An examiner or auditor reading a KYC file asks two things of every paper: which fact it proves, and which rule asks for that fact. A passport answers both for a person's name and date of birth, and neither for that person's authority to sign for a company.
What are KYC documents?
KYC documents, also called KYC documentation, are the evidence behind the facts a firm records in know your customer checks: who a person is, or what a company is and who owns and runs it. FATF Recommendation 10 asks for identity to be verified "using reliable, independent source documents, data or information" (June 2026 text).
The KYC form records what the customer says, and the documents prove it. In Recommendation 10, verification is one customer due diligence (CDD) measure, beside identifying the beneficial owner, understanding the relationship's purpose and ongoing due diligence. Where a national identity system exists, such as Aadhaar in India, its credential usually leads.
Which KYC documents do individuals and companies provide?
Table 1. Common examples of KYC documents and what each proves (as of October 2026).
| Document | Customer | What it proves | Rule behind it |
|---|---|---|---|
| Passport or national ID card | Person | Names, date and place of birth, nationality, photo | AMLR Art 22(6)(a); 31 CFR 1020.220(a)(2)(ii)(A)(1) |
| Driver's license, including a state mobile driver's license (mDL) | Person | Name, date of birth, photo; address where printed | 31 CFR 1020.220; FinCEN FAQ of 8 September 2026 |
| Residence permit or alien identification card | Person | Residence status and the card number | 31 CFR 1020.220(a)(2)(i)(A)(4)(ii), for a non US person |
| Tax identification number (TIN) | Person or company | The TIN; US banks collect the number, not a document | 31 CFR 1020.220(a)(2)(i)(A)(4); AMLR Art 22(1)(a)(iv), (b)(iii), where available |
| Proof of address | Person | Where the customer lives | AMLR Art 22(1)(a)(iv) collects the address; the US rule collects it and asks for no address document |
| Selfie or live photo | Person | That the person is the document holder; not a document itself | EBA/GL/2022/15 guideline 41(d), unattended remote onboarding |
| Certificate of incorporation, register extract or business license | Company | Name, legal form and current existence | FATF INR.10 para 5(a)(i); 31 CFR 1020.220(a)(2)(ii)(A)(2) |
| Articles of association, partnership agreement or trust deed | Company, partnership or trust | The powers that regulate and bind it; the last two also prove existence | INR.10 para 5(a)(i), (ii); 31 CFR 1020.220(a)(2)(ii)(A)(2) |
| Register of directors | Company | Names of the board and senior managers | INR.10 para 5(a)(ii); MLR 2017 reg 28(3)(b)(ii) |
| Beneficial ownership register extract | Company | Owners on the register; never the only check | AMLR Art 23(4) "recently issued excerpt"; MLR reg 28(9), not "solely" |
| Beneficial ownership certification | US legal entity | Owners of 25% or more and one controller, certified by the person opening the account | 31 CFR 1010.230(b)(1), (d) |
| Board resolution or power of attorney | Person acting for the customer | Authority to act for the customer | INR.10 para 4; MLR reg 28(10) |
| Legal Entity Identifier (LEI) | Company | The entity's global identifier | AMLR Art 22(1)(b)(iii), where available |
One photo document can fill several rows. Picture an electrician (illustrative) trading under a trade name: FinCEN's 2016 CDD rule does not count a sole proprietorship as a legal entity customer, so the bank verifies the electrician as an individual, with a driver's license.
When the electrician's LLC opens an account, the electrician is both its owner of 25 percent or more and its one controller under 31 CFR 1010.230(d), and the same license verifies both roles, beside the LLC's articles. A trust adds its settlors, trustees and any protectors to the owners to trace (AMLR Article 58, from July 2027).
What makes a document acceptable for KYC?
No FATF, EU, UK or US rule prints a fixed list of KYC documents. The EU comes closest. Under Article 6(1) of AMLA's CDD standards (final report published 30 September 2026, to be submitted to the European Commission for adoption), a document counts as equivalent to an identity document or passport if a designated authority issued it with the holder's names, place and date of birth, a number and expiry date, a facial image and signature, and security features. Where a legitimate reason such as refugee status rules that out, Article 6(2) asks for names, date of birth and a facial image on a document from a designated authority.
Six checks apply:
- Independent issuer. Official documents stay independent evidence when the customer hands them over (MLR reg 28(18)(b)).
- Unexpired. An expired passport falls outside the US rule's "unexpired" identification, yet EU banks and financial institutions may take an expired identity document from a refugee or a customer with no fixed address where national law permits (EBA/GL/2023/04, paragraph 19(b)), so a group policy needs a line per market.
- Matching data. Name and date of birth match the application; a mismatch can signal identity fraud.
- Attested copy. AMLA wants copies attested against the original (recital 10); US banks may verify owners from photocopies (1010.230(b)(2)).
- Recent. AMLA asks firms to weigh whether time has made a document less reliable (recital 9); KYB verification records each register extract's issue date.
- Understood. The firm must understand each document, whatever its language (AMLA, Article 8(2)).
Why do KYC documents matter, and are they mandatory?
