What Is First Party Fraud? Forms, Signals and SAR Triggers
First party fraud is fraud by the account holder. How it differs from credit loss, why it gets misbooked, its signals, and when it requires a SAR.
TL;DR: US KYC rules require banks to obtain specific information, and leave the choice of documents to each bank's written procedures. A bank must collect name, date of birth, address and an identification number before opening an account, and must identify every individual who owns 25 percent or more of a legal entity customer plus one control person. Passports, articles of incorporation and financial statements are ways of proving that information, and the core CIP and beneficial ownership records carry five-year retention periods.
US Rules Require Information, Not a Document List
KYC documents are the records a financial institution uses to establish who its customer is, who owns or controls that customer, and what the relationship is for. The phrase suggests a federal checklist, and for US banks none exists. The Customer Identification Program rule at 31 CFR 1020.220 fixes the data a bank must obtain. On documents, it says a bank's procedures must set out the ones it will use, and that these "may include" items such as a driver's license, passport or certified articles of incorporation.
That wording shifts the burden onto the institution. A bank can require two forms of ID for one product and accept a database match for another, provided its written program explains why and the result supports a reasonable belief that it knows the customer's true identity.
FATF Recommendation 10 follows the same logic, calling for verification using reliable, independent source documents, data or information. A US bank's binding obligations come from the BSA regulations. This guide covers banks; broker-dealers, mutual funds and futures firms have parallel CIP rules.
Required Information Versus Common Collection
The middle column below comes from regulation. The right column separates the examples the rules name from items institutions add as a matter of policy.
Individuals: Four Data Points, Then a Verification Choice
The four data points are mandatory before account opening, and verification follows within a reasonable time after it. The CIP rule requires procedures describing when a bank uses documents, non-documentary methods, or both.
Documentary verification
Documentary verification relies on an unexpired government-issued ID evidencing nationality or residence and bearing a photograph or similar safeguard. The FFIEC Manual says the banking agencies expect this for most individual customers, and it encourages reviewing more than one document given the availability of counterfeits. The rule does not require a bank to keep a copy of the ID. A description is enough: document type, identification number, place of issuance, and any issue and expiration dates.
Joint FAQs issued on September 8, 2026 by FinCEN and banking agency staff place mobile credentials in this category: an unexpired, government-issued verifiable digital credential, such as a state mobile driver's license, can serve as a documentary method if the bank's CIP allows it and the bank can extract the data.
Non-documentary verification
Non-documentary verification compares what the customer provided against an outside source. The rule's examples are contacting the customer, checking a consumer reporting agency, public database or other source, checking references with other financial institutions, and obtaining a financial statement. A bank's non-documentary procedures must cover five situations: the individual cannot present an unexpired government ID, the bank is unfamiliar with the document, no documents are obtained, the customer does not appear in person, and any other circumstance that raises the risk of failing to verify through documents.
The bank then records the methods used and their results. Any substantive discrepancy and its resolution must be recorded under either method.
What changed on TIN collection
Since 2025, the TIN no longer has to come from the customer. An order dated June 27, 2025 from the OCC, FDIC and NCUA, with FinCEN's concurrence, and a matching Federal Reserve order dated July 31, 2025 let banks and credit unions obtain it from a third-party source. The exemption is optional. The bank must still hold the full TIN before opening the account, and its written CIP must cover the method.
Legal Entities: Prove the Entity, Then Name the People
Business customers require two separate exercises. CIP establishes that the entity exists, using documents or non-documentary methods. The beneficial ownership rule at 31 CFR 1010.230 then identifies the humans behind it. CIP alone can stop at the entity. If a bank cannot verify the entity through those methods, its CIP must address when it will obtain information about individuals with authority or control over the account, including signatories.
The beneficial ownership certification
A bank identifies beneficial owners in one of two ways: it obtains the certification form in Appendix A of the rule from the person opening the account, or it collects the same information another way and has that person certify its accuracy to the best of their knowledge. The form itself is optional. The certification of accuracy is what the rule insists on.
The rule counts two groups. Under the ownership prong, each individual who directly or indirectly owns 25 percent or more of the equity is a beneficial owner, which can mean up to four people or none. Under the control prong, one individual with significant responsibility to control, manage or direct the entity must always be named. The total therefore falls between one and five people. UBO identification gets harder with layered ownership, and the bank may rely on the customer's information only if it has no knowledge of facts that would reasonably call it into question.
