KYC in the United States shifted in 2025 across banks, card networks, and payment platforms. Providers now expect non-resident businesses to show that they operate in the country in a real and verifiable way. If you relied on a virtual mailbox or a registered agent address to open accounts, you are now being asked for leases, utilities, bank letters, insurance certificates, and other documents that connect your company to a genuine place of business. This change follows stronger bank examinations, updated AML priorities, and stricter merchant location rules at the card networks.
What changed in 2025 and why it matters
In 2024 and 2025, regulators increased scrutiny of bank and fintech partnerships. Sponsor banks raised onboarding standards, especially for higher risk profiles such as non-resident owners and cross-border payment flows. FinCEN’s AML and CFT modernization efforts also pushed institutions to align controls with risk. Providers are now expected to verify where a business actually operates and to reduce exceptions for remote setups that have little substance.
Card networks reinforced the shift. Visa and other networks require a merchant’s place of business to be a real operating location. PO boxes, registered agent addresses, and mail forwarding services do not satisfy that definition. Acquirers and payment facilitators apply these standards in underwriting and during periodic reviews.
The global environment moved the same way. OECD pressure on beneficial ownership transparency and the push for effective enforcement encouraged registries and counterparties to demand better address integrity. The United Kingdom’s Companies House reforms are one visible example. The message is clear. If you claim to operate in a jurisdiction, you should be able to prove it.
Operational presence: what providers now expect
Stripe. Beginning July 1, 2025, U.S. accounts that use Issuing, Financial Accounts, or Opal must show a physical U.S. presence. Stripe screens business and representative addresses and will not accept registered agents, mailbox services, or virtual addresses for those capabilities. For Payments-only accounts, Stripe still verifies the business address. If you start with a CMRA or virtual address, you should expect a request for documents that match a non-CMRA operating address before verification is completed. The $500,000 lifetime processing rule for collecting the whole SSN or ITIN remains in effect for listed owners and representatives.
Mercury and Relay. Banks and fintech platforms such as Mercury only require a U.S. legal address. Still, Relayfi wants a real U.S. office, a lease agreement, a business utility bill, and your verified U.S. residential address. There are lots of other KYC steps, but this is the start.
Marketplaces. Amazon and similar platforms have tightened identity, address, and business verification. Accounts that show inconsistent geography across entity, identity, and address data are more likely to be flagged. Sellers are being pushed to align the location where they claim to operate with the location where they actually run the business.
Virtual address versus real operating address
A virtual mailbox or registered agent address still works for receiving mail and for many state filings. It rarely satisfies banking and payments KYC as the principal operating address. Providers now require documents that link the company name to a real location. Typical proofs include a commercial lease in the company name for a dedicated office or private coworking suite. Providers also ask for a business bank letter or statement, a business license, an insurance certificate, or a utility in the company name that shows the same address. For the account representative, a recent personal utility or bank statement at the individual’s real home address is standard.
This combination of documents is the fastest way to pass the first review with Stripe and with banking partners. It also reduces the risk of payout delays later when periodic reviews occur.
Stripe’s distinction in 2025: Payments versus stored value
Teams often miss an important detail. Stripe Payments can run without stored value features. Issuing, Financial Accounts, and Opal must now pass a physical presence test that excludes CMRA, virtual, and registered agent addresses. If you need embedded wallets, spend cards, or treasury-style features, plan on a real U.S. operating address for the business and for the account representative. If you only need to accept card payments, you still need to satisfy business address verification with documents that match a non-CMRA operating address. The $500,000 SSN or ITIN requirement applies in both situations.
Non-resident pathways that work
Route 1: U.S. LLC with a real office
Lease a non-CMRA office. A private office or a dedicated suite in a coworking facility can work if the lease is real and in the company name. Verify with the lease and one secondary business document such as a bank letter or statement, a business license, or an insurance certificate. This route aligns with the sponsor bank’s expectations and preserves eligibility for stored-value features later.
Route 2: Board as a non-U.S. entity with a global PSP
If you want to avoid a U.S. office, you can process cards through a global PSP using your home country entity and address. You will accept cross-border economics that include network cross-border fees and FX spreads. For some models, that is the right tradeoff.
Route 3: Use a Merchant of Record
An MoR sells in its own name, manages tax and KYC, and pays you net of a higher take rate. You trade margin and some control for faster eligibility and less underwriting burden.
How to pass KYC on the first try
Align your address story
Choose your lane before forming entities and onboarding providers. If you will operate in the United States, pick one operating address and use it consistently. The lease, bank profile, insurance, license, website footer, and invoices should all match. Consistency reduces mismatch flags across systems.
