November 5, 2025
No Comments
Before opening an account, a US bank must tell the customer it is asking for information to verify their identity. That notice can sit on the application form, the bank’s website or a sign in the lobby.
The bank’s written program stands behind that notice. It settles when the checks must be finished and what happens if the bank cannot verify the customer. The staff who open accounts have to apply those answers.
Banks in France answer the same questions in a different order. A flow built for a US account cannot simply be copied for a French one.
The rule is built around the day the account opens. A customer identification program (CIP) is a US bank’s written set of procedures for identifying and verifying each new customer.
The CIP rule for banks is 31 CFR 1020.220, which implements section 326 of the USA PATRIOT Act. The program must be written and form part of the bank’s anti-money laundering (AML) program. It must let the bank form a reasonable belief that it knows each customer’s true identity.
At a minimum, the bank must have four details, with exceptions for the ID number covered below.
|
Detail |
Individual |
Company, partnership, trust |
|---|---|---|
|
Name |
Required |
Required |
|
Date of birth |
Required |
Not required |
|
Address |
Street address; without one, an APO/FPO box or a contact’s street address |
Main place of business, local office or other physical location |
|
ID number |
US citizen: taxpayer identification number (TIN). Others, including permanent residents: a TIN, passport number and country, alien ID card number, or other government photo ID number and country |
US entity: TIN. Foreign entity: a government ID number; if none, ask for government papers certifying it exists |
Clustdoc’s onboarding forms have built-in validations, so customers know exactly what to update.
Does the check have to finish before the account opens? Not under the bank rule, which allows CIP verification within a reasonable time after opening.
For a person, the bank’s documents may include an unexpired government-issued ID, such as a driver’s license or passport. The rule describes this ID as showing nationality or residence, with a photo or similar safeguard.
A company, partnership or trust can prove it exists with papers. Examples include certified articles of incorporation, a partnership agreement or a trust instrument.
Non-documentary verification can compare the customer’s details with a consumer reporting agency, a public database or another source. Other methods include contacting the customer, checking references with other financial institutions and getting a financial statement.
Our identity verification sits inside the onboarding flow, with checks running in the background as the customer uploads an ID.
Sometimes a passport and a database record still disagree after every check. The CIP must include procedures for that case.
Those procedures should describe when not to open an account, and how a customer may use one while checks continue. They should also cover when to close an account after verification fails and when to file a suspicious activity report.
Some company customers cannot be verified with documents or other methods. For those, the CIP must say when the bank gets information on people with authority or control over the account, including signatories.
If one of our ID checks raises doubts, operations and compliance can review the result together. They can leave comments and decide the next step.
Five years after an account closes, the bank may still have to produce the customer’s identifying details. The record must include:
In our platform, you can set up data fields for the document type, number and expiry date.
For most account types, the identifying details must be kept for five years after the account closes. The other records must be kept for five years after each one is made.
The list check in a CIP is separate from Office of Foreign Assets Control (OFAC) sanctions screening. The CIP must include a check against any list of known or suspected terrorists or terrorist organizations that Treasury designates. It runs within a reasonable time after opening, or earlier if another federal law, regulation or directive requires it.
As of June 2026, Treasury had not designated any list for this purpose. Letting a customer transact before verification could still break other laws, such as OFAC rules.
A CIP notice is adequate if it describes the identification requirements in general terms. The bank must give it in a way reasonably designed to reach the customer before the account opens. The rule’s sample wording is titled “Important Information About Procedures for Opening a New Account”.
A bank can hand CIP steps to others in two ways. With reliance, another financial institution, which can be an affiliate, performs CIP steps for a shared customer.
The reliance must be reasonable. The other institution must be subject to an AML program rule and regulated by a federal functional regulator. By contract, it certifies each year that it runs an AML program and will perform the agreed CIP steps.
If the bank can show all of this, it is not held responsible for the other institution’s CIP failures. Agents and service providers are different. A car dealer or mortgage broker can verify a borrower’s identity as the bank’s agent, but the bank stays ultimately responsible.
Biometric checks in our KYC onboarding software cover passports and driver’s licenses, the examples the rule gives.
