You've heard the panic: Treasury Secretary Scott Bessent wants banks to start collecting citizenship data on customers, and suddenly it's the end of banking as we know it. Billions in new costs, millions of accounts frozen, legal residents debanked over paperwork gaps, and the entire system turned into immigration cops. Consensus has priced in operational Armageddon, with shares in big banks already twitching on every headline. Reality is the punchline here, and it's a lot drier than the headlines suggest.
Bessent put it plainly at the recent CNBC event: "Why can unknown foreign nationals come and open a bank account? Our bank executives' job is to know your customer. How do you know your customer if you don't know if they have legal or illegal status?" He added that "every other country does it," pointing to places like the UK where even apartment rentals trigger residency checks. The U.S. stands out for not requiring this layer—current rules under the Bank Secrecy Act and USA PATRIOT Act force banks to verify name, address, date of birth, and SSN or ITIN, but stop short of confirming legal status. That gap lets undocumented individuals open accounts with ITINs for tax purposes, something the administration wants closed.
Here's where the narrative cracks. U.S. banks already open roughly 53.6 million new accounts every year. FinCEN's own estimates peg the current Customer Identification Program (CIP) at about 3 minutes per new account, adding up to roughly 2.8 million hours of annual paperwork across 10,400 covered institutions. That's before you layer in the 11 hours per institution for ongoing system maintenance. Adding a citizenship field isn't building a new skyscraper from scratch—it's bolting one more data point onto systems already hardened against money laundering, sanctions, and fraud. The American Action Forum ran the numbers on this exact expansion for new accounts alone: 33.1 to 73.3 million additional paperwork hours and $2.6 to $5.6 billion in costs, scaled from existing fully-loaded wage rates around $106 per hour. Front-loaded on the annual flow of new accounts, not a retroactive audit of every existing relationship.
Contrast that baseline with the broader reality banks already swallow. Financial crime compliance across U.S. and Canadian institutions tops $61 billion annually, with large banks routinely dropping over $200 million each on KYC/AML alone—personnel, tech, training, the works. Mid- and large-sized firms have seen those costs climb for 99% of players in recent years, driven by ever-escalating rules. Yet somehow one incremental citizenship check on new accounts gets treated like an unprecedented apocalypse. Banks already spend billions navigating BSA/PATRIOT Act demands that verify identity without touching immigration status. Bessent's push aligns U.S. practice with peers abroad and plugs a clear "know your customer" blind spot on legal presence. The deadpan fact bomb: U.S. banks grind through 53.6 million new accounts yearly under rules demanding 2.8 million compliance hours and 11 hours of system maintenance per institution—yet verifying one additional data point on legal status suddenly becomes an existential operational crisis.
This isn't zero marginal cost, and pushback from credit unions and larger players makes sense on execution details, especially if scope creeps to existing accounts. But the AAF estimates deliberately separate new-account flow (the dominant annual volume) from any retroactive load, and early signals point to guidance focused on updates to CIP parameters rather than full account sweeps. Markets are lazy here, lumping this in with blanket debanking fears without distinguishing the incremental tweak from prior delayed proposals—like Sen. Tom Cotton's bill and October letter targeting undocumented access to FDIC/NCUA accounts. The administration's EO is "in process," building on industry input that already softened February/March ideas.
You position accordingly. Banks have the infrastructure, the teams, and the tech budgets to absorb this as a routine systems upgrade. The real risk to valuations isn't the policy—it's if execution blows out costs without any offset in risk reduction or if political noise drives unnecessary customer churn. But the data says the baseline burden already dwarfs the add-on, and "every other country does it" isn't empty rhetoric when your KYC program already costs hundreds of millions.
If no meaningful cost spike materializes, this becomes another compliance evolution that large banks digest while smaller players adapt or consolidate. Consensus crowds the overreach narrative because it fits the political heat. The numbers point to marginal impact on P&L for institutions already deep in the compliance game. Position for the reality where banks treat this as business as usual.