October 14, 2026 · Muhammad Umar · More by Muhammad Umar
Stripe Connect Can Now Defer Bank Details Under Stripe-Run KYC
A March 2026 Stripe API change lets Connect platforms skip bank-detail collection even when Stripe runs KYC — with one authentication catch.
Who This Actually Affects
Stripe's Connect embedded components let a platform drop its own onboarding UI in favor of Stripe's, via the Account onboarding and Account management components. One restriction had been baked in from the start: if Stripe itself was responsible for collecting a connected account's KYC requirements (controller.requirement_collection set to stripe, not application), the Account onboarding component always forced collection of external account (bank) details. A platform in that configuration couldn't defer that step, no matter how it wanted the onboarding flow to look.
A March 2026 change, shipped under API version 2026-03-25.dahlia, relaxes that. Per Stripe's changelog, Connect embedded components can now skip collecting external account information even when Stripe is responsible for collecting requirements, as long as Stripe user authentication is still enabled. Previously, "Connect embedded components always required external account information when Stripe was responsible for collecting requirements, regardless of whether Stripe authentication was enabled."
Two Toggles, One Hard Dependency
When creating an Account Session, a platform sets two features on the Account onboarding component: external_account_collection and disable_stripe_user_authentication. The default for external_account_collection hasn't moved — it's still true, meaning bank details get collected unless a platform explicitly turns the feature off.
What's new is that setting external_account_collection to false is now possible for Stripe-responsible accounts too, but only if disable_stripe_user_authentication is also set to false in the same request. A platform can't use this change to also drop Stripe's authentication step — the two toggles move together in that specific direction, and only in that direction.
Authentication Still Isn't Optional
That constraint isn't incidental — it's the floor the whole change sits on. Stripe's documentation is explicit that disable_stripe_user_authentication "can only be true for accounts where controller.requirement_collection is application." For platforms that let Stripe handle requirement collection, which is the exact configuration this change targets, Stripe's own authentication step stays mandatory no matter how external_account_collection is set. Stripe also documents, precisely as stated, that when controller.requirement_collection is stripe, both values default to false — worth noting as written rather than reconciled against the more general "enabled by default" framing elsewhere in the same docs.
It's also worth being clear about what this change doesn't touch. These are collection-timing controls inside Connect's embedded components, not a reduction in what Stripe ultimately requires before it enables payouts. An account still has to satisfy every KYC requirement Stripe asks for; this change only affects when, through the embedded UI, Stripe asks for bank details specifically — and only for platforms that already hand Stripe the keys to requirement collection in the first place.