Bank Compliance Review: How to Answer a Request for Information

A bank compliance review checks that the activity on a business account still matches the business the bank opened it for. It asks for a business description, the website, the source of funds behind inbound transfers, the invoices behind outbound wires and the counterparties. It goes to the director as signer of record; the merchant supplies the documents behind each answer. A complete, consistent reply sent before the deadline closes the case.

A bank compliance review is the bank checking that the activity on a business account still matches the business it opened the account for. The request for information that starts it asks for a description of the business, the website, the source of funds behind an inbound transfer, the invoice behind an outbound wire and the parties the account pays and is paid by. It is addressed to the authorized signer of record, on an IBO (Independent Business Operator) package the US-resident director, and it carries a deadline. The merchant who runs the account assembles the facts and documents behind each answer; the director sends the reply. A complete, consistent answer sent through the bank's channel before the deadline closes the case; a partial or late one can turn a routine review into a restricted account.

A bank review is not the acquirer's KYB review

Two institutions watch a merchant's money. The acquirer underwrote the MID and monitors card sales: products, refund policy, descriptor, chargeback ratios; the KYB guide on this blog covers that review. The bank holds the deposits and monitors the account: where money comes from, where it goes and whether the pattern fits a company of the declared size and trade. The two do not work from one file. What the bank knows is what the director said at opening. That description is the baseline every later answer is measured against, and the reason the reply comes from the same person, with the same facts.

Periodic refresh or triggered review: what starts one

Banks run two kinds of review. A periodic refresh is scheduled at intervals set by the bank's risk rating: current identity documents for the signer, the business description and the expected activity for the coming period. A triggered review starts with an event that the bank's transaction monitoring flagged. Banks typically do not say which event it was; the events behind a triggered review tend to be few, none is wrong in itself, and each shapes what the request then asks. The frozen-account guide on this blog covers the restriction that follows an unanswered request.

• The first large inbound transfer, especially a wire from abroad or from a payer new to the account. The request asks for its source of funds.
• An outbound wire to a new country or counterparty: a supplier, a contractor, a company related to the merchant. The request asks for the invoice behind it.
• A change in volume or rhythm: settlements several times the activity declared at opening, or money that leaves within hours of arriving. The request asks for an updated description and expected activity.
• Login signals: sessions from several countries in a short period, or from a country absent from the file. The request asks the signer to confirm identity.
• A change in the file: a new address or website, an expired signer document, a name that no longer matches the state record. The request asks for the updated document.

What the request for information asks, item by item

The ownership certification is the bank's own form, distinct from FinCEN's beneficial ownership information reporting. At the time of writing, under FinCEN's interim final rule of March 2025, domestic companies and US persons are exempt from that reporting while companies formed under foreign law that register in a US state remain subject to it. Verify current FinCEN guidance; what a given entity owes is a question for a professional, and IBOCore gives no legal or tax advice. The package documents show the director on the state filing and on the EIN letter; the bank's form is checked against them.

Why the request lands on the director, and what the merchant prepares behind it

The bank opened the account on the director's identity: government ID, proof of address, the articles and operating agreement naming the director, the EIN letter issued to the company. The director is the authorized signer of record, so the bank writes to the director: secure messaging inside online banking, email to the address on file, or post. With full operational access you may see the secure message first; that does not make you the person who answers it. A reply from someone the bank never verified, or one that describes the business differently from the director at opening, reopens the file instead of closing it.

The division of labour is set by the package. You run the business, so you hold the invoices, the supplier contracts, the merchant agreement, the settlement reports and the website. The director holds the identity documents and the bank relationship: a real, KYC-verified US resident, exclusive to your package, available for verification calls and signatures for its active life; the authorized signer guide on this blog covers that role's limits. The request goes into the private Telegram group with your account manager the day it arrives; you assemble the facts and documents behind each question; the director checks them against the opening file, signs the reply and sends it through the channel the bank used. The director does not invent an answer for an undocumented wire, and does not describe a business other than the one on file.

Writing the reply that closes the case

A compliance analyst closes a case when every question has an answer, every answer has a document, and nothing in the reply contradicts the file. Write for that reader: someone with a checklist, a deadline and other cases open.

