KYC and source of funds: what banks actually want to see.

Applicants routinely treat these as interchangeable, and that conflation is one of the fastest ways to slow down or stall an onboarding review. Source of wealth is the broader, lifetime story: how a beneficial owner accumulated their overall net worth — a business built and sold, a career of accumulated salary and bonuses, inherited assets, a portfolio of investments compounded over years. Source of funds is narrower and more immediate: the specific, traceable origin of the money that is about to move into a particular account or fund a particular transaction.

A compliance officer reviewing a new account application is trying to answer two distinct questions. First, does this person's overall financial profile make sense — is the scale of wealth they hold consistent with what is known about their career, business activity and jurisdiction? Second, and separately, is the specific deposit being made now traceable to a legitimate, evidenced origin, or does it appear from nowhere with no documentary trail connecting it to anything in the wealth narrative?

It is entirely possible to satisfy one and fail the other. A beneficial owner might have a perfectly well-documented history of wealth — a technology company sold five years ago, taxes paid, proceeds sitting in a brokerage account — but if the funds arriving in the new account today come from an unrelated third party's wire with no explanation, the source-of-funds question is unanswered even though the source-of-wealth question is not in doubt. The reverse is equally common: a young founder with a genuinely clean and traceable source of funds for the specific deposit — a recent seed round tranche, wired directly from a named institutional investor — but with a source-of-wealth picture that has never been properly documented because nobody asked before now.

The practical implication is that a KYC file needs two separate, purpose-built sections rather than one generic narrative that gestures at both. The source-of-wealth section should read as a chronological history with documentary anchors at each stage. The source-of-funds section should read as a specific, current-dated explanation of the money about to move, tied to bank statements, wire references and underlying agreements that a reviewer can independently check.

This distinction matters more, not less, as account values and business complexity increase. A modest personal account funded from salary rarely needs more than payslips and an employment letter. A corporate account intended to receive material inflows from a business sale, a crypto realisation, or a fund distribution needs both threads built out properly, because the amounts involved are exactly what triggers enhanced due diligence at most institutions.

Employment and salary income is the most straightforward category to evidence and the one reviewers are most comfortable with: recent payslips covering a representative period, an employment contract or letter confirming role and remuneration, and personal bank statements showing the salary being received consistently over time. Where bonus or commission income forms a material part of the picture, a letter from the employer confirming the structure and history of variable pay strengthens the file considerably.

Business income and dividends require a slightly deeper set: management or audited accounts for the relevant entity, board minutes or resolutions authorising a dividend or distribution, the corporate bank statement showing the distribution actually leaving the company account, and, where the business has been sold, the share purchase agreement together with completion statements and the bank statement showing proceeds landing. Tax returns covering the relevant years, filed and where possible showing evidence of payment, corroborate the whole picture and are requested in the substantial majority of enhanced due diligence files.

Investment and portfolio income is evidenced through brokerage or custodian statements showing the acquisition, holding period and disposal of the relevant positions, together with contract notes for material trades and a statement showing the proceeds being credited to a bank account before onward transfer. Where the portfolio has been built up over many years, a shorter representative sample covering the key events — the original funding of the account and the specific disposal generating the current funds — is usually more useful to a reviewer than an unwieldy full history.

Digital asset wealth is treated with particular scrutiny because the underlying rails do not produce the same kind of institutional paper trail as a bank, but it is entirely capable of being evidenced properly. Exchange account statements showing deposits, trades and withdrawals; on-chain wallet addresses with transaction history that a reviewer or their blockchain analytics provider can trace; screenshots or exports are not sufficient on their own and need to be corroborated with the underlying exchange's own statement export or an API-generated report; and, where the original acquisition was through mining, staking or an early-stage token allocation, whatever contemporaneous documentation exists — a mining pool payout record, a vesting agreement, an allocation letter — should be produced even if imperfect, because an honestly incomplete trail is treated far better than an unsupported claim of clean origin.

Loans and gifts as a funding source are accepted at most institutions but require their own documentation: a signed loan agreement stating terms, a bank statement showing the loan proceeds actually being disbursed from the lender, and, where the lender is a private individual rather than an institution, some evidence of the lender's own capacity to have made the loan. Gifts require a signed gift declaration or deed, the donor's identification, and, at many institutions, some indication of the donor's own source of wealth if the gift is material relative to the recipient's overall profile — a genuinely unconditional family gift is common and acceptable, but it still needs to be documented rather than simply asserted.

