In early 2019, Monzo Bank stopped making address verification a condition of opening an account, after finding that about 20 percent of its existing current account customers, and 47 percent of those it then rated higher risk, had failed the check. The FCA's Final Notice of 7 July 2025 fined the bank 21,091,300 pounds over its financial crime controls and records customers giving Buckingham Palace and 10 Downing Street as their address (paragraphs 1.1, 4.48, 4.50). The KYC requirements of each market decide whether a separate address document is needed, and firms often ask for one where the rule does not.
What is proof of address (POA)?
Proof of address ties a name to an address on a date, in a document printed by someone other than the customer. In KYC, the full form of POA is proof of address, also written proof of residence or proof of residency, and not power of attorney.
It shows where a customer lives, while a passport or ID card shows who, and its issuers include utilities, banks, card issuers, lenders, councils and pension payers.
Which common proof of residence documents are accepted?
Two public lists set ages: the RBI's Know Your Customer Directions, 2025 for Indian commercial banks (para 5(1)(xiv)) and the UK Disclosure and Barring Service's ID checking guidelines for criminal record checks.
Table 1. Common proof of address documents and the ages two public lists set (as of October 2026).
| Document | Issuer | Age where a rule sets one | Note |
|---|---|---|---|
| Utility bill (electricity, water, gas, landline) | Utility company | RBI: two months; DBS: 3 months | DBS refuses a mobile phone bill; RBI accepts a postpaid one |
| Bank or building society statement | Bank | DBS: 3 months | Not on the RBI list |
| Credit card statement | Card issuer | DBS: 3 months | Not on the RBI list |
| Council tax or property tax | Local council or municipality | DBS: 12 months; RBI: none | RBI names property or municipal tax receipts |
| Mortgage statement | Lender | DBS: 12 months | Not on the RBI list |
| Pension or benefit letter | Pension payer or government department | DBS: 12 months; RBI: none | RBI takes pension payment orders that carry the address |
| ID that prints the address (driver's license, national ID card) | Government | None | Can prove identity and address in one |
| Passport | Government | None | Most print no residential address; RBI lists it as an officially valid document |
The common residency proof documents are bills, statements and official letters with the customer's name and current address. Where a cell says none, the firm's own policy sets the age.
Which alternative proofs, such as an ID card, carry the address?
A national ID card or driver's license that prints the current address can prove identity and address at once. AMLA, the EU's anti money laundering authority, notes in its CDD standards (final report of 30 September 2026, which goes to the European Commission for adoption) that passports "do not typically include a residential address". Firms "need not request additional documents", it adds, for facts an official ID has already verified (recital 4).
Which documents do not count as proof of address?
Documents that lack an independent issuer or a current date do not count, since FATF Recommendation 10 asks for a "reliable, independent source". The DBS refuses a mobile phone bill. It also refuses any utility bill printed from an online account, while the RBI accepts a postpaid mobile bill. In India, a pension payment order carrying the address does count.
How recent does a proof of address need to be?
None of the FATF, EU, UK or US texts in Table 2 sets an age for proof of address; AMLA's standards ask firms to weigh how far a source is "up to date" (Article 8(1)(c)). India is the exception. A utility bill must be "not more than two months old", and a customer who opens an account with such a document brings an ID with the current address "within a period of three months". The RBI's own example is a customer living in Chennai whose ID shows a New Delhi address. When an existing customer reports only a new address at a KYC update, the bank verifies it within two months (para 42(3)(ii)).
The DBS ages of 3 and 12 months come from criminal record checks, not AML. Three months is the firm's own policy.
When do organizations request proof of address, and do AML rules require it?
Organizations request proof of address at onboarding and when a customer moves, but of the seven rulebooks in Table 2 only India's requires an address document.
Table 2. What seven AML rulebooks require on a customer's address (as of October 2026).
