U.S. KYC reality check in the United States will continue to tighten in 2026 across banks, card networks, and payment platforms. Providers now expect non-resident businesses to prove that they operate in the country in a real and verifiable way. If you relied on a virtual mailbox or a registered agent address to open accounts, you are now being asked for leases, utilities, bank letters, insurance certificates, and other documents that tie your company to an actual place of business.
For non-residents, that usually means maintaining three distinct U.S. addresses: a registered agent address for your U.S. company, a virtual address (CMRA) for mail forwarding, and a true operating address backed by a business utility bill and other proof. U.S. residents face a similar pattern. They can serve as their own registered agent (although it is rarely recommended), often add a virtual address for mail, and still need an operating address unless they are willing to use their home as the business address. All of this flows from stronger bank examinations, updated AML priorities, and stricter merchant location rules at the card networks.
Operational presence: what providers now expect
Stripe. As of July 1, 2025, U.S. accounts that use Issuing, Financial Accounts, or Opal must maintain a physical U.S. presence. Stripe screens business and representative addresses and will not accept registered agents, mailbox services, or virtual addresses for those capabilities. For Payments-only accounts, Stripe still verifies the business address. If you start with a CMRA or virtual address, you should expect a request for documents that match a non-CMRA operating address before verification is completed. The $500,000 lifetime processing rule for collecting the whole SSN or ITIN remains in effect for listed owners and representatives.
Mercury and Relay. Banks and fintech platforms such as Mercury only require a U.S. legal address. Still, Relayfi wants a real U.S. office, a lease agreement, a business utility bill, and your verified U.S. residential address. There are lots of other KYC steps, but this is the start.
Marketplaces. Amazon and similar platforms have tightened identity, address, and business verification. Accounts that show inconsistent geography across entity, identity, and address data are more likely to be flagged. Sellers are being pushed to align the location where they claim to operate with the location where they actually run the business.
Virtual address versus real operating address
A virtual mailbox or registered agent address still works for receiving mail and for many state filings. It rarely satisfies banking and payments KYC as the principal operating address. Providers now require documents that link the company name to a real location. Typical proofs include a commercial lease in the company name for a dedicated office or private coworking suite. Providers also ask for a business bank letter or statement, a business license, an insurance certificate, or a utility in the company name that shows the same address. For the account representative, a recent personal utility or bank statement at the individual’s real home address is standard.
This combination of documents is the fastest way to pass the first review with Stripe and with banking partners. It also reduces the risk of payout delays during periodic reviews.
Stripe’s distinction in 2026: Payments versus stored value
Teams often miss an important detail. Stripe Payments can run without stored value features. Issuing, Financial Accounts, and Opal must now pass a physical presence test that excludes CMRA, virtual, and registered agent addresses. If you need embedded wallets, spend cards, or treasury-style features, plan on a real U.S. operating address for the business and for the account representative. If you only need to accept card payments, you still need to satisfy business address verification with documents that match a non-CMRA operating address. The $500K SSN or ITIN requirement applies in both situations.
Non-resident pathways that work
Route 1: U.S. LLC with a real office
Lease a non-CMRA office. A private office or a dedicated suite in a coworking facility can work if the lease is real and in the company’s name. Verify with the lease and one secondary business document, such as a bank letter or statement, a business license, or an insurance certificate. This route aligns with the sponsor bank’s expectations and preserves eligibility for stored-value features in the future.
Route 2: Board as a non-U.S. entity with a global PSP
If you want to avoid a U.S. office, you can process cards through a global PSP using your home country entity and address. You will accept cross-border economics that include network cross-border fees and FX spreads. For some models, that is the right tradeoff.
Route 3: Use a Merchant of Record
An MoR sells in its own name, manages tax and KYC, and pays you net of a higher take rate. You trade margin and some control for faster eligibility and less underwriting burden.
How to pass KYC on the first try
Align your address story
Choose your lane before forming entities and onboarding providers. If you will operate in the United States, pick one operating address and use it consistently. The lease, bank profile, insurance, license, website footer, and invoices should all match. Consistency reduces mismatch flags across systems.
Build a complete document pack
Plan to upload a signed commercial lease or a compliant sublease in the company name and a secondary business document that shows the same address. A bank letter or statement is often the easiest secondary proof. A business license or an insurance certificate also works. For the account representative, provide government ID and a recent personal utility or bank statement at the real home address. Keep all documents recent and legible.
Plan for the $500K identity checkpoint.
When a U.S. Stripe account reaches $500K in lifetime processing volume, Stripe must collect the full SSN or ITIN for each listed party. Non-resident owners should establish a lawful ITIN path early to avoid interruptions from identity holds.
Expect re-verification
Address changes, ownership changes, and risk triggers can prompt new checks. Banks and platforms reserve the right to request additional documentation to meet compliance. Keep your files organized so you can respond quickly.
Tax and substance need to match your KYC story
KYC and tax substance now move together. If your business is managed outside the United States, a global PSP route may be better than a U.S. entity with only a mailbox. If you intend to build U.S. operations, put real substance in place. That includes a verifiable operating address and, where appropriate, people and functions. Align home country and U.S. tax teams. Make sure transfer pricing reflects where functions, assets, and risks reside. The KYC documentation, the permanent establishment analysis, and the transfer pricing file should tell the same story.
What changed in 2026 and why it matters
Between 2024 and 2025, regulators tightened the screws on bank and fintech partnerships, and by 2026, those changes are now baked into day-to-day onboarding. FinCEN’s proposed AML/CFT program rule pushed financial institutions to build risk assessments into the core of their programs and to demonstrate to examiners how they handle higher-risk profiles, such as non-resident owners and cross-border payment flows. Providers are now expected to verify where a business actually operates, not just where it is registered, and to reduce exceptions for remote setups with little real substance.