The single most common failure we see is not a missing document but a narrative that fails to connect the documents that do exist into a story a reviewer can follow without a follow-up call. Underwriters and compliance analysts read a large volume of files and do not have time to reconstruct a coherent picture from a folder of unlabelled PDFs — the narrative's job is to do that reconstruction for them, in plain language, in the order they will naturally ask about it.

A well-built narrative follows a simple structure: who the beneficial owner is and what their career or business history has been in summary; how their overall wealth was generated, referencing the specific supporting documents by name at each stage; and then, separately and clearly flagged, exactly where the funds intended for this specific account or transaction came from, again referencing the specific supporting document. Dates, amounts and entity names should be consistent across the narrative and the underlying documents — a mismatch of even a modest amount or a misdated event is enough to trigger a query that could have been avoided.

Round numbers and vague verbs are the two most reliable tells of an unevidenced narrative, and reviewers are trained to notice both. A narrative stating that funds derive from "business income and savings accumulated over several years" with no further specificity reads as an assertion rather than an explanation. The stronger version names the business, states the years, references the specific tax filings and account statements attached, and explains any gap or irregularity rather than smoothing over it.

Where genuine complexity exists — funds moving through more than one account before arriving at the destination, wealth generated across more than one jurisdiction, a mix of business and personal sources feeding a single deposit — the narrative should acknowledge that complexity explicitly and provide a short table or chronology showing each leg of the movement with the corresponding document reference. A reviewer who receives a clear map of a complex flow will generally accept it far more readily than one who has to infer the same complexity from an oversimplified one-line explanation that does not match the numbers.

It is worth stating plainly that a compelling narrative is never a substitute for the underlying documents, and no amount of careful drafting will clear a file where the documentary evidence is genuinely missing. The narrative's function is to organise and explain evidence that already exists, not to compensate for evidence that does not.

A corporate applicant needs its own full incorporation set before any beneficial ownership discussion begins: certificate of incorporation, memorandum and articles of association (or the local equivalent), a certificate of good standing or incumbency current within a limited window, and, where the entity has been through a name change, restructuring or redomiciliation, the documents evidencing each of those events in sequence.

The register of members and register of directors need to be current and need to reconcile exactly with the ownership chart submitted elsewhere in the file — a discrepancy between the register and the chart, even an outdated register that has simply not been refiled after a recent change, is one of the more common causes of a file being sent back for correction. Where the jurisdiction of incorporation does not maintain a public or centrally accessible register, a certified extract or a director's declaration confirming the current position is required instead.

The ultimate beneficial ownership chain has to be traced all the way down to natural persons, through every intermediate holding entity, trust or foundation in the structure, with full KYC — certified identification, proof of address, and source of funds and wealth documentation — collected for each natural person who meets the applicable ownership or control threshold. Every intermediate entity in the chain needs its own constitutional documents produced, not merely referenced, because a reviewer cannot verify a link in a chain they have not seen.

Certification and legalisation requirements vary by receiving institution and jurisdiction but are rarely optional for cross-border files: documents typically need to be certified by a notary, lawyer or other permitted certifier, and in many cases apostilled under the Hague Convention or legalised through the relevant embassy where the destination jurisdiction is not a Convention signatory. Documents in a language other than the institution's working language need a certified translation attached alongside, not instead of, the original.

Document age limits are strictly enforced and are one of the most common avoidable causes of delay: proof of address is typically only accepted within three to six months of submission, certificates of good standing and incumbency within a similarly short window, and identification documents must have a validity date that comfortably outlasts the expected length of the review and onboarding process. Submitting a file built around documents that will expire mid-review is a self-inflicted delay, and the practical fix is simply to sequence document collection so that the shortest-lived documents are obtained last, immediately before submission.

Identity verification for individuals almost universally requires a current, government-issued photo identification document — passport, national identity card, or in some jurisdictions a driving licence — that is legible, unexpired, and certified by an accepted certifier where the original cannot be presented in person. Institutions increasingly supplement documentary identification with a live biometric check, comparing a selfie or video capture against the photo page, and a mismatch or a poor-quality capture is a common cause of an otherwise complete file being bounced back.

