KYC Verification USA: How Identity Checks Work in 2026

Your deal room shows a signed subscription agreement and a $250,000 wire that landed this morning. The investor is someone you met once at a conference in another state. The subscription names a physician in Phoenix; the wire came from a company account you've never seen.

You want to mark the commitment funded and get back to the capital stack. The question worth thirty minutes of your time is narrower than the paperwork around it: is the person named on the subscription the person who sent the money?

Three separate duties get blended together whenever syndicators talk about this, and only one of them is a federal filing that, for most U.S. deals, no longer applies. Sorting them out is the difference between a raise you can defend and a subscription you can't explain eighteen months from now.

What KYC Verification Means in the United States

Start at passport control. The officer puts your document under a light, checks the security features, and looks at your face. The document alone would prove nothing if anyone could carry it. The check works because the document and the person standing in front of the officer are confirmed together.

KYC verification in the United States follows the same logic, moved to a bank portal or an investment platform.

Know Your Customer means confirming three things before money is accepted: who the investor is, that the identity documents belong to that person, and that the funds arriving in your account come from them. A wire confirms only the third. Paperwork confirms only the first two.

The U.S. rulebook behind the check

U.S. customer-identification requirements grew out of more than five decades of anti-money-laundering law. Congress passed the Bank Secrecy Act in 1970, requiring financial institutions to keep records that could help agencies investigate criminal activity and tax evasion. After the September 11, 2001 attacks, the USA PATRIOT Act authorized banking regulators to impose customer-identification requirements, and the resulting Customer Identification Program framework requires covered institutions to maintain written, risk-based procedures designed to form a reasonable belief that they know each customer's true identity, as FinCEN's CIP guidance sets out.

At minimum, that means collecting name, date of birth, address and identification number, then verifying them through documentary methods such as a driver's license or passport, non-documentary methods, or both. The address element trips up foreign investors more than any other, because a mailing address and a residential address aren't the same thing, and the physical address rules for non-residents explain what a bank or platform will accept in place of a P.O. box.

When a regulated institution sits anywhere in your deal, a bank, an escrow provider, a verification platform, identity checks are part of a wider AML control system rather than an onboarding nicety. Inside that system sit three duties people confuse constantly: identifying the investor, verifying the humans who own an investing entity, and reporting beneficial ownership to FinCEN. Different triggers, different owners, different consequences.

Identity Documents Each Investor Must Provide

Find the investor type in the table, collect every field in the middle column, and match the document on the right before the subscription is accepted.

For identity verification, U.S. users provide a driver's license or passport, and Canadian and Mexican users provide a passport. The services are available to sponsors and investors who are residents of, or organized in, the United States, and Mexican investors can participate in Reg S or other applicable private placement offerings subject to identity verification. Investors outside the U.S., Canada and Mexico can use the platform only for Reg S offerings.

Why the entity row asks for more than a certificate

An LLC formed last month with a registered agent address and no operating history looks identical, on paper, to a legitimate holding company. The formation certificate proves the entity exists. It doesn't name the human whose money is being invested.

An entity certificate proves the LLC exists. It says nothing about who is behind it.

Say an investing LLC is managed by a single member who holds a U.S. passport. You need the LLC's formation documents and EIN plus the managing member's own identity record, because the entity can't sit across from you; the member does. Trusts work the same way with one extra wrinkle: the trustee who signs and the grantor who funded can be different people, and both identities matter.

Collect for every row before acceptance, not after. A subscription accepted with a missing identification number gets resolved at the worst possible moment, when the wire is sitting in escrow and the closing date is fixed. Chasing a passport scan on the morning of a rate lock is how sponsors end up approving first and verifying later.

Digital Identity Checks and Risk-Based Tiers

A document upload proves someone had a passport photograph on their phone. It doesn't prove the applicant is the person in that photograph, controls the email on the form, or clears a sanctions list. Digital KYC earns its keep when it's engineered as an assurance-tiered system rather than a single upload step, which is how FATF's digital identity guidance frames it: higher assurance levels are more reliable, and lower levels carry a greater risk of failed or fraudulent identity proofing.

