CIP testing is how examiners and auditors check a bank's Customer Identification Program in practice: they pull a sample of accounts opened since the last examination and test each one against the rule and the bank's own procedure. The FFIEC's examination procedures tell them to build the sample by risk and to include, among others, accounts "opened with incomplete verification information" and accounts verified by non-documentary methods. Those are the CIP exception files, the ones a person resolved by hand, so any weakness in how exceptions are documented is concentrated where examiners look. Botminds' CIP Verification is an agentic solution for those files: agents compare every field across every source and draft the resolution under the bank's procedure, people approve it, and each file is kept in the rule's four parts, ready for the sample.
CIP testing in four numbers
5
checks examiners apply to each sampled account
FFIEC CIP procedures
0
fixed sample sizes in the FFIEC procedures; the sample is risk-based
23%
of supervised banks cited for BSA violations each year, FY2015–2018
all BSA areas, mostly CTR and SAR
120days
to complete the CIP lookback one 2024 order required
What is CIP testing?
CIP testing is transaction testing applied to identity: taking real account files and checking that each was opened the way the rule and the bank's written CIP say. Examiners do it during BSA/AML examinations; a bank's independent testers do it between exams, as part of the independent testing every BSA program needs. For credit unions, the NCUA's rule spells that out: the program must "provide for independent testing for compliance to be conducted by credit union personnel or outside parties" (12 CFR 748.2).
The test is of files, not of policy. A well-written CIP with files that say only "verified" fails where it matters. The FFIEC also tells examiners to keep perspective: "Minor weaknesses, deficiencies, and technical violations alone are not indicative of an inadequate CIP", and limited instances of noncompliance "(such as isolated or technical violations)" need not make the program inadequate (FFIEC BSA/AML Manual). The question is whether the weaknesses are isolated or a pattern.
What examiners put in the CIP sample
The FFIEC procedure starts with "a sample of new accounts opened since the most recent examination", chosen as a cross-section by the bank's risk assessment: consumers and businesses, loans and deposits, credit cards, and accounts opened by mail and online. Then it adds, "on a risk basis", five groups (FFIEC CIP examination procedures):
- new accounts opened using the exception for customers who have applied for a TIN;
- new accounts opened using documentary methods, and new accounts opened using non-documentary methods;
- new accounts the bank identified as higher risk;
- new accounts "opened with incomplete verification information, if applicable";
- new accounts opened by a third party as the bank's agent, such as indirect loans.
Every group on that list is overrepresented in a CIP exception queue. An examiner following the procedure is not sampling the bank's account base at random; he or she is sampling it with the exceptions turned up. If the bank relies on another institution for any part of its CIP, the examiner samples those accounts too, and checks the contract and the annual certification.
How many accounts do examiners sample for CIP?
There is no fixed number. The FFIEC's CIP procedures say what to include, not how many, and examiners size the sample to the bank's risk, volume and the results of earlier testing and audits. That is different from areas such as HMDA, where published testing guidelines set sample sizes. In practice it means a bank cannot know in advance how many of its exception files will be read, only that the procedure points the examiner toward them.
That uncertainty is the reason to do the arithmetic. If weak resolutions sit almost entirely among exceptions, the chance that an examiner meets one depends less on the size of the whole sample than on how many exception files are in it.
The five things checked on every sampled file
For each sampled account, the FFIEC procedure asks whether the bank opened it under its own CIP and then tests five things. The figure lays them beside one fictional sample file from CIP Verification, to show what an examiner would find on a file that passes.
One sampled file, five checks: what an examiner reads
1Information obtained before opening
Test: Name, date of birth, address and ID number collected before the account opened.
On the file: Application received 10:24 a.m.; membership opened 10:40 a.m., after approval.
2Identity verified in time
Test: At opening, or within a reasonable time after, to the extent reasonable and practicable.
On the file: License, bureau header, database and the member’s confirmation, all before opening.
3Failures resolved, SARs filed
Test: Unverifiable customers handled under the procedure; SARs filed as appropriate.
On the file: Not needed here; a separate sample file was referred to the BSA officer and nothing was proposed.
4A complete record
Test: Identifying information, the document relied on, non-documentary methods and results, and “results of substantive discrepancies”.
On the file: Four parts, with the date of birth corrected, procedure steps 4.5 and 4.2 cited, and both names and times.
5Government list comparison
Test: Name compared against any designated list, “if applicable”. None is designated.
On the file: OFAC and 314(a) results recorded separately, with the list dates.
Two further items sit outside the per-file checks. Examiners "review the adequacy of the bank's customer notice and the timing of the notice's delivery", and they test any reliance arrangement. The fourth check is the one exception files fail most visibly: the rule asks the record to describe how each substantive discrepancy was resolved, and a file whose discrepancy was fixed in the core system with no reason recorded has the result without the description (31 CFR 1020.220(a)(3)).
The odds a weak resolution is picked
Take a hypothetical bank that has opened 12,000 accounts since its last examination. 1,500 of them went through a CIP exception, and 75 of those (5% of the exceptions) were closed with a weak resolution: a corrected field and "verified", with no description of why. If the examiner picks 60 accounts entirely at random, the chance of meeting at least one weak file is about 31%. If the sample instead includes exception files, as the procedure directs, the chance climbs quickly with each one drawn.
Steering the CIP sample toward exceptions finds weak files fast
The table shows how the odds move with the share of weak resolutions. At 2% of exceptions, 30 files in this hypothetical bank, an examiner reading 25 exception files has a 40% chance of finding one. At 10%, the same 25 files find one 93% of the time. A program with a weakness in one in ten exception files should expect it to be found.