Proof of address needs to be independent of the identification document and dated within the institution's accepted window, typically three to six months. Accepted documents usually include a utility bill, a bank or credit card statement, a local tax or government-issued letter, or a tenancy or lease agreement, but they need to show the applicant's full name exactly as it appears on the identification document and a complete, matching address. A P.O. box, a mail-forwarding address, or an address that does not match records elsewhere in the file is a reliable trigger for further query.

Where an individual has moved recently, holds multiple residences, or lives in a jurisdiction where standard utility documentation is uncommon, the practical fix is to proactively provide a short written explanation together with whatever alternative evidence is available — a residence permit, a notarised landlord letter, a local government registration — rather than submitting a single document that does not cleanly fit the standard categories and hoping it is accepted without comment.

For corporate structures, the equivalent verification extends to registered office and, where different, principal place of business, both of which should be confirmed through independent documentation rather than the applicant's own assertion — a lease agreement, a utility bill in the entity's name, or, in the case of a registered agent arrangement, the agent's own confirmation letter.

A practical point that catches many otherwise well-prepared applicants: name consistency across every document in the file matters more than most people expect. A beneficial owner whose passport, proof of address, corporate registers and source-of-wealth documents each render their name slightly differently — a middle name included in one and omitted in another, a transliteration variance, a maiden versus married name inconsistency — will generate queries that a short covering explanation, provided upfront, would have avoided entirely.

Politically exposed person status, whether it belongs to the applicant, a beneficial owner, a director, or a close family member or known close associate of any of them, needs to be disclosed proactively rather than left for the institution's own screening to surface independently. A PEP connection discovered by the institution after an applicant has failed to disclose it is treated as a materially more serious issue than the same connection disclosed upfront, because the non-disclosure itself becomes the primary concern rather than the underlying status.

PEP status is not, on its own, disqualifying at the great majority of institutions — it is a trigger for enhanced due diligence rather than an automatic decline. Enhanced due diligence for a PEP-linked file typically requires senior management approval to onboard, a more detailed source-of-wealth and source-of-funds package than would otherwise be required, more frequent ongoing monitoring, and often a more conservative view of expected transaction volumes until a track record is established.

Adverse media screening searches an applicant's name, and the names of connected parties, against news, litigation, regulatory action and enforcement databases, and any material hit needs to be addressed head-on in the file rather than left unaddressed for the reviewer to find independently. A hit that is old, resolved, unrelated to financial conduct, or the result of mistaken identity should be explained with supporting documentation — a court judgment showing dismissal, a regulator's confirmation of resolution, or a simple identity clarification where the media relates to a different person of the same name.

The instinct to omit a disclosable connection in the hope that screening will not surface it is one of the more damaging strategic errors an applicant can make, because most institutions treat a discovered non-disclosure as a trust and integrity issue that colours the review of the entire file, well beyond the specific fact that was withheld. A disclosed PEP connection with strong supporting documentation clears far more often than an undisclosed one that surfaces on the institution's own screening midway through the process.

Family members and close associates of a PEP inherit a version of the same scrutiny even where they hold no political role themselves, and applicants sometimes overlook this because they focus only on their own direct status. Mapping this out honestly at the start of the application, and building the enhanced due diligence documentation proactively rather than reactively, materially shortens the time to approval where a PEP connection genuinely exists somewhere in the ownership or family structure.

Every account opening file, personal or corporate, requires a statement of expected account activity: anticipated monthly turnover, the typical size and frequency of individual transactions, the countries and currencies expected to be involved, and the general purpose of the account. This is not a formality — it becomes the baseline against which the institution's automated transaction monitoring measures every subsequent transaction, and a mismatch between what was declared and what actually occurs is one of the most common triggers for a post-onboarding review or account restriction.

Projections should be built from the business's or individual's actual operating history and realistic near-term plans, not from an aspirational growth scenario intended to look impressive. An underwriter reading a projection that shows an immediate, sharp step-up in volume with no supporting rationale reads it as either unrealistic or, worse, as an attempt to pre-authorise a volume the applicant expects to be questioned about later — neither reading helps the application.