The core CIP requirements are the same in four rules:
The bank and mutual fund rules allow verification up to a reasonable time after opening. The broker-dealer and futures rules say a reasonable time before or after. None of them stops a firm from verifying first.
Money services businesses and insurers have no CIP rule. A money services business’s AML program must still cover verifying customer identification where the rules apply to it. An insurer’s program covers only certain products and must gather the customer information an effective program needs.
KYC and CIP overlap, but a CIP covers only identity for new accounts. The full KYC process adds sanctions and politically exposed person (PEP) screening, a risk rating and reviews over time.
Customer due diligence runs alongside the identity check and continues after it. The bank monitors the relationship and keeps customer information current on a risk basis.
Before June 2025, a bank generally had to get the TIN from the customer. A CIP can still let a customer who has applied for one open an account. The bank confirms the filing first and gets the number within a reasonable time after opening.
The OCC, FDIC and NCUA issued an order on 27 June 2025, and the Federal Reserve followed on 31 July. The orders let banks these agencies supervise get TIN information from a third party. Those banks still need the full TIN before opening, and the exemption is optional.
FinCEN FAQs of 8 September 2026 clarified one point without changing the rule. An unexpired state-issued mobile driver’s license can count as government ID.
Two proposals would bring CIP rules to new kinds of firms, and neither was final on 7 October 2026. The first, published on 22 June 2026, would give permitted payment stablecoin issuers a CIP with the same four details.
Under that proposal, customers that are not individuals would give a date of formation. Comments closed on 21 August 2026.
The second concerns investment advisers. FinCEN’s Spring 2026 agenda lists a planned joint proposal with the SEC to replace one from May 2024.
EU law has no rule called a customer identification program. The customer identification process is one part of customer due diligence, and verification usually comes first.
France sets a stricter order than the US rule. A bank identifies the client and verifies those details before the business relationship starts (Code monétaire et financier, L561-5).
Where the risk appears low and waiting would interrupt normal business, the checks can finish during onboarding. A new account then cannot be used for any transaction until verification is done (R561-6).
From 10 July 2027, Article 23 of Regulation (EU) 2024/1624 requires verification before the relationship starts. Under simplified due diligence, verification can wait where a lower risk justifies it. As in France, it can finish during onboarding on the same two conditions, as soon as practicable.
The regulation lets a bank open an account sooner if safeguards block transactions. They stay blocked until the customer and its beneficial owners are checked. A US bank’s CIP procedures, by contrast, should describe the terms for using an account while verification is pending.
Teams opening accounts in the US and France can book a demo call. We will compare Clustdoc flows for both sets of rules.
CIP stands for customer identification program, the written procedures a US bank uses to identify and verify each new customer. The bank generally collects at least four details before opening the account. The bank rule, 31 CFR 1020.220, allows verification within a reasonable time after opening.
Financial institutions with a federal functional regulator, state-regulated banks, government agencies and certain listed companies are not customers under the rule. Neither are existing account holders whose identity the bank reasonably believes it knows.
Check cashing, wire transfers and money order sales without a formal banking relationship are not accounts. Nor are acquired accounts or accounts opened for an employee benefit plan. Regulators can exempt banks or account types by order, as they did in October 2020 for premium finance loans.
Yes, the CIP must be part of the bank's anti-money laundering compliance program. That wider program needs internal controls, independent testing and someone responsible for day-to-day compliance. It must also cover staff training and ongoing customer due diligence.
No, the CIP rule asks only for a description of the document, such as its type and number. A bank may keep copies, and its risk-based procedures may call for them in some cases. In France, a face-to-face check against an original photo ID includes taking a copy.
Yes, a CIP covers identifying and verifying each customer who opens a new account. Customer due diligence (CDD) builds a risk profile from the relationship's nature and purpose, then monitors it over time. For most company customers, CDD includes identifying and verifying the beneficial owners, at least when the customer first opens an account.
Still stitching emails, files, and approvals together?
Clustdoc gives teams one place to run client-facing work, boost customer engagement and increase compliance.
Claire writes about customer onboarding, digital processes, and the day-to-day challenges faced by operations teams. At Clustdoc, she focuses on practical insights: how organizations collect information, guide customers through complex steps, and improve service delivery with automation.
