Know Your Customer (KYC)

Know Your Customer is the umbrella term for rules requiring financial institutions to identify their customers, verify that identity, and learn the essential facts about each customer's circumstances. In the United States it rests on two legal foundations: anti-money-laundering law — including the Bank Secrecy Act and the USA PATRIOT Act's customer identification program requirements — which targets the use of financial accounts by criminals; and conduct rules for securities firms, such as FINRA's Know Your Customer rule, which require firms to know the facts needed to serve an account properly and to make recommendations that fit the customer.

The identity side works through the customer identification program (CIP) that banking and brokerage firms must run: before opening an account, the firm collects your name, date of birth, address, and an identification number (for U.S. persons, typically a Social Security number), verifies the information, and screens it against government watch lists. For accounts opened by companies, trusts, and other legal entities, FinCEN's customer due diligence rule additionally requires identifying the beneficial owners — the actual people who own or control the entity — so an account can't hide behind a shell. Firms must also monitor activity and file reports on suspicious transactions.

The investor-protection side is different in purpose. FINRA Rule 2090 requires broker-dealers to use reasonable diligence to know the essential facts about every customer, because everything else in the conduct rulebook depends on that profile: a recommendation can only be evaluated against your objectives, time horizon, tax status, and risk tolerance if the firm actually knows them. That's why Regulation Best Interest and the suitability framework are inseparable from KYC — a firm that doesn't know you can't act in your best interest.

Investment advisers have long faced the profile-gathering obligation through their fiduciary duty (advice must be suitable for the specific client), while formal AML program requirements historically applied to banks and broker-dealers rather than advisory firms. FinCEN finalized a rule in 2024 extending AML-program and suspicious-activity-reporting requirements to SEC-registered investment advisers, but has postponed its effective date to January 1, 2028 while it reviews and re-tailors the rule — so those program requirements are not yet in force for advisory firms.

In practice, KYC shows up at three moments. At account opening, you supply identity information and documents, and answer profile questions — employment, income, net worth, objectives, experience, risk tolerance. During the relationship, the firm monitors transactions for activity inconsistent with your profile and periodically asks you to reconfirm the information. And when something doesn't fit — a sudden series of large wires, say — the firm investigates and may file a suspicious activity report.

A hypothetical example of why the profile matters to you: Ray, 68 and retired, opens a brokerage account and — wanting to seem sophisticated — overstates his income and marks his risk tolerance as aggressive. When a representative later recommends a concentrated, volatile position, the recommendation is judged against the profile Ray gave, not his real situation. Accurate KYC answers are one of the few investor protections you control directly: they define what the firm is allowed to steer you toward.

Pros

• Makes accounts harder to use for money laundering, fraud, and identity theft — including accounts opened in your name by someone else.
• Forces firms to learn your actual situation, which is the foundation of suitability and best-interest protections.
• Watch-list screening and transaction monitoring catch some elder abuse and account-takeover fraud in progress.

Cons

• Adds friction and document-gathering to every account opening, and verification hiccups can freeze legitimate accounts.
• Requires sharing sensitive personal data with every institution you use, each one a potential breach target.
• Compliance costs fall on all customers, and monitoring occasionally flags innocent activity, which can be slow to unwind.