8.2 Customer Identification, Due Diligence, and Beneficial Ownership
Key Takeaways
A broker-dealer CIP obtains the required identifying information before account opening and verifies identity within a reasonable time before or after opening.
CIP procedures address documentary and non-documentary verification, inability to verify, government-list checks, customer notice, and records.
Risk-based CDD seeks to understand the nature and purpose of the relationship, develop a customer risk profile, monitor activity, and update information on a risk basis.
For covered legal-entity customers, the beneficial-ownership rule generally identifies each 25% equity owner and one control person, subject to definitions and exclusions.
Customer Identification Program
A broker-dealer's written Customer Identification Program (CIP) is part of its AML program. Before opening an account, the firm generally obtains an individual's name, date of birth, residential or business street address, and identification number. Rules provide alternatives for a person without a conventional street address and for non-U.S. persons, so procedures should use the actual regulatory options rather than accept an unexplained post-office box.
The firm verifies identity within a reasonable time before or after account opening using documentary methods, non-documentary methods, or both. Documentary evidence may include an unexpired government identification showing nationality or residence and a photograph or similar safeguard. Non-documentary methods can include database checks, contact with the customer, references from another institution and comparison of information from independent sources.
Required Procedures and Records
CIP must describe when enhanced verification is required, how the firm handles an inability to verify, whether and when an account may operate pending verification, when it will close or restrict an account, and when it will file a SAR. It also addresses comparison with applicable government lists and provides customers adequate notice that identity information is being requested.
The firm retains the identifying information for five years after the account is closed. A description of verification documents and methods, results of substantive discrepancies, and resolution generally is retained for five years after the record is made. Retention clocks differ, so a system should not delete the whole CIP file based on one date.
Customer Due Diligence
Risk-based CDD has four practical objectives:
- identify and verify the customer;
- identify and verify beneficial owners of covered legal-entity customers;
- understand the nature and purpose of the relationship to develop a risk profile; and
- conduct ongoing monitoring to identify and report suspicious transactions and, on a risk basis, maintain and update customer information.
Updating is event and risk driven, not a requirement to refresh every customer on one universal schedule. New ownership, unexplained activity, changed occupation, new geography, sanctions risk or inconsistent source of funds can trigger review.
Legal Entities and Beneficial Owners
For a covered legal-entity customer, the ownership prong generally reaches each individual who directly or indirectly owns 25% or more of the entity's equity interests, while the control prong identifies one individual with significant responsibility to control, manage or direct the entity. The number identified under the ownership prong can range from zero to four; the control person is still identified. Definitions, exemptions and reliance provisions matter, so the firm should not apply the shorthand to an excluded entity without checking the rule.
| Situation | Principal's focus |
|---|---|
| Complex entity chain | Trace natural-person ownership and document calculations |
| Trust or nominee | Determine the actual customer and applicable rule treatment rather than assume the nominee is the owner |
| Inconsistent documents | Resolve before treating verification as complete |
| Ownership change | Apply risk-based updating and monitoring procedures |
| Refusal to identify owners | Follow restriction, closure and SAR escalation procedures |
Reliance and Escalation
The broker-dealer remains responsible for a reasonable program even when an intermediary, transfer agent or clearing firm performs steps. The CIP rule allows reliance on another financial institution, such as a clearing firm, only if the reliance is reasonable under the circumstances, the other institution is itself subject to an AML program rule and regulated by a federal functional regulator, and it contracts to certify annually that it has implemented its AML program and will perform the specified CIP steps. Ordinary outsourcing is not the same as regulatory reliance.
The principal should review accounts opened with overrides, unresolved taxpayer-identification discrepancies, shared addresses, improbable ages, shell-company indicators and verification completed only after significant activity. A customer who passes identity verification can still present high AML risk; CIP success never ends CDD.
Account-Opening Decisions
Procedures should state who may approve an account before verification is complete and what functions are restricted. A customer may be allowed to fund while withdrawals or trading remain limited, depending on risk and policy. If identity cannot be verified, the firm decides whether to refuse or close the account and whether the circumstances support a SAR.
For omnibus or intermediary relationships, the firm identifies the legal customer and evaluates the intermediary's regulation, AML program, ownership, services and underlying-customer access. Treating every intermediary as low risk can obscure who controls funds and instructions.
Discrepancies should be resolved rather than merely noted. A name, address or ownership mismatch can be innocent, but repeated unexplained differences across documents, bank instructions and public records may change the customer's risk rating and monitoring.
How long is core customer identifying information generally retained under the broker-dealer CIP rule?
Only until identity is first verified.
Five years after the account is closed.
Permanently for every rejected applicant.
Three years after each trade.
A covered legal entity has no individual who owns 25% or more. Does beneficial-owner identification necessarily end there?
Yes. The control prong applies only when there is also a 25% owner.
No. The firm must identify exactly four owners regardless of ownership.
No. The firm still generally identifies one control person under the control prong.
Yes. Legal entities without a 25% owner are exempt from all CDD.
Sections you finish are checked off in the contents.