The customer identification program requirements come from one regulation, 31 CFR 1020.220, which every bank, savings association and credit union follows. It requires a written, risk-based program that collects four items from each new customer before an account opens (name, date of birth, address and an identification number), verifies identity within a reasonable time by documents, non-documentary methods or both, says what happens when verification fails, keeps a record of how it was done, checks designated government lists, and tells customers in advance. The text has barely changed since 2003; what makes it hard is applying it to applicants whose data disagrees. Botminds' CIP Verification is an agentic solution for that part: agents compare every field across every source and propose the resolution a bank's own CIP procedure allows, and people approve it.
This page reads the rule clause by clause, with the agencies' own interpretive answers where the text is silent. It is written for staff new to compliance or account operations, and for anyone who has to explain the rule to someone who is.
The customer identification program rule in nine obligations
- A written program, approved and part of the AML program
Risk-based, “appropriate for the bank’s size and type of business”. For credit unions, approved by the board and reflected in its minutes (12 CFR 748.2).
- Four items collected before the account opens
Name, date of birth for an individual, address, identification number.
- Verification within a reasonable time
By documents, non-documentary methods or both, enough to form a reasonable belief the bank knows who the customer is.
- Non-documentary procedures for five named situations
No unexpired photo ID, unfamiliar documents, no documents, not in person, or other added risk.
- Additional verification for some non-individuals
Information about the people with authority or control, when the entity itself cannot be verified.
- Procedures for when identity cannot be verified
When not to open, how the account may be used meanwhile, when to close, when to file a SAR.
- A record in four parts, kept on two clocks
Identifying information, the document relied on, the non-documentary results, and how each discrepancy was resolved.
- Comparison with designated government lists
None has been designated for CIP purposes; OFAC and 314(a) are separate duties.
- Adequate notice before opening
The rule supplies sample wording.
What are the CIP requirements?
The CIP requirements are the nine obligations above, applied to every "customer" who opens a new "account". Both words are defined narrowly. An account is "a formal banking relationship", including deposits, loans, safe deposit boxes and trust services; it excludes products with no formal relationship, such as check cashing, a wire transfer or the sale of a money order, accounts acquired in a merger, and ERISA plan accounts (31 CFR 1020.100). A customer is the person who opens the account, or the individual who opens it for a minor or for a group that is not a legal person, such as a civic club.
Three exclusions matter in practice. A person whose loan application is denied never becomes a customer. A person with an existing account is not a new customer, "provided that the bank has a reasonable belief that it knows the true identity of the person". And regulated financial institutions, government entities and listed companies are outside the rule. Everything else is risk-based: the procedures must reflect the bank's account types, opening channels, available identifying information, size, location and customer base (FFIEC BSA/AML Manual).
The standard running through all of it is a "reasonable belief that it knows the true identity of each customer". The rule never says "certainty", and the agencies' FAQ is explicit that a bank "need not establish the accuracy of every element of identifying information obtained", only enough of it. A program is judged by whether its procedures produce that belief, consistently, and leave a trail showing how.
What are the three requirements for a bank's CIP program?
The question comes from training quizzes, and the rule does not list exactly three. The answer usually expected is identity verification procedures, recordkeeping and comparison with government lists, because those are the first three numbered elements after the general requirement. The regulation actually makes four elements mandatory after the written program itself: verification procedures (which include collecting the four items and handling failed verification), recordkeeping, the government list comparison, and customer notice. Reliance on another institution is a fifth element a bank may choose.
If a course or exam insists on three, give those three and add the notice. If a colleague asks what the CIP requires in practice, the nine obligations in the checklist above are the honest answer.
The four items collected before an account opens
The bank must obtain, "at a minimum", four items from the customer "prior to opening an account". The timing is strict for collection and flexible for verification: the information comes first, checking it may follow.
Name. As the customer gives it. Date of birth, for an individual.Address: a residential or business street address; for someone without one, an Army or Fleet Post Office box or the street address of next of kin or another contact. For a business, a street address where it actually operates, such as its main or a local office. The agencies' FAQ adds that a rural route number is acceptable, and where there is nothing else "a description of the customer's physical location will suffice" (interagency CIP FAQs).
Identification number. For a US person, a taxpayer identification number: a Social Security number, an ITIN or an EIN. For a non-US person, one or more of a TIN, a passport number and country of issuance, an alien identification card number, or the number and country of another government photo ID evidencing nationality or residence. Two exceptions soften the TIN rule: an applicant who has applied for a TIN but not received it may open the account if the bank confirms the application was filed and gets the number within a reasonable time, and for credit cards the information may come from a third party before credit is extended.
