CIP requirements for existing customers when account ownership changes

The CIP requirements for existing customers are narrower than most procedures assume: the rule excludes "a person that has an existing account with the bank, provided that the bank has a reasonable belief that it knows the true identity of the person," and nothing more. A person who becomes co-owner of an existing deposit account is not covered by that exclusion for the new relationship. The interagency guidance says so directly: such a person "is a 'customer' subject to the CIP rule because that person is establishing a new account relationship with the bank." For deposit operations, that turns an ownership change from a form update into an account opening for the person being added, with identification, verification, list screening and records. Botminds' Account Maintenance Requests is account maintenance request software that treats ownership changes that way: agents identify who is new, check authority and takeover signals, and two specialists sign before the core banking system changes.

This guide is for the BSA officer who owns the customer identification program, the deposit operations manager who runs the desk and the tester who samples its files. Rule text is quoted from the eCFR and FinCEN as of November 2026; the worked examples use a fictional sample bank and customers.

What are the CIP requirements for existing customers?

There are none for an existing customer the bank already knows, and full requirements for anyone else. The rule defines a customer as "A person that opens a new account," and excludes a person with an existing account at the bank only where the bank "has a reasonable belief that it knows the true identity of the person" (31 CFR 1020.100(b)). The exclusion is a condition, not a status: it lasts only while the belief is reasonable.

The guidance shows how a bank demonstrates that belief for long-standing customers: "an active and longstanding relationship with a particular person, evidenced by such things as a history of account statements sent to the person, information sent to the IRS about the person's accounts without issue, loans made and repaid, or other services performed for the person over a period of time." It adds that this alternative "may not suffice for persons that the bank has deemed to be high risk." A file that relies on the exclusion should say which evidence the bank relied on.

Two limits catch procedures out. The exclusion applies only to a person who "currently" has an account at the time the new one is opened, so a customer whose last account closed twelve months ago is new again. And it is per bank: an account at an affiliate does not qualify, though the bank may be able to rely on the affiliate to perform parts of its program (interagency CIP guidance).

When does an ownership change create a new customer?

Whenever someone becomes an owner who was not one before. Adding a joint owner creates a new customer for the added person; the existing owner, already known, does not need to be re-identified. Removing an owner creates no new customer but ends rights the departing owner held. Retitling into a trust brings in a new customer, the trust, and the guidance notes the bank may need information about the settlor, trustee or others with authority over the account to establish who the customer truly is.

Renewals point the other way. A CD rollover or loan renewal is a new account in the rule's terms, but the parties are existing customers, so the bank "need not perform its CIP when a loan is renewed or certificate of deposit is rolled over." The guidance closes the gap in the same breath: "if a new customer is added to the loan or deposit account, the bank would need to satisfy the CIP rule with respect to that new account relationship."

Business accounts follow a different rule for a different reason. When a company's shares change hands, the account owner, the company, does not change; its beneficial owners do. FinCEN's customer due diligence guidance says that where the update is a change of beneficial ownership, "the new beneficial owner's identity would need to be collected, certified, and verified" (FinCEN CDD Rule FAQs, updated May 6, 2026). Since February 13, 2026 an exceptive relief order lets banks stop re-collecting beneficial ownership at each new account, but it keeps the duty when the bank has facts that call the information it holds into question. Whether beneficial ownership is still required at the bank sets out the 2025–26 changes.

What the bank must do for the person being added

Everything it would do at an opening. The program must contain "risk-based procedures for verifying the identity of each customer to the extent reasonable and practicable," enough to form "a reasonable belief that it knows the true identity of each customer" (31 CFR 1020.220(a)(2)). For the added owner that means the four identifying items, verification within a reasonable time, a check against the government lists, notice, and records kept for the periods the rule sets.

The lack-of-verification procedures matter more at a maintenance desk than at a branch opening. When an added owner cannot be verified, the account already exists and already holds money. The program should say whether the change waits until verification is complete, which is the safer default, or whether the person may be added with limits while the bank keeps trying, and what reverses the change if verification fails.

What else an ownership change moves: insurance and inheritance

The identification rule is one of three things an ownership change touches. The FDIC insurance category moves, and so does who keeps the money at an owner's death. A desk that handles only the first can leave a customer worse insured, or disinherit someone, by accident.