Where growth is genuinely expected — a new product launch, an expanding customer base, a seasonal business with predictable peaks — that trajectory should be shown explicitly with the underlying assumption stated, rather than folded silently into a single flat monthly figure. A projection that shows a conservative ramp-up over the following two to three quarters, with the assumption behind each step named, is read as considerably more credible than either a flat line or an unexplained spike.

For businesses whose activity is inherently variable — marketplaces, trading businesses, businesses with a small number of very large transactions rather than many small ones — the projection should describe the shape of that variability explicitly, since an institution that expects smooth, evenly distributed volume and instead sees a small number of large, irregular transactions will generate monitoring alerts that a properly framed projection would have pre-empted.

Once onboarded, projections are not a one-time submission to be forgotten. Most institutions expect a business to proactively notify them, or at minimum be prepared to explain without delay, when actual activity is going to materially exceed what was originally declared, particularly where a large one-off transaction or a step-change in monthly volume is anticipated. Treating the original projection as a living document that is updated as the business's actual trajectory becomes clear, rather than a box ticked once at onboarding, avoids a substantial share of the account reviews that follow a genuine but undisclosed change in activity.

Beyond overall volume, institutions expect a clear picture of who the money is actually moving between and along which corridors, because jurisdictional and counterparty concentration is itself a risk factor independent of the absolute amounts involved. A file should identify the principal counterparties expected — key suppliers, customers, payment processors or platforms — and the countries in which they are located, rather than describing activity only in aggregate terms.

Corridor concentration in a jurisdiction that carries elevated regulatory attention does not automatically prevent an account being opened, but it does require proactive disclosure and, in most cases, a specific explanation of the underlying commercial rationale and the enhanced controls in place around that exposure. An institution that discovers material undisclosed activity in a sensitive corridor during a post-onboarding review will treat the omission itself, not only the underlying exposure, as a serious finding.

Where counterparties are themselves regulated entities — payment institutions, exchanges, other licensed businesses — naming them and, where available, providing evidence of their own licensing status strengthens the file considerably, since it allows the reviewing institution to assess counterparty risk directly rather than relying on the applicant's characterisation of the relationship.

For businesses operating through intermediaries or platforms rather than direct counterparty relationships — a marketplace seller, an affiliate operating through a network, a business receiving pooled settlement from a payment aggregator — the disclosure should explain the intermediary structure clearly, including how underlying end-customers or end-counterparties are known and screened by the intermediary, since an opaque pooled-settlement structure with no visibility into the underlying flow is treated with particular caution.

As with expected activity, corridor and counterparty disclosure should be treated as something to update over time rather than fix once at onboarding. A business that adds a materially new corridor or a significant new counterparty relationship after the account has been opened should expect, and ideally proactively initiate, a further review of that specific change rather than allowing it to surface unexplained in routine monitoring.

Round-number projections are one of the most reliably flagged patterns: a stated expected monthly turnover of exactly one million, or transaction sizes that are uniformly round, reads to an experienced reviewer as a figure chosen for its appearance rather than derived from an actual operating model. Real businesses produce irregular numbers, and a projection built from genuine historical data or a bottom-up operational estimate will naturally reflect that irregularity.

Unexplained third-party inflows are treated as a serious concern regardless of the amounts involved, because a payment arriving from a party with no stated relationship to the account holder, and no accompanying explanation, is precisely the pattern layering-stage money laundering is designed to produce. Every material inflow from a party other than the account holder's own known entities should be pre-emptively explained in the file, with the nature of the relationship and the underlying reason for the payment stated clearly.

A mismatch between the stated business model and the actual transaction pattern — a business described as a small consultancy whose account shows the volume and pattern of a payment processor, or a described retail business whose flows show wholesale-scale, round-number transfers to a small number of counterparties — is one of the fastest routes to an enhanced review or account restriction, because it suggests either an inaccurate original application or a business that has evolved without updating its disclosures.

Self-declared crypto gains with no corroborating trail remain one of the most commonly rejected source-of-wealth claims, not because digital asset wealth is inherently suspect but because applicants frequently submit a wallet balance or an exchange account screenshot as if it were self-evidently sufficient evidence, when what is actually required is a traceable history connecting the original acquisition, through any intermediate transfers, to the current holding and its disposal. A current balance alone answers none of the questions a reviewer is actually asking.