A service member's APO address, accepted under the rule's own exception
CIP documentary vs non-documentary verification
The rule lets a bank verify identity with documents, with non-documentary methods, or with both, and its written procedures must say which it uses when. Documentary verification for an individual usually means a current, government-issued photo ID that shows nationality or residence, such as a driver's license or passport. The FFIEC adds that other forms may be used if they support a reasonable belief, and that "a bank is encouraged to review more than a single document" because counterfeits exist.
Non-documentary verification examples are listed in the rule: getting in touch with the customer; matching what the customer gave against a credit bureau, a public database or another independent source; taking references from other banks; and asking for a financial statement (how banks verify identity compares the methods). The 2005 FAQ also lets the record cross-reference the procedure section that describes a non-documentary method rather than describing it afresh on every file.
Documentary and non-documentary verification do different jobs
Documentary: A government photo ID or, for an entity, documents showing it exists: articles, business license, partnership agreement, trust instrument.
Non-documentary: The customer’s data against an independent source: a credit bureau header, a public database, a reference from another bank, a financial statement, a call to the customer.
Documentary: That the person presenting it matches the photo, if the document is genuine.
Non-documentary: That the name, date of birth, address and number belong together in sources the applicant does not control.
Documentary: Counterfeit or altered documents, expired IDs, applicants who are not present.
Non-documentary: Thin or no credit files, recent movers, new ITIN holders, data stolen together.
Documentary: Never mandatory on its own; it is the agencies’ expectation for most individuals.
Non-documentary: In five named situations: no unexpired photo ID, unfamiliar documents, no documents, not in person, or other added risk.
Documentary: The type of document, its number, place of issuance, and issue and expiry dates.
Non-documentary: The methods used and their results.
Most remote openings combine the two: a scanned license checked for tampering, plus a database comparison. The five situations that force a non-documentary route are, in effect, the categories of a CIP exception queue, and CIP exceptions and the routes the rule names treats them one by one.
Customer identification program requirements for business customers
The customer identification program requirements for business customers include the same four items, adapted. The "date of birth" falls away, the address is a principal place of business or other physical location, and the identification number is the EIN, or for a foreign business without one, "alternative government-issued documentation certifying the existence of the business". Documentary verification uses papers showing the entity exists, such as certified articles, a business licence from a government body, a partnership agreement or the trust deed.
When neither documents nor non-documentary methods establish the entity's identity, the rule adds a step: the bank collects information on the people who can control the account, its signers included. The FAQ gives two examples, a partnership with no documents and a sole proprietorship with no assumed-name certificate. For a trust, the TIN is the trust's EIN, or the grantor's number where the trust has none.
The beneficial-ownership certification many people associate with business accounts is a different rule (31 CFR 1010.230). CIP identifies the entity; the CDD rule identifies who owns and controls it.
What the rule requires when identity cannot be verified
The program must say what happens when the bank "cannot form a reasonable belief that it knows the true identity of a customer". The procedures should describe four things: when the bank will decline to open; what a customer may do with an account while verification is still under way; when to close an account after attempts have failed; and when to file a Suspicious Activity Report.
The rule leaves the thresholds to the bank, which is why two banks can treat the same applicant differently and both comply. What examiners expect is that the bank follows its own procedure and can show it did. In CIP Verification's sample data, an applicant whose Social Security number belonged to another person, born in 1958, was stopped before opening: the agents proposed nothing, and the BSA officer decided between declining and asking for a second ID.
CIP record retention requirements
The record has four parts and two retention clocks. The CIP record retention requirements keep identifying information for five years after the account closes, and the verification records for five years after they are made. Banks often keep everything for longer as policy; the table shows the minimum the rule sets.
What the CIP record holds, and how long the rule says to keep it
| Part of the record | What it contains | Kept for at least |
|---|---|---|
| A. Identifying information | Name, date of birth, address, identification number and anything else collected under the CIP | Five years after the account closes (for credit cards, closed or dormant) |
| B. Document relied on | Type, any number on it, place of issuance, issue and expiry dates | Five years from the day the record is made |
| C. Non-documentary methods | The methods used and their results, or a cross-reference to the procedure section that describes them | Five years from the day the record is made |
| D. Discrepancies | A description of how each substantive discrepancy was resolved | Five years from the day the record is made |
The CIP record in the rule's four parts, in CIP Verification
The government list check, and why OFAC and 314(a) sit beside it
The rule requires procedures to check whether a customer appears on any list of known or suspected terrorists "designated as such by Treasury". No such list has ever been designated. The FFIEC manual says so directly: "no designated government lists for CIP purposes exist", and checking customers against OFAC lists and 314(a) requests remains a "separate and distinct" requirement.
