Can I open a bank account without SSN or ITIN? Yes, and the file says the block is somewhere else

I opened the federal complaint file expecting to find people who had been refused an account. Two years of it, every complaint mentioning an ITIN, 163 of them between July 2024 and July 2026. Ten are about opening an account. Six per cent of the record. I had built most of a piece around that six per cent, and the thing that actually fills the file is something I had barely mentioned, so I had it wrong and this is the corrected version.

Eighty two of those 163 sit in credit reporting, which is 50.3 per cent of a file about a number most people think of as a banking problem. The hard part is not getting in. It is what the system does with you for the ten years afterwards, and never once in four drafts did I put that first.

What the rule says, which is shorter than its reputation

Can I open a bank account without SSN or ITIN. Yes, usually, and the regulation is one paragraph long. Do not take the first refusal as a statement of law, and never pay anybody 300 dollars to tell you what 31 CFR 1020.220 says for free.

It is 31 CFR 1020.220, the customer identification programme. A bank collects the name, the date of birth, the address and an identification number, and that is the entire list. You should read the fourth item yourself rather than take my word for it, because it is where everybody stops. For a United States person it is a taxpayer identification number and there is no alternative. For everybody else the rule lists four:

"For a non-U.S. person, one or more of the following: A taxpayer identification number; passport number and country of issuance; alien identification card number; or number and country of issuance of any other government-issued document evidencing nationality or residence and bearing a photograph or similar safeguard."

A passport is on that list by name, not as a fallback and not as an exception. Always get the stated reason for a refusal in writing, because the wording is the only thing that tells you whether you hit the regulation or the software. I have read that sentence perhaps thirty times now and I still find it strange that it is not the first thing on every provider's page, because it answers the question that sends most people away before they start.

The same regulation tells you what the bank has to write down afterwards, which is the fastest way to work out what to send. The record must describe "the type of document, any identification number contained in the document, the place of issuance and, if any, the date of issuance and expiration date". Four fields. A scan that shows all four in one frame does the job, and a photograph of a passport with a thumb across the expiry date does not, which sounds obvious and was the cause of one of the two rejections I have watched from close range.

The exception nobody quotes

There is a second paragraph that I think is more useful than the first, and I have never seen it in a guide.

A bank may open an account for somebody who has applied for a taxpayer identification number and not received it yet. The rule requires the bank to confirm the application was filed before the account opens and to obtain the number within a reasonable period afterwards. Two conditions, no form, no fee. That is the whole mechanism.

So the seven week wait for an ITIN is not necessarily a seven week wait for an account. The IRS says to allow seven weeks to hear about a W-7, and nine to eleven weeks if you apply during the season that runs from the fifteenth of January to the thirtieth of April, or if you apply from outside the country. Both conditions describe most foreign founders, and they stack rather than compete.

The arithmetic is mine and it is simple enough to check. Seven weeks is 49 days. Eleven weeks is 77. The declared season covers 106 days, so 29 per cent of the calendar sits inside the slower window before you add the overseas condition that applies to you all year anyway. Somebody filing from Lisbon in February is looking at eleven weeks, and eleven weeks is a quarter of a year in which the company exists on paper and cannot take money.

The regulation does not make anybody use that exception, it only permits it, and the difference matters. Whether a given bank has written it into its own programme is a question you can ask, and the phrase to ask it with is whether their CIP includes procedures for a customer who has applied for but not received a taxpayer identification number. I have asked it twice in writing. One answer came back in four days and said yes. The other has not come back at all, and it has now been three weeks, which I am recording because two data points and one silence is not evidence of anything and it is still more than I could find published.

Then the second layer, which is about people not paper

Sitting on top is 31 CFR 1010.230. The bank identifies every individual who owns twenty five per cent or more of the entity, plus one person who exercises significant control over it.

Two members at fifty per cent each produces two identity files. Four at twenty five produces four, and a company with four foreign members is collecting sixteen fields of identity data before anybody looks at the money. Five people at twenty per cent each produces, on the ownership prong, nobody at all, and only the control person gets collected. That reads like a loophole and it is not one, because the control prong is not optional and somebody always has to be named in it.

For each of those people the bank is collecting the same four items, which means the passport route applies to them too. This is the part where a company with members in three countries turns into a paperwork exercise rather than a legal problem. Nothing here forbids the account. It takes longer than anybody plans for, and the two weeks people budget is closer to six once a document has to travel between three time zones and come back with a correction.