Build a complete document pack
Plan to upload a signed commercial lease or a compliant sublease in the company name and a secondary business document that shows the same address. A bank letter or statement is often the easiest secondary proof. A business license or an insurance certificate also works. For the account representative, provide government ID and a recent personal utility or bank statement at the real home address. Keep all documents recent and legible.
Plan for the $500,000 identity checkpoint.
When a U.S. Stripe account reaches $500,000 in lifetime processing volume, Stripe must collect the full SSN or ITIN for each listed party. Non-resident owners should establish a lawful ITIN path early to avoid interruptions from identity holds.
Expect re-verification
Address changes, ownership changes, and risk triggers can prompt new checks. Banks and platforms reserve the right to request additional documentation to meet compliance. Keep your files organized so you can respond quickly.
Tax and substance need to match your KYC story
KYC and tax substance now move together. If your business is managed outside the United States, a global PSP route may be better than a U.S. entity with only a mailbox. If you intend to build U.S. operations, put real substance in place. That includes a verifiable operating address and, where appropriate, people and functions. Align home country and U.S. tax teams. Make sure transfer pricing reflects where functions, assets, and risks reside. The KYC documentation, the permanent establishment analysis, and the transfer pricing file should tell the same story.
What’s coming in 2026
Regulators and providers are unlikely to loosen standards. Expect more automation and fewer exceptions.
Bank–fintech oversight will keep tightening. Sponsor banks are standardizing “principal place of business” proofs and ongoing reviews. You should plan for periodic re-verification of operating address, ownership, and website signals, not just one-time onboarding.
AML/CFT program modernization will become more operational. Institutions will map controls to risk more explicitly. Remote, non-resident setups will continue to draw higher scrutiny, particularly where entity, address, and activity are not aligned.
Card-network enforcement of merchant location will harden. Acquirers and PayFacs will push consistent “real address” documentation and will downrank or reject mail-drop and agent addresses on the first pass rather than after go-live.
Address screening will get more data-driven. Expect broader deny-lists of CMRA and registered-agent addresses, plus cross-checks against business licenses, insurance COIs, and bank records. If your documents do not match, reviews will stall.
Marketplaces will raise the bar on geographic consistency. If entity country, ID country, IP sign-ins, tax forms, and operating address do not line up, expect holds until you document where you truly operate.
Identity thresholds will stay in focus. The “full SSN or ITIN at $500,000 lifetime volume” checkpoint for U.S. accounts remains a predictable trigger. Non-residents should plan their ITIN timing well before reaching that level.
Global transparency will ripple into onboarding. UK registry reforms and OECD transparency pushes will continue to influence counterparties. If you claim U.S. operations, you will be expected to show substance that matches your KYC story and your tax story.
Practical takeaway for 2026. If you intend to operate in the U.S., secure a non-CMRA office and build a document pack that ties your company to that location. If you prefer not to build a U.S. footprint, board with a global PSP through your home-country entity and accept cross-border economics. Either way, keep your documents current and consistent across bank, payments, licensing, insurance, website, and invoices.
Frequently asked questions
Do virtual or CMRA addresses ever work for verification
They can work for mail and for some state filings. They are now commonly rejected or escalated during banking and payments verification. For Stripe Issuing, Financial Accounts, and Opal, they are ineligible as of July 1, 2025.
Can a home address be used
U.S. residents who operate from home can often use their home address if their business documents match it. Non-residents who form a U.S. LLC should plan on a leased or compliant subleased office in the company name.
Is this a tax issue or an AML issue
The primary drivers are AML and KYC rules, as well as card network location standards. Marketplaces and banks also prefer consistency across entities, addresses, and activities. That preference intersects with tax and permanent establishment analysis. Coordinate with your tax teams.
Executive takeaway
The reality in 2025 is simple. Show operational presence or expect friction. If you want U.S. banking and Stripe to run smoothly for a non-resident entity, use a verifiable non-CMRA operating address and keep your documents consistent. If you do not want a U.S. footprint, board outside the United States with a global PSP and accept the cross-border tradeoffs. In either case, plan early for the $500,000 SSN or ITIN checkpoint.
Work with us
Before you form a U.S. company, pressure test KYC and tax substance. Our U.S. Payments Readiness Diagnostic maps the correct lane, provides the document stack that passes on first review, lays out the ITIN timeline for the $500,000 trigger, and aligns permanent establishment and transfer pricing so finance and compliance are synchronized.
