KYC: the staged identity flow and its holding state

Bank Secrecy Act / USA PATRIOT Act §326 — Customer Identification Program rule, 31 CFR 1020.220

• Collect at least four elements before opening the account: name, date of birth, address, and an identification number.
• Verify identity within a reasonable time after account opening — documentary methods, non-documentary methods, or both, on a risk basis.
• Have defined procedures for when identity can’t be verified: the terms under which a customer may use the account while verification is pending, when to close the account, and when to file a SAR.
• Keep records of the information collected and the verification steps taken.

The rule never mentions screens, steps, or progress bars. It dictates what you collect, that you verify, and that you can describe a “pending verification” state — not how the interface is arranged.

• Verification has to be its own state, separate from “form submitted” — pending, verified, more documents needed, manual review, declined.
• Because the account can exist in a limited-use state during verification, the UI needs an honest “what you can and can’t do yet” surface, not a blank dashboard.
• Document-upload and liveness steps are gated by the bank’s risk tier, so the flow needs conditional steps rather than one fixed form.
• Every collected field and verification decision is a record — timestamps and status changes should be first-class, not hidden.

• Staged collection: identity → address → ID number → document / biometric if the risk tier triggers it
• A persistent verification-status indicator (not a generic spinner)
• A “limited account” state screen listing enabled vs. locked actions
• A manual-review / “we need another document” path
• A decline path with a neutral message (see the adverse-action pattern for the reason-disclosure interplay)

CIP failures are a core BSA/AML exam finding and have driven consent orders and civil money penalties against banks and their fintech partners.

• eCFR — 31 CFR 1020.220 (Customer identification program requirements for banks)
• FFIEC BSA/AML Examination Manual — Customer Identification Program

Last reviewed 2026-08-28. Verify against the primary source before you ship.