7.1 Customer Identification Program (CIP) Under USA PATRIOT Act §326

Establishing the authentic identity of customers is the cornerstone of anti-money laundering (AML) and counter-terrorist financing (CTF) compliance. In digital banking, Banking-as-a-Service (BaaS), and financial technology platforms, onboarding occurs remotely within seconds, making rigorous adherence to statutory customer verification standards vital. Compliance professionals must understand the regulatory foundation of the Customer Identification Program, master the required identifying data elements, evaluate documentary and non-documentary verification mechanisms, and execute proper procedures when customer identity cannot be verified.

Regulatory Framework: USA PATRIOT Act §326 and 31 CFR § 1020.220

Following the terrorist attacks of September 11, 2001, the United States Congress enacted the USA PATRIOT Act to strengthen domestic security and enhance financial transparency. Section 326 of the Act amended the Bank Secrecy Act (BSA) by adding subsection (l) to 31 U.S.C. § 5318, directing federal financial regulators to issue joint regulations requiring financial institutions to establish a written Customer Identification Program (CIP).

For banking institutions, these statutory requirements are implemented under FinCEN regulations at 31 CFR § 1020.220 (with parallel rules for broker-dealers at 31 CFR § 1023.220, futures commission merchants at 31 CFR § 1026.220, and open-end mutual funds at 31 CFR § 1024.220). The regulation requires every covered institution to design, implement, and maintain a written CIP tailored to its size, operational structure, customer base, and risk profile. Crucially, the CIP must be formally incorporated into the institution's overall BSA/AML compliance program and receive explicit approval from the institution's board of directors or an authorized board committee.

Under 31 CFR § 1020.220, key statutory definitions dictate the scope of the program:

• Customer: A person (an individual, a corporation, partnership, trust, or estate) that opens a new account. The definition excludes persons who do not open an account, such as an individual cashing a third-party check or purchasing a cashier's check without an established deposit relationship. It also excludes regulated domestic financial institutions, publicly traded companies, and government entities.
• Account: A formal banking relationship established to provide or engage in services, dealings, or other financial transactions. This includes demand deposit accounts, savings accounts, loan relationships, credit lines, and trust services. It excludes products or services where a formal ongoing relationship is not established (e.g., occasional wire transfers conducted for walk-in non-account holders, though other BSA recordkeeping rules apply).

The Four Mandatory CIP Data Elements for Individuals

Prior to opening an account, a financial institution must collect, at a minimum, four core identifying data elements from an individual applicant:

1. Full Legal Name: The individual's official first name, middle name or initial, and surname. Nicknames, aliases, or screen handles are unacceptable for initial onboarding.
2. Date of Birth (DOB): Required for natural persons to confirm legal age capacity and establish a baseline for biographical database screening.
3. Physical Address: The applicant's physical location:
   • For an individual: A residential or business street address.
   • For an individual who does not have a physical address (such as a homeless person or transient migrant): An Army Post Office (APO) or Fleet Post Office (FPO) box number, or the residential or business street address of next of kin or another contact individual.
   • The P.O. Box Prohibition: A Post Office Box (P.O. Box) is strictly prohibited as the sole address provided. Commercial Mail Receiving Agencies (CMRAs), private postal drop boxes, virtual offices, or mail forwarding suites cannot substitute for a verified residential or business street address unless one of the narrow regulatory alternatives applies.
4. Government Identification Number:
   • For a U.S. Person: A Taxpayer Identification Number (TIN), which is an individual's Social Security Number (SSN) or an Individual Taxpayer Identification Number (ITIN) issued by the Internal Revenue Service.
   • For a Non-U.S. Person: One or more of the following: a taxpayer identification number; a passport number and country of issuance; an alien identification card number; or the number and country of issuance of any other unexpired government-issued document evidencing nationality or residence and bearing a photograph or similar safeguard.
   • Pending TIN Exception: A bank's written CIP may establish procedures permitting an account to be opened for a customer who has applied for, but not yet received, a TIN. The bank must confirm that the application was filed before opening the account and obtain the TIN within a reasonable operational timeframe.

Verification Methodologies: Documentary vs. Non-Documentary Standards

Collecting the four core data elements is only the first step. The institution's CIP must contain risk-based procedures enabling the bank to form a reasonable belief that it knows the true identity of each customer within a reasonable time before or after account opening.