Card networks reinforced the shift. Visa and other networks require a merchant’s place of business to be a genuine operating location, and acquiring banks are on the hook if they look the other way. PO boxes, registered agent addresses, and generic mail forwarding services do not satisfy that standard, so acquirers and payment facilitators have pushed those rules into underwriting and periodic KYC reviews.
The global environment moved the same direction. OECD work on beneficial ownership transparency and tax transparency, combined with new identity verification and address integrity rules at registries such as the United Kingdom’s Companies House, has raised expectations for accurate ownership and real addresses. The message in 2026 is clear. If you claim to operate in a jurisdiction, you should be able to prove it with people, paper, and a physical footprint that matches your KYC story.
What to expect through late 2026 with your U.S. KYC reality check
Regulators and providers are not signaling any return to looser standards. The direction is more automation, more risk scoring, and fewer manual exceptions for edge cases.
Bank–fintech oversight will continue to tighten as recent enforcement actions and guidance sink in. Sponsor banks are formalizing their “principal place of business” tests and refreshing KYC more often, not less. You should assume periodic re-verification of operating address, ownership, and web presence, instead of one-time onboarding.
AML / CFT program modernization will move from rulemaking into operations. As institutions build formal risk assessments into their programs, non-resident and remote-only structures will remain in the higher-risk bucket, especially when entity, address, and transaction patterns are not aligned.
Card network enforcement of merchant location will continue to harden at the acquiring bank level. Acquirers and PayFacs will keep pushing for consistent “real address” documentation and will increasingly filter out obvious mail-drop and registered-agent addresses early in the underwriting process.
Address screening will become more data-driven. Expect broader internal deny lists for CMRA and agent addresses, plus automated cross-checks against business licenses, insurance certificates, corporate registries, and bank records. When those data points do not match, reviews will slow down or stall.
Marketplaces will keep raising the bar on geographic consistency. Suppose your entity country, ID country, IP logins, tax forms, and operating address tell different stories. In that case, you should expect additional holds or document requests until you prove where you actually operate.
Identity thresholds will remain a predictable trigger. For example, the “full SSN or ITIN at roughly $500,000 lifetime volume” checkpoint for many U.S. acquiring setups and platforms is not going away, so non-resident owners should plan their ITIN strategy well before hitting those levels.
Global transparency will continue to ripple into onboarding. UK registry reforms, OECD work on beneficial ownership and tax transparency, and similar initiatives put pressure on counterparties to demand clearer ownership and address evidence. If you claim U.S. operations, you will be expected to show substance that matches both your KYC story and your tax story.
Practical takeaway for 2026:
If you intend to operate in the U.S., plan on a non-CMRA operating address and a document pack that ties your company to that location (lease, utilities, insurance, licenses, bank statements). If you prefer not to build a U.S. footprint, board with a global PSP through your home-country entity and accept cross-border pricing. In either case, keep your data and documents current and consistent across banks, payment providers, marketplaces, licensing, insurance, website, and invoices.
Frequently asked questions
Do virtual or CMRA addresses ever work for verification?
They still work very well for mail and for many state-level filings. They can also appear as a secondary or mailing address on some profiles. Where they increasingly fail is as the primary KYC / operating address for serious banking and payment products. In 2026, you should assume CMRA and generic virtual addresses will be rejected or escalated for U.S. bank KYC and for higher-level Stripe products. Stripe Issuing, Financial Accounts, and Opal have been ineligible since the 2025 policy change, and that is not expected to roll back.
Can a home address be used?
For U.S. residents who actually operate from home, the home address can often serve as the operating address, as long as tax, banking, and platform documents match it. Many will still use a registered agent and a virtual address for privacy and mail, but the home remains the “real” place of business. Non-residents who form a U.S. LLC and want U.S. banking and processor access should plan on a leased or properly subleased non-CMRA office or private suite in the company name. If they are not willing to build that kind of presence, they are usually better off boarding as a foreign merchant through a global PSP instead of trying to force a U.S. domestic setup.
Is this a tax issue or an AML issue?
The primary drivers are AML/KYC regulations and card network merchant location rules. Banks, processors, and marketplaces must be able to show regulators and networks that they know who you are and where you actually operate. At the same time, those KYC and location choices intersect with tax, permanent establishment, and transfer pricing. If your KYC story says “U.S. business with U.S. place of business,” but your functions and management are offshore, you may create tax and PE questions you did not intend. Treat it as both: AML and KYC first, then coordinate with tax teams to make sure substance and tax position line up
Executive takeaway
The reality in 2026 is simple. Show operational presence or expect friction. If you want U.S. banking, Stripe, and marketplace accounts to run smoothly for a non-resident structure, you need a verifiable, non-CMRA operating address in the company name and a clean, consistent story across IRS, banks, processors, and platforms. If you do not want a U.S. footprint, board outside the United States with a global PSP through your home-country entity and accept the cross-border economics. In either case, build your three-address stack intentionally (registered agent, virtual for mail, real operating address), and plan early for identity checkpoints such as whole SSN or ITIN collection once you reach key processing thresholds.
Work with us
Before you form a U.S. company or apply for new banking and processor relationships, pressure test both KYC and tax substance.
Our U.S. Payments Readiness Diagnostic:
- Maps the lane that actually fits your situation (true U.S. presence versus cross-border).
- Identifies the address and document stack that will pass modern KYC on the first serious review.
- Lays out the SSN/ITIN timeline for the $500K identity trigger and related thresholds.
- Aligns your U.S. structure, permanent establishment analysis, and transfer pricing so finance, tax, and compliance are all working from the same playbook.
The goal is not just to open an account. The goal is to keep your accounts boring, low-risk, and fully aligned with how regulators, banks, and marketplaces will view you in 2026.
