What Banks Owe You After a KYC Rejection

A refusal is a decision, and decisions carry duties. This is what the published rules require a bank or platform to give you afterwards, which document says so, and how long you have before the right expires.

Published 26 September 2026 · maintained by KYC Rejected

The short answer

Almost nobody asks. That is the whole opportunity. After a rejection, most people retake the selfie, get refused again, burn their attempts and go looking for another platform. Meanwhile the firm that refused them is usually sitting under a written duty to explain itself, or to hand over the report it relied on, or to let a human being look at the file again.

The four things worth asking for are the same everywhere, even though the legal basis for each one changes with the country. You can ask for the specific reason in writing. You can ask for human review of an automated refusal. You can ask for the report or the data the decision was based on. And when the firm goes quiet, you can take it to an ombudsman or supervisor that costs you nothing and that the firm has to answer to.

None of it is a magic key. Anti money laundering law genuinely does let a firm stay silent in some cases, and we are honest about that further down. But the gap between what firms are obliged to do and what they actually do when nobody pushes is very wide, and that gap is where a refusal gets reversed.

The four asks, by country

Read across your own row. The deadline column is the one people miss, because two of these rights expire quickly and cannot be recovered afterwards.

Fix the thing they will not explain While the complaint sits in a queue, a specialist checks the document itself and sends it back ready to submit, usually in under 10 minutes. $1.99, money back if it is not approved. Get my fix

European Union and EEA: the reason is owed to you in writing

The Payment Accounts Directive is the strongest consumer rule in this whole area and hardly anyone rejected by a bank has heard of it. Article 16(2) gives a consumer who is legally resident in the Union the right to open and use a payment account with basic features, and it says so in terms that cover people without a fixed address and asylum seekers as well.

Article 16(4) then sets the one refusal ground member states must apply: the bank has to refuse where opening the account would break the rules on preventing money laundering and terrorist financing. That is the ground firms lean on, and sometimes it is the right one. What firms skip is Article 16(7), which says the consumer must be informed of the refusal and of the specific reason for that refusal, immediately, in writing and free of charge, together with information about how to complain and who the competent authority is. The only carve out is where telling you would be contrary to national security, public policy, or the anti money laundering objectives.

Closure is treated separately and more strictly. Under Article 19 a bank may only end the contract unilaterally on defined grounds, including deliberate use of the account for unlawful purposes, no transactions for more than 24 consecutive months, false information given to obtain the account, and no longer being legally resident in the Union. For several of those grounds the bank owes you at least two months of written notice, free of charge. An account that vanishes overnight with no notice and no reason is not the normal legal position, it is the firm hoping you will not ask.

If you were refused by an electronic money institution or a payment institution rather than a credit institution, the basic account right does not reach them in the same way. The data protection route below still does, and so does the national supervisor.

The ruling from June 2026 that matters if you were screened out

This is the newest and most useful development for anyone caught by a sanctions or politically exposed persons screening hit. On 11 June 2026 the Court of Justice of the European Union gave judgment in Case C-81/24, a Slovenian reference about a bank that refused to open a basic payment account because the applicant appeared on the United States Office of Foreign Assets Control list of Specially Designated Nationals. The person had never been convicted of anything and was not under UN, EU or national sanctions.

The Court held that a bank may not refuse a basic payment account solely because the applicant appears on a restrictive measures list imposed by a country outside the EU, without having carried out an individual assessment of the money laundering and terrorist financing risk of the relationship. A refusal stands only where that risk cannot be managed by measures proportionate to the size and nature of the institution.

Read the practical consequence carefully. A third country listing can be a risk factor in the assessment. It cannot be the assessment. A firm that tells you it refused because your name came up on a list, with no sign that anyone looked at your actual circumstances, is describing exactly the practice the Court ruled against. That sentence, quoted back with the case number, changes the tone of a complaint.

United Kingdom: the clock is much shorter than people assume

The UK route is procedural rather than substantive, and it works because the deadlines are short and the ombudsman is genuinely free. Complain to the firm first, in writing, and say the word complaint so it is logged as one. Most firms then have 8 weeks to give you a final response.

The exception is the one that covers most people reading this. Where the complaint concerns payment services or electronic money, which includes app based accounts, money transfer services and prepaid cards, the firm has only 15 days. If it cannot answer in 15 days it must explain why and then answer within 35 days. Once you have the final response, or once the time runs out with no response, you have 6 months to refer the matter to the Financial Ombudsman Service.

The service is free, you do not need a lawyer or a claims company, and its decisions bind the firm. The single most common mistake is waiting. Six months from the final response is a hard limit.

United States: the report is the leverage

US account denials often have nothing to do with your photograph. They come out of a consumer report from a specialist agency, most often ChexSystems or Early Warning Services, which hold deposit account history, identity verification signals and fraud flags. Those agencies are consumer reporting agencies under the Fair Credit Reporting Act, and that puts a set of duties on the bank that denied you.