Documentary Verification

Documentary verification relies on physical, unexpired government-issued identity documents. Under 31 CFR § 1020.220(a)(2)(ii)(A), acceptable documents for individuals include:

• State-issued driver's licenses or state identification cards.
• Unexpired U.S. or foreign passports.
• U.S. military identification cards.
• Permanent resident cards (green cards) or unexpired alien registration cards.

In traditional banking, physical documents are reviewed face-to-face. Compliance personnel examine physical security features, including intaglio printing, optical variable inks, microprinting, ultraviolet (UV) fluorescent threads, and laminate holograms. In digital onboarding, FinTech platforms utilize mobile document capture engines that inspect digital images through optical character recognition (OCR) and document forensic algorithms. However, because digital document images can be manipulated or generated through synthetic templates, digital platforms cannot rely solely on documentary inspection.

Non-Documentary Verification

Non-documentary verification relies on independent electronic data sources and verification workflows. Under 31 CFR § 1020.220(a)(2)(ii)(B), non-documentary methods are not merely optional alternatives—they are mandatory under specific operational conditions:

• When an individual customer is unable to present an unexpired document bearing a photograph.
• When the institution is unfamiliar with the documents presented (such as foreign identity credentials).
• When the account is opened without in-person physical contact (the standard operating model across all FinTech neobanks and digital lenders).
• When the bank encounters circumstances that heighten the risk that it will be unable to verify the customer's true identity through documents alone.

Key non-documentary verification methods include:

• Consumer Reporting Agency Verification: Querying major national credit bureaus (Equifax, Experian, TransUnion) to confirm that the submitted name, SSN, DOB, and address have an established historical credit footprint.
• Independent Public and Proprietary Databases: Matching application details against LexisNexis, ChexSystems, Early Warning Services, or public utility records.
• Out-of-Band Direct Contact: Contacting the applicant directly via postal mail containing an activation code, or initiating automated one-time password (OTP) verification to a verified mobile device registered in the applicant's name.
• Financial Institution Reference Verification: Checking references with other depository institutions where the customer maintains verified accounts.

Comparative Analysis: Documentary vs. Non-Documentary CIP Verification

The following table compares the operational, technical, and regulatory dimensions of documentary and non-documentary verification:

Discrepancy Resolution and Edge Cases

A compliant CIP must establish rigorous written procedures for identifying and resolving discrepancies between data submitted by the customer and information retrieved from independent databases or documents:

1. Name Variations and Nicknames: Applicants may submit an informal name (e.g., "Bob Smith" instead of "Robert Smith"), hyphenated matrimonial names, or cultural naming conventions with multiple surnames. Automated eIDV systems must apply fuzzy logic algorithms to evaluate name similarity while requiring documentary evidence (such as a marriage certificate, court order, or updated driver's license) if legal name continuity is disputed.
2. Address Inconsistencies: When an applicant's stated residential address differs from credit bureau files (common among recent movers, university students, or active military personnel), the institution must require secondary non-documentary proof of address, such as a recent utility bill, municipal tax assessment, or residential lease agreement (many policies require a document dated within, for example, the last three months).
3. Identification Number Anomalies: Mismatches between the customer's name, DOB, and SSN indicate severe financial crime risk, including identity theft, synthetic identity creation, or mistyped digits. The institution must halt automated onboarding and route the application to specialized compliance staff for step-up verification.

Account Opening Restrictions, Closure Procedures, and SAR Triggers

Federal CIP regulations recognize that an institution may not always be able to verify a customer's identity immediately upon application. Under 31 CFR § 1020.220(a)(2)(iii), the bank's written program must explicitly dictate:

• Circumstances for Refusing Account Opening: Conditions under which the bank will not open an account (e.g., refusal to provide the mandatory four elements, presentation of an altered foreign passport, or failure to pass OFAC screening).
• Restricted Terms of Account Use: The specific terms under which a customer may conduct transactions while identity verification is pending. Best-practice FinTech compliance frameworks implement strict controls: prohibiting outbound international wire transfers, capping daily debit card transactions at $250, placing 5-business-day holds on incoming ACH or check deposits, and disabling peer-to-peer (P2P) push payments.
• Mandatory Account Closure Thresholds: A defined operational timeframe (typically 15 to 30 calendar days) after which the account must be closed if the customer fails to resolve outstanding identity discrepancies.
• Suspicious Activity Report (SAR) Filing Determination: The compliance department must evaluate whether the circumstances surrounding the unverified identity warrant filing a SAR under 31 CFR § 1020.320. A SAR is mandatory if the institution knows, suspects, or has reason to suspect that the applicant provided fraudulent documents, utilized a stolen Social Security Number, attempted to evade BSA reporting, or engaged in criminal identity impersonation.

