneficial ownership: Copies of beneficial ownership certification forms and verification records retained for 5 years after account closure
• Account records: FINRA Rule 4512 requires maintenance of customer name, tax ID, address, date of birth, employment status, associated person relationship, trusted contact person, and other information specified in the rule
• Reliance on other institutions: Under Section 326 reliance provisions, a firm may rely on another financial institution's CIP if: (a) the relying firm's CIP incorporates this reliance, (b) the other institution is subject to an AML program rule, and (c) the other institution enters into a written contract for this purpose

Worked Examples

Example 1: Opening a trust account without identifying beneficial owners

Scenario: A wealth management firm opens a revocable living trust account for a family trust. The account opening team collects the trust agreement and identifies the grantor/trustee but does not collect beneficial ownership information on the trust beneficiaries. The trust holds $2M in investable assets.