Table 2. What each rulebook asks KYC documents to prove (as of October 2026).
| Rulebook | Rule | Facts to establish | Evidence named | Updates |
|---|---|---|---|---|
| FATF | Recommendation 10(a); INR.10 paras 4 and 5 | Identity; a company's name, form, existence, powers, senior managers, registered office | "Reliable, independent source documents, data or information" | Ongoing due diligence (R.10(d)); no interval |
| EU today | Directive (EU) 2015/849 Art 13(1)(a) | Identity of the customer and the beneficial owner | Documents, data or information from a reliable and independent source, including eID | Set by national law until 10 July 2027 |
| EU from 10 July 2027 | AMLR Arts 22 and 26; AMLA CDD standards Art 6 | Names, place and date of birth, nationalities, residence; a company's name, form, office, representatives | ID document, passport or equivalent, or eID at "substantial" or "high" | At least yearly for higher risk, 5 years for others, and on change (Art 26) |
| UK | MLR 2017 reg 28(2), (3), (18), (19); reg 5 | Identity; a company's name, number, registered office, board; owners above 25% | Documents or information from a reliable, independent source, or a secure eID process | Records kept up to date, no interval (28(11)(b)) |
| US | 31 CFR 1020.220 (customer identification program); 1010.230; 1020.210 | Name, date of birth, address, ID number; owners of 25% or more and one controller | Documents, methods without documents, or both | On a risk basis (1020.210(a)(2)(v)(B)) |
KYC documents matter because these regulatory requirements make verification mandatory, while a document is only one route to it. In the EU and the UK, a bank that cannot complete customer due diligence must refuse or end the relationship and consider reporting the customer (Directive 2015/849 Article 14(4); AMLR Article 21; MLR 2017 regulation 31); the UK still lets deposited money be repaid to the depositor, with consent where a disclosure is required.
A US bank's CIP sets when it refuses an account, the terms for using one while verification runs, when it closes it and when it files a SAR (1020.220(a)(2)(iii)).
What if a customer cannot provide a passport or ID card?
Picture an asylum seeker with an asylum authority letter and no passport. Where national law permits, the EBA expects an EU bank or financial institution to name the alternative documents it accepts: up to date, from an official national or local authority, with at least full name and date of birth (EBA/GL/2023/04, paragraph 19(a)). For a refugee or someone with no fixed address, papers from social services or an aid organization working for the authorities, such as the Red Cross, may also count (19(b)).
AMLA's recital 10 would accept a birth certificate as a credible source for a minor whose parent or legal guardian is identified and verified. A US bank's methods without documents must cover a customer unable to present an unexpired photo ID (31 CFR 1020.220(a)(2)(ii)(B)).
How are KYC documents checked?
KYC verification of a document sent as an image works through three tests in the EBA's remote onboarding guidelines: valid security features and unaltered data (guideline 33), accurate optical character recognition or machine readable zone reading (34) and, in an unattended check, a photo or video matched to the document's picture (41(d)).
complead, formerly Sanction Scanner, has document and biometric identity verification "handled by your IDV provider", as its product page says, and takes the verified identity into the customer risk assessment, scored in one API call. Customer onboarding then runs KYC or KYB, sanctions, PEP and adverse media checks on the same record in one request.
Can KYC documents be submitted digitally?
Yes, in the EU, the UK and the US. From 10 July 2027, an EU firm may verify with electronic identification at the "substantial" or "high" assurance level instead of a document (AMLR Article 22(6)(b)). The UK accepts a secure electronic identification process (MLR reg 28(19)).
In the US, FinCEN's FAQ lets a bank accept an unexpired state mobile driver's license, a digital credential, that shows nationality or residence and a photograph, where its CIP allows and its systems can extract the credential's data. That holds for accounts opened over the internet, the benefit for eKYC and remote onboarding.
Which KYC document rules changed in 2026?
- 13 February. FinCEN's exceptive relief order: covered institutions may verify a legal entity's owners at its first account, then only on doubt or as risk procedures require.
- 14 August. FinCEN's final BOI reporting rule took effect: US companies file no BOI report, and banks still collect owners under the CDD rule.
- 8 September. FinCEN and four agencies' staffs explained how mobile driver's licenses fit the CIP rule.
- 30 September. AMLA's CDD standards: final report published, to be submitted to the European Commission for adoption.
So the paper list is your firm's own policy: per customer type, which facts you prove by document and which by data or eID, and what you accept, with whose sign off, when the passport is missing.
Related terms
- Proof of address. The evidence that a customer lives at the address the application gives.
- KYC verification. Checking that the person on an application exists and is the one applying, against documents, data or electronic identification.
- KYB verification. Confirming a business customer's existence, officers and owners from registry records and other independent sources.
- Ultimate beneficial owner. The individual at the end of the ownership or control chain behind a company or trust.
- Customer due diligence. FATF's four measures: identify and verify the customer, identify the beneficial owner, understand the relationship's purpose and keep up ongoing due diligence.
- Know your customer. The wider program these documents serve: knowing who each customer is and what the relationship is for.
How this entry was checked. Burçak Aydın, Finance Manager, drafted the tables and the text, and Ufuk Gürdaş, Compliance Specialist, fact checks them before publication. Fact checked by: Ufuk Gürdaş, Compliance Specialist, 29 October 2026. Last reviewed: 29 October 2026. Table 1 lists a document only where a rule names the fact it proves; the electrician and the asylum seeker are illustrations. Each rule was reread in its own text on 28 October 2026: the June 2026 FATF Recommendations, EBA/GL/2023/04 and EBA/GL/2022/15, Directive (EU) 2015/849 as amended, Regulation (EU) 2024/1624, AMLA's CDD standards (final report, 30 September 2026), regulations 5, 28 and 31 of the UK Money Laundering Regulations 2017, 31 CFR 1010.230, 1020.210 and 1020.220, and four FinCEN texts of 2016 and 2026 (CDD rule, relief order, BOI rule, mDL FAQ).
