CIP exceptions: the five routes the rule names, and each one's record

CIP exceptions are new-account applications whose identifying information could not be verified the normal way, so a person has to decide what happens next. The Customer Identification Program rule, 31 CFR 1020.220, anticipates them: it names five situations in which a bank's procedures must use non-documentary methods, it asks for a written resolution of every substantive discrepancy, and it requires a plan for the applicant whose identity cannot be verified at all. The difficulty is volume and evidence, not doctrine: the same queue holds a missing apartment number, a married surname and a Social Security number that belongs to someone else. Botminds' CIP Verification is an agentic solution that sorts each exception into its route, cites the bank's own procedure step, and leaves the decision and the signature to people.

What is a CIP exception?

A CIP exception is any new-account file that leaves the automated path. It usually starts as a "refer" or "fail" from the identity verification service: the document check, the credit bureau header or the non-documentary database did not agree with what the applicant gave. "CIP exception meaning" searches tend to expect a single definition, but the rule produces three different kinds, and they need different handling.

Route exceptions are the five situations the rule names, where documents alone cannot do the job and the procedure must say which other method applies. Discrepancies are values that disagree between sources: a date of birth keyed day-first, an address without its unit. Verification failures are the files where, after the procedure has been followed, the bank still cannot reasonably believe it knows who the customer really is. The first two are resolved; the third is decided, by someone with the authority to decline, restrict, close or report.

The five situations the rule names

The rule says a bank's non-documentary procedures "must address situations where an individual is unable to present an unexpired government-issued identification document that bears a photograph or similar safeguard; the bank is not familiar with the documents presented; the account is opened without obtaining documents; the customer opens the account without appearing in person at the bank; and where the bank is otherwise presented with circumstances that increase the risk". Those five clauses are the routes. A procedure that gives each one a numbered step, with the methods allowed and the evidence required, turns an inbox of refers into a set of known paths.

The routes overlap in real files. An online applicant with an ITIN and no credit file is "not in person" and, for the bureau, "no documents obtained" at the same time; a written procedure picks one step and lists the evidence it needs. The FFIEC manual adds two habits worth writing in: banks should look at more than one document where they can, and the bank may require more identifying information for certain customers or products than the rule's minimum (FFIEC BSA/AML Manual).

What is a CIP discrepancy, and when is it substantive?

A CIP discrepancy is a difference between the identifying information the customer gave and what a verification source says. The rule requires the record to include "a description of the resolution of any substantive discrepancy discovered when verifying the identifying information obtained" (31 CFR 1020.220(a)(3)(i)(D)), and it does not define "substantive".

A workable test is whether the difference could mean a different person. "Ln" for "Lane" cannot. A missing unit number at a known street address cannot. A day and month swapped, where the license, the database and the bureau's month and year agree, almost certainly cannot, once the applicant confirms it. A date of birth twenty years off, or a Social Security number linked to someone else, can. The first group is cosmetic and can be closed by a written rule; the second is substantive and needs a described resolution with evidence; the last is not a discrepancy to resolve at all, but a failure to verify.

Banks differ on where the line sits, which is why it belongs in the written procedure rather than in each analyst's head. Whatever the line, "verified" on its own is not a description of a resolution. The record should say which field disagreed with which source, what was concluded, on what evidence, and under which procedure step.

CIP name discrepancy and the other everyday variants

Most exceptions are variants, not fraud. Take thirty days of fictional sample files from CIP Verification, at a sample credit union with 38 branches, a contact center and online opening: 640 exceptions over 20 business days, which the agents classified by type. Address variants and recent movers were half the queue; ID number conflicts, the kind most likely to mean a different person, were 14.

A CIP name discrepancy usually falls into one of four shapes: a hyphenated or compound surname that one source truncates ("Castellano" against "Castellano-Wu"), a married or former surname still on the bureau file, a nickname on the application ("Bill" for "William"), or a transliteration of a non-English name. Each has a safe resolution when the other three fields match and an independent source carries the full name, and each deserves its own procedure step so the analyst cites it rather than re-argues it.

Four fields across four sources, each discrepancy explained in a sentence

Can a bank open an account before verifying identity?

Yes. The rule requires the four identifying items "prior to opening an account", but verification may follow within a reasonable time once the account is open. A bank can therefore open an account and verify it the same afternoon, or the next week, provided its procedures say so and set "the terms under which a customer may use an account while the bank attempts to verify the customer's identity".

How long does a bank have to verify identity? The rule does not say. "Reasonable time" is left to the bank's risk-based procedure, and the honest practice is to set it in writing by product and channel: a deposit-only account might allow a few days with outgoing payments held; a credit line might allow none. Service-level clocks are a separate matter. In CIP Verification's sample settings, an exception file is due four business hours after it opens and escalates to the BSA officer when it passes, which is an internal service standard, not a legal deadline.