Under 15 U.S.C. 1681m(a), a person who takes adverse action based on information in a consumer report must give you notice of the action, the name, address and telephone number of the agency that furnished the report, a statement that the agency did not make the decision and cannot tell you the specific reasons for it, and notice of your right to obtain a free copy of the report and to dispute anything inaccurate or incomplete.

Two clocks start there. You have 60 days from that notice to claim the free copy, and once you file a dispute the agency generally has 30 days to reinvestigate and must correct or delete anything it cannot verify. This is the route that catches the mistake that ruins the most applications, which is a file mixed up with somebody else who shares your name, a similar Social Security number or an old address.

Ask for the file even if the denial looked like a document problem. A rejected selfie and a stale fraud flag look identical from the outside, and only one of them can be disputed.

India: what the Master Direction actually says

India is where the gap between practice and rule is widest, so it is worth quoting the rule. Paragraph 38 of the Reserve Bank of India Master Direction on Know Your Customer sets periodic updation at once every two years for high risk customers, once every eight years for medium risk and once every ten years for low risk, counted from account opening or the last update.

Then comes the provision almost nobody cites. For an individual customer categorised as low risk, the Master Direction says the regulated entity shall allow all transactions and ensure the KYC update happens within one year of it falling due, or up to 30 June 2026, whichever is later, and that it applies equally to low risk customers whose update had already fallen due. The account is meant to keep working while the paperwork catches up.

Paragraph 38 also tells the bank to warn you properly before the due date. It must send at least three advance intimations, including at least one by letter, and after the due date at least three reminders, including at least one by letter. If your account was restricted and you never received a letter, that is a specific, checkable failure to put in a complaint, not a vague grievance. There is more on this in our guide to accounts frozen for re-KYC.

Escalation is defined and free. Under the Reserve Bank Integrated Ombudsman Scheme 2021 you must first make a written complaint to the bank. You can go to the Ombudsman once the bank has rejected the complaint wholly or partly and you are not satisfied, or once 30 days have passed with no reply. The complaint must reach the Ombudsman within one year of receiving the reply, or within one year and 30 days from the date of your complaint where no reply came. There is no fee.

When the rules let them tell you nothing

Being straight about the limits is the point of this page. There are real situations where silence is lawful and pushing harder will not help.

• Suspicion reporting. Where a firm has filed a suspicious activity report, tipping off rules in most countries forbid telling you about it. The refusal reason you get will be thin because it has to be.
• The anti money laundering carve out in the EU rule. Article 16(7) itself allows the specific reason to be withheld where disclosure would run against national security, public policy or anti money laundering objectives.
• Firms outside the scope. A crypto exchange, a marketplace or a gig platform is usually not a credit institution offering a payment account with basic features, so the basic account right does not apply to it. Data protection rights and the platform's own appeal route still do.
• Commercial discretion. Outside the basic payment account rules, a firm can generally decline a customer it does not want, provided it is not discriminating on a protected ground and it follows its own published process.

Even inside those limits, the procedural duties survive. A firm that is allowed to withhold the reason is still not allowed to ignore your complaint, miss its deadline, or refuse to correct inaccurate data that it holds about you.

The order to do it in

Sequence matters more than wording. Each step creates the record the next step needs, and doing them out of order is how people end up outside a deadline.

1. Write down what you were actually shown. The exact on screen message, the date and time, and which document you had submitted. If you have a reference number, keep it. Our page on KYC error codes helps you work out which stage failed.
2. Do not resubmit yet. Attempts are usually capped, and a second identical submission removes an attempt without adding any information. There is more on how the caps work in our guide to failed attempts and bans.
3. Send one written request, to the right place, using the word complaint. Ask for the specific reason, ask for human review if the decision looks automated, and ask for the report or data if there is a consumer reporting agency involved.
4. Diary the deadline the moment you send it. 15 days or 8 weeks in the UK, 30 days in India, 60 days for the free US report, one month for a data request in the EU.
5. Fix what is actually fixable while you wait. If the cause was a name that does not match your document, or an address that does not match your proof, no complaint solves that and you can prepare the correction now.
6. Escalate on the day the clock runs out, not later. Ombudsman schemes are strict about their own time limits and generous about very little else.

What to put in the letter

Short beats long. A complaint that fits on one screen and names the rule gets handled by a person who can act on it. A three page account of how unfair it all feels gets a template reply. Include, in this order: who you are and the account or application reference, the date and the exact wording of the refusal, one sentence saying what you are asking for, the rule you are relying on, and the date you expect an answer by.

Name the document, not the principle. Article 16(7) of Directive 2014/92/EU lands differently from a general appeal to fairness, and so does 15 U.S.C. 1681m(a), or paragraph 38 of the Master Direction. You are not arguing that you deserve an account. You are pointing at an obligation that already exists.

Send it once, from the email address on the account, and keep the sent copy. If the firm answers with a template that does not address the ask, reply once quoting your own earlier sentence, then escalate. Repeating yourself a third time only burns the clock you are trying to protect.

Frequently asked questions