What the bank does when you are not standing in front of it

The rule also requires every programme to have non-documentary procedures, and it names the situations they must cover. One of them is a customer who "opens the account without appearing in person at the bank". Another is where the bank "is not familiar with the documents presented".

That second one is doing quiet damage. A Portuguese identity card and a Nigerian passport are both on the right side of the regulation, and neither is on the right side of an onboarding tool trained mostly on North American documents. I have watched this happen with a Portuguese card that was accepted by one provider in eleven minutes and rejected by another after four days of silence, same document, same person, same month, and the only difference I could see from outside was that the first one asked for a second document and the second one never asked for anything at all. The refusal that comes back does not say we could not read your document. It says we are unable to verify your identity, and those two sentences mean very different things to the person receiving them.

If you take one habit from this piece, take that one, and do it before you apply anywhere else. A refusal is a statement about that company's tooling and risk appetite, not about the law. Two providers can read the same paragraph and land in opposite places, and neither is misapplying anything. Treating the first no as the answer to the general question is the specific error this piece exists to prevent.

What the file actually contains

Now the part I got wrong. Here is where 163 complaints mentioning an ITIN landed by product.

Credit reporting takes 82 of them, which is 50.3 per cent. Checking or savings takes 37, or 22.7 per cent. Credit cards take 23, money transfer 8, debt collection 5, vehicle loans 4, mortgages 2. By issue the largest single category is incorrect information on a report, at 35, followed by being unable to get a report or a score at all, at 21, and problems with a company's investigation into something the person had already disputed, at 17. Opening an account sits at 10.

The company list follows the same shape. TransUnion 24, Experian 22, Capital One 21, Equifax 20, then Bank of America at 13 and Chase at 11. Three of the top four are credit bureaus, holding 66 of the 163 between them, in a file about a number people think of as a banking problem.

Geography clusters harder than I expected. California 24, Florida 20, Texas 15, New Jersey 13, New York 12, Washington 9. Delaware appears seven times against a population near 1.05 million, which works out at more complaints per head than California with 24 against 39 million, and is presumably about where the companies are rather than where the people live.

A short digression, because it changed how I read the rest. Somebody using an ITIN is often invisible to a credit file for years and then becomes visible all at once, wrongly, when a record attaches to the number that belongs to somebody else. Twenty one people out of 163 could not get a report at all, which is one in eight. That is not a dispute about a balance. That is a dispute about whether you exist. Anyway, back to the accounts.

The outcome column, which nobody prints

Of the 163, one hundred and thirty eight were closed with an explanation, twenty three were closed with non-monetary relief, and two were closed with monetary relief.

Two out of 163 across two years, which is 1.2 per cent.

I do not want to over-read that. Most of these complaints are about a record being wrong rather than about money going missing, and non-monetary relief is exactly the right outcome for a corrected file. But the ratio is worth holding next to the effort involved, and the honest reading is that the complaint route fixes records reasonably often and returns cash almost never. Plan the paperwork so you do not need it.

What I could not establish

I do not know how many banks have actually written the applied-for exception into their programmes. It is not published anywhere, it would not be published, and the only way to find out is to ask each one and count the answers. My guess is that the large institutions all have it and use it rarely, because it creates an open item somebody has to chase, and that is a guess with nothing behind it except how compliance teams treat open items.

I went looking for the same complaint file broken out by whether the person was a resident, because the whole question turns on that, and the field does not exist. The CFPB record has a state, a product and an issue. It does not have nationality or residency status, so every number in the section above includes United States residents who use an ITIN, and I cannot separate them from foreign founders. That limits what the 163 can prove and I would rather say so than build a chart that pretends otherwise.

I also cannot tell you which providers read the passport route generously, because the answer changes with their appetite that quarter and any list I published would be wrong by winter.

The bit I keep going back to

The rule fits in a paragraph. The identification list has four entries. The exception for a pending application runs to two sentences and takes about a minute to read, against the 49 to 77 days it can save.

None of it is hidden. It sits on a public site, it is free, it has been there for years, and it is still normal to be told flatly that you need a Social Security number by somebody who has never been given a reason to know otherwise. I have started keeping the paragraph in a note on my phone so I can paste it into a chat window, which is a slightly absurd thing to be doing in 2026, and it has worked twice.