What happens if a bank can't verify your identity?

When verification fails, the bank follows the four decisions its procedure must describe: whether to open the account at all, how the account may be used while verification continues, when to close it after attempts fail, and when to file a Suspicious Activity Report. For the applicant, that usually means a request for another document or a visit to a branch, and sometimes a decline. A bank does not tell an applicant that a SAR is being considered, which is why applicants and branch staff should see a neutral status only.

The cost of getting this wrong is public. In 2020, Metropolitan Commercial Bank "received multiple reports indicating widespread fraud related to the Movo program and continued to issue Movo Accounts to applicants for whom the Bank did not have a reasonable belief that it knew their true identity", and people "using stolen identities" collected more than $300 million in state unemployment benefits, about $200 million never recovered (Federal Reserve order, 2023). The order that followed required a plan to "address the circumstances in which the Bank cannot form a reasonable belief" and a $14.5 million penalty.

Identity not verified: the opening stops and nothing is proposed

When should a bank close an account for CIP?

A bank should close an account for CIP when its own procedure says the attempts to verify have failed, and the procedure should say what "failed" means in time and in tries. The rule only requires that the procedure describe it. Regulators who have found that gap have been specific: the FDIC's 2024 order against Sutton Bank required procedures for "timely resolution of identified deficiencies", including when, and how fast, an account with an unresolved deficiency must be closed (FDIC and Ohio DFI, 2024; the same clock for customers who never answer is in KYC outreach to non-responders).

A defensible closing rule names three things: the number of contact attempts and their interval, the restrictions while they run, and who decides the closure. In the sample settings, member reminders go out after one and three business days; anything that still cannot be verified goes to the BSA officer, not to a timer.

What the record must say for each route

The rule's record has four parts: the identifying information obtained; a description of the document relied on; a description of "the methods and the results" of non-documentary verification; and the resolution of each substantive discrepancy. On every route the last two parts carry the weight, because they are what changes from one exception to the next.

A route-aware record is short. For Ahmad Rezaei, a fictional applicant whose day and month of birth were swapped when his application was keyed, it reads: date of birth corrected from 03/07/1991 to 07/03/1991, the license and the non-documentary database agreeing and the bureau holding July 1991; confirmed by the applicant in the digital banking app with a one-time code at 10:37 a.m.; procedure step 4.5; proposed by the member service representative at 10:38 and approved by a BSA analyst at 10:40. An examiner can read that without opening anything else, which is the point. What examiners sample in CIP testing shows why exception files are where they look first.

How CIP Verification routes each exception

In CIP Verification, a route is chosen by evidence and confirmed by people. The agents read and compare; they never approve, never change a value and never decide a referral.

The thresholds are the bank's. The Resolution agent proposes only what a step allows and asks a person below 0.90 confidence; procedure changes are proposed, versioned and approved by the BSA officer before the agents use them. Over the thirty sample days, 3.1% of proposals were returned by an analyst, each with a reason code, and no membership opened with an unresolved CIP field. Those are figures from fictional sample data, and the second is the solution's design target, not a promise about any bank's files.

How CIP exceptions are running: counted from the files themselves

The routes also show where the queue's time goes. In the sample, 122 applicants were asked for a document over the thirty days, and most of the rest were closed on evidence already in hand. Opening an account with an expired ID follows one route from the applicant's side. The full solution is described on the CIP Verification page.

Questions people ask

Is a CIP exception the same as a CIP violation?

No. An exception is a file that needs a person's review; a violation is a failure to follow the rule or the bank's own procedure, such as opening without the four items or leaving a discrepancy unresolved. Exceptions handled under a written step, with the resolution recorded, are the rule working as designed.

Can a bank resolve a CIP discrepancy by changing the application to match the vendor?

Only if the evidence supports the change and the record says so. Editing a field so the vendor passes, without a described resolution, removes the very information the rule asks the bank to keep for five years.

Do CIP exceptions have to be reviewed by the BSA officer?

The rule does not name a role. A common design has analysts approve routine resolutions and reserves failures to verify, potential list matches and SAR decisions for the BSA officer, with dual control so the person who proposes does not approve, which is the kind of internal control the FFIEC manual asks examiners to look for.

Is a thin credit file a CIP exception?

It is a route exception, not a reason to decline. A young adult or a recent immigrant may have no bureau file, so the procedure needs another independent source: the ID document, a database record, a utility account or a call-back to a number the bank sourced itself.

How long should a CIP exception take to resolve?

The rule sets no clock beyond "reasonable time" for verification. In the fictional sample, the median from exception to approved resolution was 34 minutes and 97.6% were resolved within four business hours, against a sample service level of four business hours.