OFAC screening and 314(a) searches apply under their own regulations, 31 CFR Part 501 and 31 CFR 1010.520, and can run at opening alongside the CIP. The point for a written program is to cite each check under the rule that requires it, so an examiner reading the CIP does not find a list comparison described as something it is not.
CIP notice requirements
Customers must get "adequate notice" that the bank is requesting information to verify their identities, before the account opens. Notice is adequate if it describes the requirements generally and is given in a way "reasonably designed to ensure that a customer is able to view the notice": a lobby sign, a website notice, text on the application, or written or oral notice. For a joint account, giving it to one owner for delivery to the others is enough. The rule supplies the wording most banks use.
Important Information About Procedures for Opening a New Account. To help the government fight the funding of terrorism and money laundering activities, Federal law requires all financial institutions to obtain, verify, and record information that identifies each person who opens an account.
Sample notice, 31 CFR 1020.220(a)(5)(iii)
The notice is also an examination item: the FFIEC's procedures ask examiners to judge whether the bank's notice is adequate and delivered at the right time. For an online opening, that means the notice appears before the applicant submits, not in a welcome email afterwards.
Reliance, exemptions and the 2025 TIN orders
A bank may rely on another financial institution, including an affiliate, to perform parts of its CIP for a shared customer, but only if reliance is reasonable, the other institution has its own AML program and a federal functional regulator, and it signs a contract to "certify annually" that it is performing the specified requirements. Without that contract, the bank may still use an agent or service provider, but it remains "ultimately responsible" for the agent's compliance.
The regulators can exempt types of account by order, and in 2025 they used that power on the TIN. FinCEN's order of June 27, 2025, issued with the OCC, FDIC and NCUA, lets a bank take the taxpayer identification number from a third-party source instead of asking the customer for it, provided the bank otherwise complies with the CIP rule, including obtaining the TIN "prior to opening an account". "The use of this exemption by banks is optional" (FinCEN, June 27, 2025). The Federal Reserve issued the same relief for its banks on July 31, 2025 (Board and FinCEN order).
The orders changed where the number may come from, not when it is needed or whether it is verified. A bank that switches the relief on should record, on each file, which way the TIN was obtained. In CIP Verification the choice is a setting the BSA officer controls, off by default.
An ITIN applicant verified by the rule, not declined for being unusual
How the requirements map onto daily work in CIP Verification
The rule is short; the work is in the exceptions. Each of the obligations above lands somewhere in an account opening team's day, and CIP Verification is built around the ones that need judgement. The agents read the application and the ID, compare the four items across the document, the bureau header and a non-documentary database, and map each discrepancy to a step of the institution's own procedure. A member service representative proposes the resolution and a BSA analyst who did not propose it approves; only then is anything written to the core system. Each resolved file is kept in the rule's four parts, with both retention dates set.
The solution does not replace the identity verification service that checks documents, nor the OFAC screening the bank already runs; it sits on the files those tools refer. How long that work really takes, and where the minutes go, is the subject of identity verification for banks, priced by the minute. The full description is on the CIP Verification page.
Questions people ask
Does the CIP rule apply to credit unions?
Yes. Federally insured credit unions follow 31 CFR 1020.220 through 12 CFR 748.2, which requires the CIP to be part of a BSA program that is written, approved by the board and reflected in the credit union's minutes.
Can a minor open an account under the CIP rule?
Yes. If a parent opens the account, the parent is the customer; if the minor opens it, the minor is. The agencies' FAQ gives the example of a school savings program, where a student ID or a teacher's confirmation can verify the student.
Does a bank have to verify identity before opening the account?
It must collect the four items before opening, but it may verify them "within a reasonable time after the account is opened". The procedures must say how the account can be used in the meantime and when it is closed if verification fails.
Do existing customers go through CIP again for a new account?
No, if the bank already has a reasonable belief that it knows the person's true identity. The FAQ says a bank can show that belief, for customers who held accounts on October 1, 2003, by its comparable procedures at the time.
Does a bank have to keep a copy of the driver's license?
No. The rule requires a description of the document relied on: type, number, place of issuance and dates. Copies are allowed, and if kept in place of a description they follow the general BSA retention rule.
Can the SSN come from a credit bureau instead of the applicant?
Yes, since the 2025 orders, for banks that choose the relief: June 27, 2025 for OCC, FDIC and NCUA institutions and July 31, 2025 for Federal Reserve banks. The TIN must still be obtained before the account opens.