Know Your Customer and Anti-Money-Laundering Obligations

Scope, and one category of information is deliberately absent. This article explains why a firm asks for documents and what legal obligation it is discharging when it does. It states no reporting threshold, no transaction size that triggers a filing, and nothing about how obligations might be avoided. That omission is deliberate and is stated rather than concealed: material of that kind functions as instruction for the people these rules exist to catch, and it does nothing for a reader trying to understand a request they have just received. United States framework, verified 17 August 2026; the European Union operates a separate regime and the closing section says so.

The firm is not assessing your trustworthiness. It is producing evidence for its own examiner.

Where the obligation comes from

The framework rests on the Bank Secrecy Act, which dates from 1970, and its basic architecture has not changed since: private institutions collect financial intelligence, it is aggregated centrally, and it is made available to law enforcement.

The four minimum elements of an AML programme are internal policies, procedures and controls; a designated compliance officer; an ongoing employee training programme; and an independent audit function that tests the programme.

What the brokerage rule adds

For brokerage firms, the self-regulatory layer described in Who Regulates What imposes its own requirement on top.

A member firm must have a written AML programme, approved in writing by a member of senior management, containing policies reasonably expected to detect and cause the reporting of suspicious transactions, and annual independent testing conducted by someone with a working knowledge of the underlying requirements.

The Bank Secrecy Act applies to all broker-dealers. There are no exceptions. Which is why the request cannot be waived by the person you are speaking to, however reasonable your explanation is — the obligation runs to the state, not to the customer, and the firm's own liability is what is at stake.

It does not stop at onboarding

The requirement most people are unaware of is that the obligation is continuing rather than one-off.

Firms must understand the nature and purpose of a customer relationship, monitor it on an ongoing basis, and update customer information on a risk basis. So a question arriving years after an account was opened is not a sign that earlier answers were unsatisfactory.

A firm's programme must also be risk-based, which means the depth of enquiry legitimately differs between customers. For accounts held by legal entities rather than individuals, the identification of beneficial owners applies — though a firm is generally not required to look through a trust to its beneficiaries, or through an intermediary holding an omnibus account, and may verify the named accountholder instead.

A recent change, and an illustration of why nothing in this area should be assumed to be current. On 13 February 2026 the central financial-intelligence bureau granted exceptive relief from the requirement to identify and verify the beneficial owners of a legal entity customer at each new account opening. Institutions may now limit that identification to three circumstances: when the entity first opens an account; when the institution learns facts that reasonably call into question the reliability of information previously obtained; and as needed under its own risk-based ongoing due diligence. Every other obligation — programme, recordkeeping and reporting — continues unchanged. This portal reports the relief as a fact and takes no view on it. The reason it appears here is procedural: an article written six months earlier would have described the previous position with complete confidence, and a reader would have had no way of knowing.

Two things that are easier to bear once explained

Sanctions screening produces false matches. Names are checked against lists, and a person who shares a name with a listed individual can be delayed while that is resolved. The delay reflects a name collision rather than any allegation.

A firm may be unable to tell you what is happening. Suspicious-activity reporting is subject to statutory confidentiality: a firm that has filed such a report, or that has information which would reveal that one exists, is prohibited by federal law from disclosing that fact to the person concerned — so where a firm has concerns it may be legally restricted in what it can say about them. An account restriction accompanied by no explanation is therefore not necessarily rudeness or incompetence — it may be a legal constraint on the firm. A reader in that position should seek their own legal advice rather than an explanation from the firm, because the firm may not be permitted to give one.

Other jurisdictions

The European Union operates a separate and differently structured regime, and terminology overlaps without equivalence. A reader with accounts in more than one jurisdiction should expect different documentation, different retention periods and different thresholds, and should not assume that satisfying one framework satisfies another.