The seven steps of a defensible digital check

1. Collect the four data points on one form. Legal name, date of birth, residential address and identification number. Splitting collection across two screens or a PDF attachment creates transcription mismatches that later look like fraud.
2. Ask for consent before any biometric step. A selfie or liveness check processes biometric data, and users are asked to consent before biometric verification begins. A timestamped consent click is also the record that answers a complaint six months later.
3. Validate the document itself. Check authenticity features, expiry date, and whether the printed details match what the applicant typed.
4. Match a live selfie to the document photo. This is the step that shows control of the identity rather than mere possession of a document. Liveness detection defeats a static photo, a mask or a replayed video.
5. Screen for sanctions and watchlists against the verified details, not against whatever was typed into a form before verification.
6. Score the case as pass, manual review or reject, and route anything ambiguous to a person. Binary pass or fail systems push edge cases into silent approval.
7. Record the decision. Method, data source, timestamp, match outcome, reviewer name and the reason for any override. This is the only artifact that lets you reconstruct how an investor was admitted.

We run identity verification through Persona, and we keep a verification token and result rather than the investor's underlying identity documents, unless law or a third-party provider requires us to keep more. Your obligation doesn't transfer with ours. Your file still needs to show why a given investor was admitted.

Three assurance tiers and when to escalate

A basic tier covers document validation and database checks, and it's enough for a low-risk domestic individual wiring from an account in their own name. Most of your investors land here, and pushing them through heavier checks costs you conversions for no gain.

The middle tier adds liveness matching plus phone and email possession checks. It fits a first-time investor whose documents are thin, an investor whose address differs from the bank on file, or anyone whose device and session signals look unusual.

The enhanced tier is for foreign persons, trusts, newly formed entities, proxy-like behavior where one person acts for several subscribers, identity inconsistencies, and high-value subscriptions. Manual review, source-of-funds questions and a second reviewer belong here. Risk-based routing like this reduces false approvals without pushing ordinary investors to abandon the subscription.

Recordkeeping test: if the file can't explain in one sentence why an investor passed, it isn't finished.

What a clean pass looks like

A clean pass means every field matched, the selfie matched the document photo, and screening came back with no hits. Anything less is a review, even when the platform shows green.

The most common slip is skipping the manual-review record. Someone looks at a mismatch, decides it's fine, admits the investor, and writes nothing down. Two years later, a bank or an auditor asks why an investor with a different name on the remitting account was approved, and nobody can answer. Confirm what your own portal stores before you rely on it, because a provider can run the checks while the decision record stays your responsibility.

Verifying Entities and Their Beneficial Owners

Verifying an entity and verifying its owners are two jobs, and the second one is where most control failures happen. FinCEN's customer due diligence framework requires covered financial institutions to identify and verify each beneficial owner of a legal-entity customer using risk-based procedures with verification elements at least comparable to those used for individual customers, as summarized in FinCEN's CDD rule FAQs.

Consider an investing LLC with three members at 40%, 35% and 25%, plus a manager who holds no equity. All three members sit at the 25% or more beneficial-ownership threshold, so each one needs identity verification, alongside one individual with significant control. Here the manager is the control person and gets verified in that capacity even though the manager owns nothing. The sponsor ends up with four identity records for one subscription.

Ownership that runs through other entities

Layered ownership, where an entity owns another entity, breaks naive verification. You can't stop at the first company in the chain, because the certificate you collected names a holding company incorporated in another state, and the actual humans sit two levels up. Trace to natural persons, collect the ownership chain as a document, and treat any gap in the chain as an open item rather than a rounding error.

A harder failure is treating the formation certificate or an accredited-investor representation as proof of the natural person funding the investment. Neither document says anything about whose money arrived.

Trusts add a role split worth planning for. A trustee signs the subscription, a grantor may have funded the trust years earlier, and beneficiaries may hold the economic interest. Capture trustee identity, grantor details and the trust certification so a later review can see who controls the account and who benefits from it.

When to escalate

• Unresolved identity mismatches: a name, address or date of birth that won't reconcile across documents goes to review, not to a note in the margin.
• Layered ownership: two or more entity levels, or any structure that can't be drawn on one page.
• Foreign investors: different document sets, different address evidence, and often a source-of-funds question.
• Sanctions concerns: any partial hit, including a name that's close but not exact.
• Inconsistent source-of-funds information: a wire from an account that doesn't belong to the subscriber.

Log each beneficial owner separately from the person exercising control, with the ownership percentage and the evidence you relied on. One combined "entity verified" checkbox can't survive a question about which member was checked and when.