1. Quote the reference. The case number, the date of the request and the last four digits of the account, so the reply files itself.
2. Answer in the order asked. One to three sentences per question, under the bank's own wording. Do not merge questions or answer ones that were not asked.
3. Describe the business in one paragraph. The paragraph the director gave at opening, updated only where the business changed.
4. Document every transfer named. Date, amount, counterparty, what it paid for, and the attachment that proves it. Beneficiary and amount on the invoice match the wire exactly.
5. Attach documents, not screenshots. PDFs of the invoice, the agreement, the settlement report, the current ID and proof of address, each named after the question it answers. A cropped screenshot invites a request for the full document.
6. State expected activity for the coming period. Monthly inbound and outbound volume, the largest transfers to expect, the countries involved.
7. Send it complete, from the director, before the deadline, through the channel the request came in. If a document cannot be obtained in time, say which one and when it will follow; a dated promise beats silence or a partial reply presented as complete.

Consistency is the test that matters most: the reply, the description given at opening, the website and the business declared to the acquirer must describe one business. Where the business has changed since opening, say so, with the date and the reason. A change explained is a routine update; a change discovered by comparison is what keeps a case open.

What happens while the review is open, and after it closes

Banks typically keep an account receiving during a review and restrict only what the case requires: outbound wires held or limited, one transfer paused until its document arrives. Do not answer a hold by moving the business elsewhere mid-review: changing the settlement account on the MID restarts the acquirer's own KYB questions, and a new bank asks the same questions from zero. Answer the request; the decision comes after it.

• Case closed, no change. The outcome a complete reply is written for. Keep the reply and the attachments; the next periodic refresh starts from them.
• Case closed with conditions. A lower transfer limit, notice required before large wires, or a shorter review cycle. Keep activity inside what you declared.
• Account restricted or closed. The bank is not required to give a reason and may give none; the balance is returned, sometimes after a delay. The frozen-account guide on this blog covers getting the balance out and where the settlement account goes next.

Whatever the outcome, the file the reply created is an asset: the acquirer's next KYB refresh asks for bank statements and a business description, and the sanctions screening guide on this blog describes the identity requests that follow a name match. The same description, invoices and director answer all of them. IBOCore does not change how any bank runs its review; the package changes who is on the other end and what is already on hand.

Questions merchants ask

Can I answer the bank myself, since I hold the online banking login?

Read it the day it arrives. The reply comes from the director: the authorized signer of record, the person whose identity the bank verified. You supply the facts and documents in the Telegram group; the director checks them against the opening file and answers through the bank's channel.

What if a wire the bank asks about has no invoice behind it?

Say what it was, plainly, and attach whatever exists: an order confirmation, a contract, an email thread agreeing the price. Then put a document behind every future wire before it is sent. How the transfer is recorded in the company's books is a question for the professional who keeps them, not something to improvise in a reply. What a bank cannot accept is a transfer nobody can describe.

How long does a bank compliance review take?

It depends on the bank, its risk rating of the account and how complete the first reply is; IBOCore does not publish or promise any bank's timeline. A complete answer with the documents attached, sent before the deadline, lets an analyst close a case in one pass. Every missing document or contradiction adds a round trip, and the restriction stays for each of them.

Why US banks ask for a real signer on the account

Chase, Mercury, Relay and similar banks run KYC on the beneficial owner and authorized signer. Foreign passports alone trigger enhanced review. A vetted IBO with clean credit, US utility bill and in-person or video verification satisfies the "US human" requirement. Without that, accounts freeze when volume spikes or the MCC looks high-risk.

• NSF / return: ACH reject analog; keep operating balance for debits.
• Wire vs ACH: wires for large funding; ACH for payroll and US payouts.
• Beneficiary name: must match entity DBA on processor settlements.

Banking mistakes after the account opens

• Mixing personal and merchant settlements in the IBO account.
• Ignoring mail from the bank or IRS (the IBO must forward and respond).
• Changing website vertical without telling the acquirer (undisclosed products).

FAQ: quick answers

How fast can I get an IBO package on IBOCore?

Available inventory ships the same day after payment. You receive Articles, EIN letter, registered agent details, bank onboarding pack and signer contact through your merchant dashboard. Processor onboarding typically follows over the next one to two weeks.

Where can I look up payment-processing jargon?

Use the Resources glossary on IBOCore (/resources) for 580+ definitions: MID, chargeback ratio, MATCH, rolling reserve, MCC, RDR, KYB and high-risk vertical vocabulary.