| Rulebook | Address collected | Address document required | Age set | Status |
|---|---|---|---|---|
| FATF Recommendation 10 | Not named for a person; a legal person's registered office (INR.10 para 5(a)(iii)) | No; identity from "reliable, independent source documents, data or information" | No | June 2026 text |
| EU today: Directive (EU) 2015/849, Article 13(1)(a) | Not named | No; identity from "a reliable and independent source" | No | Applies through national laws; repealed from 10 July 2027 |
| EU from 10 July 2027: AMLR, Article 22 | "The usual place of residence" (22(1)(a)(iv)) | No; an ID document plus, "where relevant", independent sources, or eID (22(6)) | No; sources "up to date" (AMLA standards) | Applies to most obliged entities from 10 July 2027 (Article 90); AMLA's standards go to the Commission for adoption |
| UK: MLR 2017 reg 28 | A company's registered office (28(3)(a)(iii)); a person's address not named | No; verify from a reliable, independent source (28(18)) | No | In force |
| US: 31 CFR 1020.220, customer identification program | "A residential or business street address" | No; identity verified by documents such as a passport, methods without documents, or both | No | In force |
| Hong Kong: HKMA Guideline, 4.3.5 | Residential address | No; a bank may verify it "(on top of collection)" for other purposes and should tell the customer why (note 19) | No | Revised May 2023 |
| India: RBI Directions, para 5(1)(xiv) | Yes | Yes: an ID with the current address, or a listed document | Utility bill two months; ID within three months | 28 November 2025, updated 1 October 2026 |
Firms ask anyway, for what the HKMA's note 19 calls other purposes, such as group requirements or another country's legal and regulatory requirements.
In Monzo's case, dropping the address check was "not contrary to prevailing guidance on the MLRs", the FCA found; what it hurt was a risk appetite built on "only providing services to individuals residing within the UK" (paragraph 4.49). An address check answers to the firm's own risk appetite, so make it as strict as that appetite.
AMLA's standards would let a firm leave out the address in situations of low risk (recital 18, Article 18), while higher risk customers move to enhanced due diligence. In complead, formerly Sanction Scanner, a customer risk assessment can weight geography as one of its factors, and every rating shows the factors behind it.
How do you check proof of address and spot a fake one?
Picture an applicant who uploads a bank statement PDF dated 97 days before the application, its address line in a slightly different font. It fails a three month policy, but the font matters more: a late statement can be swapped for a newer one, while an edited one is document forgery, a form of identity fraud. Your check covers nine points:
- Date: issued within the age limit the firm's policy sets.
- Name: exactly as it appears on the verified ID.
- Full address: street, building and flat number where they exist (AMLA standards, Article 3(1)(c)).
- Kind of address: no PO box, mail forwarding address or landmark, all of which Monzo let through (4.50).
- Issuer: a real company or office, "independent of the person" being verified (MLR reg 28(18)).
- Layout: letter headed paper and correct bank headers, as the DBS guidelines ask.
- File: the metadata, since FinCEN's alert of 13 November 2024 on deepfake media names "examining an image's metadata".
- Reuse: one address on several files, a money muling risk (4.50), or a drop address, a synthetic identity fraud sign.
- Second source: the same address in a credit reference or public database record.
In complead's customer onboarding, the decision that follows is logged with its evidence on the record where KYC checks, screening and adverse media run in a single request, before the account exists.
What changed for proof of address in 2026?
- 30 September. AMLA published its final report on the CDD standards; the next step is submission to the European Commission for adoption.
- 1 October. The RBI updated its 2025 Know Your Customer Directions for commercial banks.
- 6 October. The DBS stopped asking for a manual address check when a digital identity check cannot verify the address (digital identity verification guidance, 4.2.a).
The check Monzo dropped in 2019 compared name, date of birth and address with credit reference agency data (paragraph 4.47). When a firm checks an address against a database instead of a document, which sources count as reliable and independent, and what does the file keep?
Related terms
- Identity fraud. Opening or taking over an account in another person's name, at times with a forged or altered document.
- Synthetic identity fraud. An identity pieced together from real and invented details, often with a drop address for the cards.
- Money mule. Someone who lets their own account carry other people's money.
- KYC documents. The identity, address and company papers a firm collects before it opens an account.
- Electronic identity verification. Checking identity and address against electronic records or an eID instead of paper.
- Customer due diligence. The measures that identify a customer and its owners and record what the relationship is for.
How this entry was checked. Author: Barbaros Sercan, Customer Success Specialist at complead. Fact checked by: Javid Khasayev, Senior Anti Fraud Specialist at GoldenPay, 28 October 2026. Last reviewed: 28 October 2026. An age limit appears on this page only where a public text prints one, and the 97 day statement is an illustration. The texts, each opened on 28 October 2026: FATF Recommendation 10 (June 2026), Directive (EU) 2015/849 Article 13 and its repeal in Directive (EU) 2024/1640, Regulation (EU) 2024/1624 Article 22, AMLA's final report on the CDD standards of 30 September 2026, UK MLR 2017 regulation 28, 31 CFR 1020.220, the HKMA's AML and CFT Guideline for authorized institutions (May 2023), the RBI's Know Your Customer Directions, 2025, the DBS ID checking guidelines and digital guidance, FinCEN's deepfake alert of 13 November 2024 and the FCA's Final Notice to Monzo Bank Limited.