Recordkeeping Mandates: The Dual Five-Year Rules

The CIP rule enforces strict recordkeeping requirements under 31 CFR § 1020.220(a)(3). Candidates frequently confuse the distinct retention schedules governing different categories of CIP data:

1. Identifying Information (The Core Four Elements): The institution must retain the customer's full legal name, date of birth, physical address, and identification number for at least five years after the date the account is closed (or five years after a credit card account becomes dormant and is formally written off).
2. Verification Records and Discrepancy Notes: The institution must retain records of the verification process—including a description of any document inspected, the methods and results of any non-documentary measures, and the resolution of any substantive discrepancies—for at least five years after the record is made.

This structural separation ensures that law enforcement can reconstruct a customer's identifying profile years after an account relationship terminates, while preserving contemporaneous audit trails of verification decisions made during onboarding.

Realistic Exam Scenario

A 26-year-old applicant applies for a digital checking account through a mobile neobank partnered with a chartered depository institution. The applicant submits their full legal name, date of birth, a valid SSN, and a physical mailing address that lists a commercial suite number at a private packaging and shipping store (a Commercial Mail Receiving Agency, or CMRA). The platform's automated eIDV engine verifies the SSN and date of birth against a national credit bureau, but flags the address as a commercial drop facility.

The neobank requests proof of residential address. The applicant uploads an electric utility bill displaying the applicant's name and a residential apartment address in an adjacent municipality. However, forensic image analysis indicates that the utility bill's font kerning and account balance barcode have been digitally spliced. The applicant also submits an image of an unexpired state driver's license displaying a photograph with noticeable edge blurring and a format inconsistency in the state DMV seal.

Compliance Analysis:

1. The applicant did not provide a residential or business street address as 31 CFR § 1020.220 requires; a commercial mail drop does not meet that requirement, and the APO/FPO and contact-address alternatives do not apply.
2. The secondary proof of address and documentary photo identification exhibit definitive indicators of digital forgery and image manipulation.
3. In accordance with the bank's written CIP, the compliance officer must immediately terminate onboarding or execute an administrative freeze on the pending account, document the failed verification, and refer the case for a SAR decision. An attempted account opening with forged documents can be reportable, and if a SAR is filed it is due within 30 days of initial detection.

Common Exam Traps

• Trap 1: Accepting a P.O. Box as a Primary Address: Believing that a customer can provide a Post Office Box as their primary address if accompanied by a utility bill. A P.O. Box is strictly impermissible under federal CIP rules unless the customer is an active military service member utilizing an APO/FPO box or lacks a physical residence (homeless exception) and provides a contact address.
• Trap 2: Conflating the Dual 5-Year Recordkeeping Rules: Assuming that all CIP records must be kept for five years after account closure. The four identifying elements must be maintained for five years post-closure, but verification documentation, credit bureau query logs, and discrepancy resolution notes must be kept for five years after the record is made.
• Trap 3: Believing Verification Must Always Precede Account Opening: Assuming that an account can never be opened before identity verification is 100% complete. CIP regulations explicitly permit institutions to open accounts and allow restricted usage while verification is underway, provided the written program enforces tight velocity and withdrawal caps.
• Trap 4: Treating Walk-In Non-Account Transactions as CIP Accounts: Assuming that an individual cashing a payroll check or purchasing a $500 cashier's check is opening an "account" subject to full CIP. While other BSA recordkeeping thresholds apply (such as the Monetary Instrument Rule at 31 CFR § 1010.415 for transactions between $3,000 and $10,000), single walk-in transactions do not establish a formal ongoing account relationship under 31 CFR § 1020.220.