Verification of each named person follows the CIP elements for individuals, with one concession: photocopies of ID are acceptable for beneficial owners.
The 2026 changes, and what they did not touch
FinCEN's exceptive relief order of February 13, 2026 ended the need to re-identify and re-verify beneficial owners at every new account. A covered institution may now limit that work to three moments: when the legal entity first opens an account, when facts reasonably call the existing information into question, and as its risk-based ongoing customer due diligence procedures require. Taking the relief is the institution's choice.
The Corporate Transparency Act moved in a different direction and is a frequent source of confusion. FinCEN's final rule, effective August 14, 2026, confirmed that US companies are exempt from filing beneficial ownership reports with FinCEN. Only certain foreign companies registered to do business in the US still report. The bank-side requirement in 31 CFR 1010.230 remains in the current regulation, so a US company that owes FinCEN no report still owes its bank a beneficial ownership certification.
When EDD Documents Come In
EDD documents enter the file when the customer's risk profile calls for them, and no regulation supplies a universal list. The FFIEC Manual's customer due diligence section says procedures should define both when and what additional information will be collected, and offers examples: source of funds and wealth, occupation or type of business, financial statements for business customers, primary trade area, expected transaction volumes, and information about major customers and suppliers.
Risk works in both directions. Beneficial ownership must be collected at the 25 percent threshold regardless of risk, but other customer information should match the risk profile. For lower-risk customers, the FFIEC Manual says a bank may not need any additional information beyond what it gathered at account opening. Sending the same source-of-wealth questionnaire to every retail customer spends effort the rule does not ask for.
Foreign correspondent accounts, private banking accounts and money services businesses carry their own expectations. Enhanced due diligence should be triggered by a written criterion, so a reviewer can show why a document was requested and what it established.
How Long to Keep KYC Records
Five years is the operative number, but the start date changes by record type.
The CDD program requirement in 31 CFR 1020.210 sets no retention period of its own for risk profiles and EDD material, so institutions commonly apply the CIP schedule to the whole file. A bank that keeps ID copies in place of a description must retain them under 31 CFR 1010.430, whose general period is five years.
Testing Whether a Document Standard Holds Up
A written standard is defensible when a reviewer can trace each requirement back to a rule or a risk decision. Three questions test it:
- Does each document on the list map to a data element it verifies?
- Can the bank show what happens when verification fails, including when an account is refused or closed and when a SAR is considered?
- Are policy additions labeled as policy, so staff do not describe them to customers as legal requirements?
Where Sphinx Fits
Sphinx is an investigation layer that works inside the tools a compliance team already uses. Its AI agents read the documents and data already in a customer file, compare them with the CIP and beneficial ownership record, apply the team's SOPs, and prepare a traceable recommendation showing what was checked and what is missing. The team keeps final approval. Sphinx does not verify a person's face, connect to bank accounts, or score transactions, so a program still needs its own identity verification step.
Frequently Asked Questions
What documents are required for KYC in the US?
US rules do not prescribe a single document list for banks. The CIP rule requires name, date of birth, address and an identification number, and each bank's written procedures specify which documents or non-documentary methods it uses to verify them. A driver's license, passport and certified articles of incorporation are examples named in the rule.
Do banks have to keep a copy of a customer's ID?
No. The CIP rule requires a description of the document relied on, including its type, identification number, place of issuance and any issue and expiration dates. A bank may choose to keep copies, and copies held in place of a description fall under the five-year period in 31 CFR 1010.430.
Does the Corporate Transparency Act exemption remove beneficial ownership collection by banks?
No. FinCEN's August 2026 final rule exempts US companies from filing beneficial ownership reports with FinCEN, while 31 CFR 1010.230 continues to require covered institutions to identify and verify the beneficial owners of legal entity customers. The two obligations sit on different parties.
Can a mobile driver's license be used for KYC?
Yes, if the bank's CIP allows it. September 2026 joint FAQs state that an unexpired, government-issued verifiable digital credential can be a documentary verification method when it evidences nationality or residence and bears a photograph or similar safeguard, and the bank can extract its data.