Sanctions Screening and Source-of-Funds Checks

Sanctions screening asks whether a person is barred from holding the investment at all. Source-of-funds asks where the money came from. Both sit downstream of identity matching, and both fail when nobody owns them.

Take the earlier case: a $250,000 Reg S subscription where the wire arrives from a bank account held by a third party. Here's the sequence that resolves it without guessing.

• Confirm the remitting account holder against the subscriber. If the names don't match, you have a question, not an inconvenience.
• Screen the subscriber and every owner before acceptance, not after the funds land. Screening a wire you've already credited is cleanup.
• Request source-of-funds documentation that ties the money to the subscriber. A bank statement, a sale proceeds letter or a distribution statement from another investment, in the subscriber's name.
• Hold the subscription pending manual review when names or documents don't line up, and tell the investor what you need. Silence reads as rejection.
• Record the decision and the reason, including who reviewed it and what evidence resolved the question.

Sequencing rule: screen before the money moves, not after it lands.

Source of funds answers where this particular money came from. Source of wealth answers how the investor built the net worth behind it, and higher-risk files need both. A cleared sanctions hit is still an open documentation item, because a hit you cleared with no written rationale looks identical to a hit you ignored.

The scale behind these checks isn't abstract. The U.S. Treasury Department reported that FinCEN analyzed 137,153 Bank Secrecy Act reports filed between January 2020 and December 2024 in connection with suspected Chinese money-laundering networks, covering approximately $312 billion in suspicious transactions. Third-party remitters and layered entities are how that money moves. For the wider picture of where these controls sit in a real estate raise, see this guide to AML compliance for real estate.

Which KYC and Reporting Rules Apply to Each Role

Three obligations get used interchangeably in syndication content, and they aren't interchangeable. Investor KYC is what the sponsor runs on the people subscribing. Customer due diligence is what a bank or escrow provider runs on its own account holders. Beneficial-ownership reporting is a filing with FinCEN, and it belongs to the reporting company, not to the sponsor's onboarding flow.

Read the table by structure, not by habit. The sponsor row and the U.S. investor LLC row are fixed rules: verify the human, keep the record. The foreign-registered entity row and the pooled vehicle row depend on how the offering is organized, which is why those two rows deserve a conversation with counsel before your next PPM goes out.

The rule change that causes the most confusion is on the reporting side. U.S.-formed companies and U.S. persons are no longer generally required to submit beneficial-ownership information to FinCEN, while certain foreign entities registered to do business in the United States remain subject to reporting, per FinCEN's consolidated CDD FAQs.

A missing federal filing is not a missing control.

Losing a filing obligation removes a form, not the bank's customer due diligence, your identity verification, sanctions screening or source-of-funds questions. Keep verification results, beneficial-owner records and subscription documents anyway. Each sponsor, not Homebase, determines and verifies investor qualification for its offerings, and we retain KYC and AML records for up to five years.

Set Up Your KYC Workflow Before the Next Raise

Start with a list, not a policy document. Pull every investor who has subscribed or is about to, and put each name against one row of the investor-type table. Any row you can't point to a stored document for is a gap you can close this month instead of during a closing week.

A blank cell in that column is the only finding that matters right now.

Next, mark the rows that hinge on structure rather than on the person: foreign-registered entities, trusts and any pooled vehicle in the offering. Those are the rows where the duty shifts, and where a copied template answer will be wrong.

The setup side is quicker than most sponsors expect. Our verification runs through Persona, and a new account takes 24 hours to set up with no sales call required, so the binding constraint is your recordkeeping rather than the software.

Ask counsel to confirm how the rules apply to your specific offering and investor mix, since a Reg S raise with Mexican investors carries a different document set than a domestic 506(b). Then close each raise with one check: every accepted subscription has a complete decision record, meaning matched fields, a document or database result, a screening outcome and a reviewer's name. Your first action this week is an audit of current onboarding against the investor-type table, with every investor type that lacks a documented verification method written down and assigned an owner.

Homebase puts investor verification inside the raise itself, so the subscription, the identity check and the signed document land in one record instead of three inboxes. Identity verification runs through Persona, with beneficial-ownership checks for entity investors and accreditation handled alongside KYC. Visit Homebase to see how the deal room, subscription documents and verification fit together before your next raise opens.