The CIP compliance analyst: the seat that clears every exception

A CIP compliance analyst is the person who reviews customer identification exceptions after the front line has collected an applicant's name, date of birth, address and ID number and something did not verify. The analyst decides whether a swapped day and month, a missing apartment number or an ITIN in place of a Social Security number still lets the bank form a reasonable belief that it knows who the customer is, and writes down how each discrepancy was resolved. It is hard because the evidence sits on four screens, the applicant is waiting, and the rule wants the reason on file for years. Botminds' CIP Verification is an agentic solution built for this seat: agents compare every field across every source and draft the resolution the bank's own procedure allows; the analyst approves or returns it.

The seat is easy to miss because no customer ever sees it. The new accounts clerk interviews the applicant; the teller checks the license; the online form calls an identity verification service. When any of them gets a refer, the file goes somewhere else, and that somewhere is the subject of this page.

What does a CIP compliance analyst do?

A CIP compliance analyst resolves the accounts the automated checks could not clear, then documents each decision in the form the rule asks for. The Customer Identification Program rule, 31 CFR 1020.220, lets a bank verify identity by documents, by non-documentary methods such as a consumer reporting agency or public database, or by both, and it requires the bank's procedures to address what happens when those methods disagree. The analyst is where that procedure is applied to a real person.

The daily work falls into four kinds of task. Reading the evidence: the application, the ID document and its barcode, the credit bureau header and the non-documentary database result, usually in different systems.Classifying the gap: a name variant, an address variant, a recent move, a date of birth error, a thin file, an ITIN applicant, a military address, an expired document, or a number that belongs to someone else.Choosing the next step: accept the variant under a written step, ask the applicant for one confirmation or one document, or stop and refer. Writing it down: the resolution, the source relied on, the step applied and the analyst's name.

The last task is the one examiners test. The rule's record has four parts, and the fourth is a description of how each substantive discrepancy was resolved, kept for five years after it is made. A file that says only "verified" has the outcome without the reason.

Who reviews CIP exceptions, and why it is not the person who opened the account

In the banks GAO studied, the CIP exception is reviewed by someone other than the employee who took the application, often the BSA officer or an analyst on the BSA team. GAO's study of eleven banks described the common workflow plainly: front-line staff collect the information at opening, and a second person, often the BSA/AML officer, checks that it is complete and looks for warning signs (GAO-20-574). The second reader exists because the first has an interest in opening the account.

Examiners look for the same separation. The FFIEC manual tells them to consider "general internal controls concepts, such as dual controls, segregation of duties, and management approval for certain actions" when they assess a CIP, and names "BSA compliance officer or other senior management approval for staff actions that deviate from the bank's CIP policies" as one such control (FFIEC BSA/AML Manual). In practice that becomes a maker and a checker: the front line proposes, the analyst approves, and the BSA officer owns the procedure and the files nobody can resolve.

The work NIST calls a trusted referee

Federal identity guidance already has a name for this seat, though banks rarely use it. NIST's identity proofing standard, SP 800-63A-4, defines a trusted referee as someone "vetted and trained to make risk-based decisions regarding an applicant's identity proofing case when that applicant is unable to meet the expected requirements", including "when applicants do not possess the required identity evidence or the attributes on the evidence do not all match the claimed identity (e.g., due to a recent name or address change)" (NIST SP 800-63A-4).

That is a fair job description for a CIP compliance analyst, and the comparison is useful in two ways. First, NIST separates the trusted referee from the proofing agent, who makes "limited, risk-based decisions" such as checking that a document has not been altered: the counter and the back office are different jobs with different training. Second, NIST expects the referee to receive a summary of why the automated checks failed. An analyst who has to reconstruct the failure from vendor codes is doing the machine's reporting by hand before starting the judgement.

NIST 800-63 is written for federal agencies and is voluntary for banks. It is still the most precise public statement of what exception handling requires, and it gives a bank's job description words an auditor will recognise.

What a CIP exception looks like on the analyst's desk

A typical exception is not fraud. It is a real person whose data disagrees with itself in one of a handful of familiar ways. Take one sample file as it runs through CIP Verification. On Thursday, October 22, 2026, Ahmad Rezaei applies at a branch for a share savings account and checking. His identity verification service returns a refer: date of birth mismatch, address partial.

Laid side by side, the four sources tell a simple story. The application says 03/07/1991; the driver's license and the non-documentary database say 07/03/1991; the credit bureau has July 1991. The day and month were swapped when the form was keyed. The license reads "14 BIRCH LN" with no apartment; the bureau and the database have "Apt 2". The SSN matches the bureau and the database in full. By hand, an analyst would reach the same conclusion, after opening four systems and emailing the branch.

The analyst's written resolution is what the examiner samples

The resolution matters more than the decision because it is the only part an examiner can test after the fact. The FFIEC's CIP examination procedures direct examiners to sample new accounts opened since the last exam and to include, on a risk basis, accounts opened with incomplete verification and accounts verified by non-documentary methods (FFIEC examination procedures). Those are exactly the files that passed through the analyst's hands. For each one the examiner checks that the file records what verification found, including how any substantive discrepancy came out.

In Ahmad's sample file, the resolution reads as the rule's four parts would have it: the identifying information, with the date of birth corrected from 03/07/1991; the license relied on, with its number, issue and expiry dates; the bureau and database results and the member's confirmation; and the resolution of each discrepancy, citing procedure steps 4.5 (a transposed day and month, confirmed by the member and an independent source) and 4.2 (unit and suffix variants are the same address), with the proposer, the approver and the times. The five routes a CIP exception can take sets out what that record should contain on each route.