Chance an examiner finds at least one weak resolution, by exception files read
| Weak share of exceptions | 10 files read | 15 files read | 25 files read | 40 files read |
|---|---|---|---|---|
| 2% (30 of 1,500) | 18% | 26% | 40% | 56% |
| 5% (75 of 1,500) | 40% | 54% | 73% | 88% |
| 10% (150 of 1,500) | 65% | 80% | 93% | 99% |
The arithmetic also shows what a finding means. One weak file in 25 is the "isolated" kind of deficiency the FFIEC says should not alone make a CIP inadequate. Three or four in 25 suggests the weak share is closer to 10% than 2%, and that is a pattern. The cheapest way to change both numbers is to make the description of the resolution part of closing the file, not a later clean-up.
What is CIP transaction testing in an audit?
In an internal audit or independent test, CIP transaction testing is the same exercise done by the bank on itself: sample, check the five things, measure the error rate, report it. The difference is that the bank can choose to read more exception files than an examiner would, and should. A tester who wants to predict the examiner's result reads the files the examiner's procedure points to, not a random draw of all accounts.
Testers also look at the process around the files. The FFIEC asks examiners to look for dual control, separated duties and management sign-off on deviations from the CIP; an audit can test whether the person who proposed each resolution was different from the person who approved it, file by file. That is easier when the file carries both names and times.
A CIP audit checklist built on the examiner's procedure
- Sample by risk, then add the exception groups
TIN-applied-for, non-documentary, higher-risk, incomplete-verification and third-party-agent accounts.
- Check the four items were collected before opening
Compare the application timestamp with the account opening date.
- Check verification timing against your own written “reasonable time”
By product and channel, as the procedure states it.
- Read the resolution of every discrepancy
Field, sources, conclusion, evidence, procedure step. “Verified” alone is a finding.
- Check maker and checker were different people
And that approvals for deviations came from the role the procedure names.
- Trace each failure to verify
Declined, restricted or closed as the procedure says; SAR considered and recorded where only BSA staff see it.
- Confirm OFAC and 314(a) results are on file
As separate requirements, with list dates.
- Review the customer notice and its timing
Before opening, in each channel, including online.
When testing turns into a CIP lookback
When testing finds a pattern, the remedy can reach back years. In February 2024, the FDIC and Ohio's Division of Financial Institutions ordered Sutton Bank to require its prepaid program managers "to collect all required information, including the full first name of customers at account opening, and test for compliance during the CIP testing process". It also required "a lookback of prepaid card customers 'CIP Lookback Review' beginning from July 1, 2020, to ensure that all required CIP information has been obtained and the Bank has formed a reasonable belief that it knows the true identity of the customer", with a plan due in 60 days and the review completed within 120 (FDIC and Ohio DFI order).
Other regulators have cited CIP directly. New York's Department of Financial Services announced its April 2025 action against Block, Inc. under the heading "DFS Investigation Found Insufficient Customer Identification Procedures and Transaction Monitoring" (NYDFS, 2025). CIP is not the most frequently cited BSA area, which GAO found to be currency transaction reports, SARs and information sharing (GAO-20-574), but a lookback over years of accounts is among the most expensive remedies, because every file has to be reopened by hand. A file that already carries its resolution in four parts is one a lookback can close quickly.
What CIP Verification leaves for the examiner
CIP Verification is designed so that the fourth check never fails for want of a description. Each exception is compared field by field across the application, the ID document, the credit bureau header and a non-documentary database; each discrepancy is explained in a sentence and mapped to a step of the bank's own procedure; a member service representative proposes the resolution and a BSA analyst who did not propose it approves. Nothing is written to the core system until then, and the resolved file is kept in the rule's four parts, with the procedure and agent versions that decided it.
The CIP record an examiner reads, in CIP Verification
The reports matter for the tester as much as the file. Over thirty days of fictional sample data, the solution counted 640 exceptions, a 3.1% rate of proposals returned by an analyst with a reason code, and no membership opened with an unresolved CIP field. The last is the solution's design target; a bank's own number is something its tester should measure, not assume. CIP exceptions, route by route covers what the record should hold on each route, and the CIP requirements in plain words covers the rule the examiner is testing against.
Counts a CIP tester can start from, taken from the files
The full solution is described on the CIP Verification page.
Questions people ask
Where are the FFIEC CIP examination procedures?
In the FFIEC BSA/AML Examination Manual, under Assessing Compliance with BSA Regulatory Requirements, Customer Identification Program, which has an overview and a separate examination procedures page. The manual says it does not itself establish requirements; the rule is 31 CFR 1020.220 and the agencies' parallel citations.
What is a CIP lookback?
A CIP lookback is a review of past accounts to confirm that the required information was obtained and that the bank formed a reasonable belief about each customer's identity. Regulators order them when testing finds systemic gaps; Sutton Bank's 2024 order required one back to July 1, 2020, completed within 120 days.
Do examiners test the CIP notice?
Yes. The procedures ask examiners to review the adequacy of the customer notice and the timing of its delivery, which must be before the account is opened, in each channel the bank uses.
Is one undocumented discrepancy a CIP violation?
It is a deficiency in that file's record. The FFIEC says minor weaknesses and isolated or technical violations do not alone make a CIP inadequate; a pattern across the sample does, and that is what the examiner is testing for.
How often should a bank test its CIP?
The rule sets no frequency. Independent testing of the BSA program is required; set the CIP test's frequency and depth by risk, and read more exception files when the bank adds channels, vendors or third-party agents.