What Companies Can Actually Legally Demand From You

There is a question almost nobody asks when a company requests a document: is this actually required, or is it just what the form says?

The assumption is that if an institution asks, the law made them ask. Sometimes that is true. Very often it is not, and the more interesting discovery is that when the law does step in, it usually steps in on the side of collecting less. The federal rules governing banks, employers, and even court filings are full of language about minimums, choices, and descriptions rather than copies. Most people never hear about any of it.

This is not legal advice and it is not a script for being difficult. It is the context that makes you a better judge of a request.

The federal courts already made redaction the default

Start with the clearest case, because it reframes everything else.

If you file a document in federal civil court, Federal Rule of Civil Procedure 5.2(a) says that when a filing contains an individual's Social Security number, taxpayer identification number, or birth date, the name of a known minor, or a financial account number, the filer "may include only" the last four digits of the SSN or TIN, the year of birth, the minor's initials, and the last four digits of the account number.

Read that again. In the venue with the strongest possible claim to needing complete information, the rule is partial disclosure. Not full numbers with a promise to protect them. The last four digits, the birth year, the initials.

The federal judiciary decided the useful part of an identifier can be separated from the dangerous part. That is precisely the argument for redacting a document before you email it to a landlord, and it comes from the least privacy-radical institution imaginable.

Your bank needs four things, and a photocopy is not one of them

Banks are the source of the most common "we are required to" claim. Under the Customer Identification Program rule at 31 CFR 1020.220, a bank must obtain, at a minimum, before opening an account: your name, your date of birth, your address, and an identification number, which for a US person is a taxpayer identification number.

Four data points. Then the bank has to verify that you are who you say you are, and here the rule is deliberately flexible. It permits verification "through documents" or "through non-documentary methods," and the non-documentary options include comparing what you provided against information from a consumer reporting agency or public database, checking references with other financial institutions, or obtaining a financial statement.

Now the part that surprises people. The recordkeeping requirement asks the bank to keep "a description of any document that was relied on," noting the type of document, any identification number it contains, the place of issuance, and the issuance and expiration dates. A description. Not the document.

This was a conscious decision. When Treasury and the banking agencies finalized the rule in 2003, the preamble states that in response to comments the final rule "no longer requires a bank to keep copies of documents used to verify a customer's identity." The proposed version had that requirement. The final version removed it.

So when an institution says it must keep a copy of your license on file, that is very likely its own policy, not the federal rule. Which is a legitimate choice a business can make. It is just not the immovable legal object it gets presented as. And the retention side matters: the CIP rule requires the bank to hold your identifying information for five years after the account closes.

Your employer cannot pick your documents

Form I-9 is where this gets sharpest, because there is an actual enforcement agency.

USCIS guidance for employers is unambiguous: "You must allow the employee to choose which documentation they will present from the Form I-9 Lists of Acceptable Documents," and "You cannot specify which documentation an employee will present." The choice belongs to the worker. An employer who demands more or different documents than required, or insists on particular ones, may be committing an unfair documentary practice under 8 U.S.C. 1324b(a)(6). The Justice Department's Immigrant and Employee Rights Section enforces it and states plainly that employers "are not allowed to demand more or different documents than necessary, request specific documents, or reject reasonably genuine-looking documents."

Copying those documents is optional too. The regulation at 8 CFR 274a.2 says an employer "may, but is not required to," copy or make an electronic image of a document an individual presents. And when a copy is made, the I-9 file has a long life: three years after the date of hire, or one year after employment ends, whichever is later.

The pattern, and what to do with it

Three different bodies of law, one shape. The court says include only the last four. The bank rule says obtain four data elements and keep a description. The employment rule says the worker chooses and the copy is optional. Nobody drafting these rules believed that maximum collection equals maximum safety.

The gap is that the institution's incentive runs the other way. Collecting everything is cheaper than deciding what is necessary, and the cost of holding it shows up years later in a breach notice with someone else's name on the letterhead. Retention periods are the tell. A file you send today is a file that can leak in five years.

So the practical move is not to argue about the law. It is to make the document you send match the decision being made.

• Name the decision. A landlord is checking whether you can pay rent. A lender is verifying income and identity. A new employer is confirming authorization to work.
• Keep what proves it. Your name, the institution or employer name, the dates, the figures.
• Remove what does not. Full account and routing numbers, government identifier numbers, unrelated transactions, dependents, itemized deductions.
• Ask about retention when it is a document you cannot easily replace, like a passport or a Social Security card.
• Redact permanently. A black shape drawn in an image editor or a PDF viewer often lifts right off, and a real redaction flattens the file so the data underneath is gone rather than covered.

That last point is where most good intentions fail. If you can still select the text under the box, you have made a decoration, not a redaction.

RedactID runs entirely in your browser. Your file never gets uploaded and never gets stored on a server, because the redaction happens on your own device, which is the only arrangement where our promise costs you nothing to believe. Start with the bank statement redactor, the pay stub redactor, or the ID redactor.

The institutions asking for your documents operate under rules built around collecting the minimum. You are allowed to send the minimum too.

Related: redact documents online, redact mortgage documents, redact an ID for a loan application.

Free redactions every day, no account required. See pricing if you need more volume.