The checker's view: the proposal, its sources and a checklist

CIP compliance analyst salary, and the jobs around the seat

There is no official pay series for a "CIP compliance analyst". The closest BLS occupation is compliance officers (13-1041): 436,400 jobs in 2025 across all industries, a median wage of $80,730, and 3.8% growth projected to 2035 (BLS Employment Projections). Many CIP seats in banks and credit unions are entry or mid-level roles inside BSA departments, so a bank's own grade structure is a better guide than any national median; a posted title can mean anything from a branch-support clerk to a senior analyst.

The jobs around the seat are shrinking. BLS projects tellers to fall 13.2% between 2025 and 2035 and new accounts clerks 6.5%. O*NET lists interviewing customers for the information needed to open accounts as the new accounts clerk's first task (O*NET 43-4141). As applications move online, the interview disappears and the questions it used to settle arrive in the back office as exceptions. The volume of identity work does not fall when the counter staff do; it changes address.

The seat therefore asks for two kinds of skill that rarely appear together in a job posting: operations (queues, service-level clocks, vendor result codes, written procedures) and judgement about identity, with the discipline to write that judgement down so someone else can test it five years later.

The counter used to settle most identity questions face to face. Online, every one of them arrives in the back office as an exception, with the applicant waiting and the reason still to be written.

How the seat changes with agents in CIP Verification

The agents take the reading and drafting, not the decision. In CIP Verification, an Application Reader agent reads the application and the ID document, front, back and barcode. A Source Comparison agent pulls the bureau header and the non-documentary database and marks each of the four fields as a match, a near-match or a conflict, with a sentence explaining why. A Resolution agent maps each discrepancy to a step of the institution's procedure and proposes the resolution with its confidence; below 0.90 it asks a person instead. A Member Request agent drafts the one confirmation or document request that closes the file.

What reaches the analyst is a proposal with its evidence attached. In the sample, Ahmad's file went from application at 10:24 a.m. to approval at 10:40 a.m.: Dana Whitcombe, the member service representative, proposed the resolution at 10:38, and Marcus Ellery, the BSA analyst, approved it two minutes later. Only then was the corrected date of birth written to the core banking system.

Approving a resolution in CIP Verification

The queue changes shape too. Instead of an inbox, the analyst works lanes: files needing a proposal, files waiting for the member, files waiting for approval, escalations past the clock. Each row says what the agents found and which step they propose, so a name variant under step 4.1 and an ITIN applicant under step 5.1 can be told apart before either is opened. Automated identity verification, traced second by second follows one file through every step.

The analyst's queue: every CIP exception by lane and clock

What the CIP compliance analyst still decides

Everything that carries a judgement stays with a named person. In CIP Verification the agents never approve, never change a value in the core system, never clear a potential OFAC match and never decide a referral. A proposal cannot be approved by the person who made it, in single or bulk actions, and bulk approval is limited to address variants the agent rates at 0.95 or above, each read before it is approved. Procedure and threshold changes are proposed, versioned and approved by the BSA officer before the agents use them.

Some files are not exceptions at all but referrals. In one sample file, an applicant's SSN belonged to another person, born in 1958, at both the bureau and the database. The agents stopped the opening and proposed nothing; the BSA officer decided whether to decline or ask for a second ID in the branch, and any SAR decision was recorded only in the BSA case system. The applicant and the branch saw a neutral status. That boundary, between a discrepancy a procedure step can resolve and one it cannot, is the most important call the seat makes, and how often people get identity checks wrong explains why it should not rest on anyone's eye alone.

The seat also owns the quality of its own output. Returns, with their reason codes, are the analyst's measure of the agents: in thirty days of sample files, 3.1% of proposals were returned, most often for insufficient evidence. A rising return rate on one procedure step is a signal to rewrite the step, not to approve faster. The full solution is described on the CIP Verification page.

Questions people ask

What does CIP mean in compliance?

CIP stands for Customer Identification Program, the part of a bank's anti-money laundering program required by section 326 of the USA PATRIOT Act and implemented at 31 CFR 1020.220. It requires a written, risk-based procedure to collect four identifying items before an account opens and to verify them within a reasonable time.

What is a CIP exception?

A CIP exception is an account application whose identifying information could not be verified automatically, so a person has to review it. Most are ordinary variants, such as an address without its unit number or a married surname, and a minority are referrals where the identity cannot be verified at all.

Is a CIP analyst the same as a KYC analyst?

Not quite. A CIP analyst verifies who the customer is at opening; a KYC or CDD analyst goes further, into the nature and purpose of the relationship, beneficial owners and risk rating. In smaller institutions one person often does both, and BLS counts both within compliance officers.

How many CIP exceptions can one analyst review in a day?

There is no published benchmark. In the sample credit union, a BSA analyst approved 30 to 40 resolutions a day from email threads before the agents; the honest measure for your own team is median time from exception to approved resolution, counted from your own files.

Can the person who opened the account approve its CIP exception?

The CIP rule does not say, but the FFIEC manual asks examiners to look for dual controls, segregation of duties and management approval for deviations from the CIP procedure. Most banks therefore separate the person who proposes a resolution from the person who approves it.