A further pattern worth naming explicitly is documentation that is internally inconsistent in small ways — a stated incorporation date that does not match the certificate, a beneficial ownership percentage that does not sum to 100% across the register, a projected turnover figure in the business plan that does not match the figure in the account opening form. None of these individually would sink an application, but a reviewer who finds two or three small inconsistencies in a file reasonably concludes the whole file has not been carefully prepared, and reads everything that follows with correspondingly less trust.

The salaried founder opening a personal or early-stage corporate account typically needs: passport and proof of address; recent payslips and an employment contract or letter; personal bank statements for the past three to six months; where the account will also receive founder equity proceeds or investor funds, the relevant share purchase, subscription or SAFE agreement and the wire confirmation for any funds already received; and a short written narrative connecting salary history to the funds being introduced.

The established business owner opening a corporate account, or a personal account intended to receive dividends or sale proceeds, needs the full corporate KYC set for the operating entity — incorporation documents, register of members and directors, beneficial ownership chart — together with two to three years of management or audited accounts, tax returns for the relevant years, board minutes authorising any dividend or distribution, and, where a sale has occurred, the share purchase agreement, completion statements and bank statements showing proceeds received.

The crypto trader or digital asset holder needs exchange account statements covering the full relevant history rather than a current snapshot, wallet addresses with on-chain transaction history available for review, contemporaneous documentation of any mining, staking or token allocation origin where applicable, a clear written explanation of the trading or investment strategy that generated the gains, and evidence of any conversion to fiat, including the receiving bank statement. Where losses or write-downs occurred, including that honestly in the narrative strengthens rather than weakens credibility, since a story with no losses across a volatile asset class over years reads as implausible.

The fund manager or institutional applicant needs the fund's constitutional documents, the offering memorandum or equivalent disclosure document, evidence of the fund's own regulatory status or registration where applicable, administrator and custodian statements evidencing assets under management, the beneficial ownership and control chain for the management entity, and, for personal accounts of principals receiving management fees or carried interest, the fund's own financial statements and the specific distribution documentation evidencing the payment.

Across every client type, the common thread is the same: gather documents proactively rather than waiting to be asked for each one individually, keep every figure and date consistent across the file, and pair every document with a sentence of narrative explaining what it shows and why it is relevant, rather than submitting a folder of unlabelled attachments and leaving the reviewer to work out the connections.

KYC and source-of-funds work does not end at account opening. Institutions run automated transaction monitoring continuously against the activity profile declared at onboarding, and periodic reviews — typically annual for standard-risk clients, more frequent for higher-risk or PEP-linked relationships — refresh the identity, ownership and source-of-wealth documentation on file to confirm it remains current and accurate.

A periodic review request is not, on its own, a sign of a problem, and treating it as an inconvenience to be delayed or minimised is a common and avoidable mistake. Institutions are required by their own regulators to refresh files periodically regardless of how the relationship has performed, and a prompt, complete response to a review request is itself a positive signal about the account holder's overall compliance posture.

Where actual account activity has materially diverged from the original projection, a periodic review is often the point at which that divergence is formally addressed, and the account holder should arrive prepared with an explanation and, where relevant, updated projections and supporting documentation, rather than being caught unprepared by a question the institution is entitled to ask at any point in the relationship.

Material changes to the business or personal circumstances — a change in beneficial ownership, a new significant source of income or a business sale, a new material counterparty relationship or corridor, a change of registered address or jurisdiction — should generally be proactively notified to the institution rather than left to surface at the next scheduled review, since most account terms require this and a change discovered independently by the institution is treated less favourably than one self-reported promptly.

The practical discipline that keeps an account in good standing over time is the same one that gets it opened in the first place: maintain the underlying documentation as a living file rather than a one-time submission, keep source-of-funds and source-of-wealth evidence current as new transactions occur, and treat every institutional request, whether at onboarding or years into the relationship, as an opportunity to demonstrate a well-run, transparent operation rather than an obstacle to be minimised. This is general information, not legal or tax advice, and specific document requirements vary by institution and jurisdiction and should be confirmed directly with the receiving institution or qualified counsel.