The FDIC's joint category has conditions the desk can break. All co-owners must be living people, "All co-owners must have equal rights to withdraw deposits from the account," and each has signed a signature card or the bank's records otherwise establish co-ownership (FDIC, Your Insured Deposits). An owner added "for emergencies" who may sign only with the parent does not have equal rights, and under the FDIC's rule an account that fails the test is split by each person's actual interest and added to each person's single accounts (12 CFR 330.9). For a parent who already holds $250,000 alone at the same bank, the whole "joint" balance can end up uninsured.

Inheritance follows the account form, not the request's intent. In states with a typical multiple-party accounts statute, the bank may pay any party to a joint account on request (Va. Code § 6.2-613), and the survivor takes what is left. Many requests to "add my daughter" come from a parent who wants help paying bills; an authorised signer or an agent under a power of attorney does that without owning anything. Offering the lighter option, and recording that the customer chose ownership anyway, protects the customer and the bank.

Removals and contested changes

Removing an owner creates no new customer, but it takes away a right that owner already holds, so most banks need every owner's signature or a court order. Where owners disagree, state law usually gives the bank a holding position: in Virginia any party may tell the bank in writing not to permit withdrawals, after which the bank may hold them, without liability, until the parties' rights are settled (Va. Code § 6.2-616(D)).

The operational trap is access. Removing a name from the title does not end the departing owner's debit card, digital banking login or automatic transfers; each is a separate change. The cleaner route is often to open a new account for the remaining owner and close the joint one, which also gives the bank a fresh signature card and a clean CIP file for the account that continues.

Ownership changes as a takeover and exploitation signal

An added owner is the strongest kind of access a fraudster or an exploiter can get, so the timing and the person matter as much as the documents. The Red Flags guidelines name a request for "the addition of authorized users on the account" shortly after a change of address as a warning sign (12 CFR 41, Appendix J, Supplement A). A new joint owner a week after a new address, or a caregiver added to an older customer's savings, is the pattern the guidelines and elder exploitation cases both describe.

At the sample bank, a request to add a son as joint owner on a 77-year-old customer's checking account carried one signal and was cleared by a callback on the owner's number of record, in which he described the change in his own words. The son was then identified and verified as a new customer before a second specialist signed. Hot powers in a power of attorney covers the harder version, where an agent asks to add himself.

An ownership change, cleared by a callback and waiting for its second signature

The desk procedure, from request to posting

A sound procedure decides who is new before it decides anything else, because that answer sets every later step. The flow below is how the sample bank runs it; the identification steps are the bank's own CIP, applied at the maintenance desk.

What CIP testing finds at the maintenance desk

Testers usually find that the account-opening process is well documented and the maintenance process is not. The table lists the findings most specific to ownership changes and the evidence that closes each; segregation of duties on the maintenance desk covers the maker-checker findings that sit alongside them.

A buyer evaluating tools for this desk should ask a vendor to run one added-owner request and one business share sale end to end and show the file that results. Twelve questions for comparing account maintenance software lists the rest of what to test.

Questions people ask

Do you need to run CIP when adding a joint owner to an account?

Yes, for the added owner. The interagency guidance says a person who becomes co-owner of an existing deposit account is a customer subject to the CIP rule because that person is establishing a new account relationship. The existing owner, already known to the bank, does not need to be re-verified.

Is an authorized signer a customer under the CIP rule?

The rule defines the customer as the person who opens the account, and the guidance treats an agent acting for a competent owner as not the customer, so a person added only as a signer is not, on the rule's text, opening an account. For a business or other non-individual customer, the rule lets the bank, based on its risk assessment, obtain information about individuals with authority or control, including signatories. Many banks verify every new signer as a matter of policy.

How does a bank show it has a reasonable belief it knows an existing customer?

By evidence of an active, long-standing relationship: statements sent over time, tax reporting about the person's accounts without issue, loans made and repaid, or other services over a period. The guidance warns that this may not suffice for customers the bank has deemed high risk, who may need fresh verification.

Does CIP apply when a CD rolls over or a loan renews?

A renewal or rollover creates a new account in the rule's terms, but the parties are existing customers, so the bank need not repeat CIP if it reasonably believes it knows them. If a new person is added at renewal, CIP applies to that person.

Does a business share sale require new beneficial ownership information?

Yes. FinCEN's CDD guidance says a change of beneficial ownership means the new beneficial owner's identity must be collected, certified and verified, while other changes, such as a new address, need only that information updated. The February 2026 relief order did not remove that duty.

How long must the CIP records for an added owner be kept?

The identifying information must be kept for five years after the account is closed. Descriptions of documents and methods used to verify, and of how discrepancies were resolved, must be kept for five years after each record is made.