Customer identification program (CIP) for remote account opening

CIP stands for Customer Identification Program. A customer identification program is the written set of procedures a U.S. bank uses to collect and verify identifying information from each customer who opens an account, as required by the Bank Secrecy Act (BSA) rule at 31 CFR 1020.220.

The program must let a bank “form a reasonable belief that it knows the true identity of each customer.” This guide covers each part of the rule, with a focus on remote account opening, where the customer never visits a branch.

What is a customer identification program (CIP)?

Under 31 CFR 1020.220, a bank that must have an anti-money laundering (AML) program must also have a written CIP “appropriate for the bank’s size and type of business.” The CIP must be part of that AML program.

The procedures must be risk-based: each bank bases them on its own risks, including its account types, the ways customers can open accounts, the identifying information available, and its size, location and customer base.

What about credit unions? They are covered. FinCEN’s definition of “bank” in 31 CFR 1010.100 includes “a credit union organized under the law of any State or of the United States.” And the National Credit Union Administration (NCUA) rule at 12 CFR 748.2 says each federally insured credit union is subject to the CIP regulation at 31 CFR 1020.220, which NCUA and Treasury issued jointly.

CIP requirements: the minimum information

Before opening an account, the bank must obtain at least these four items from the customer:

1. Name.
2. Date of birth, for an individual.
3. Address. For an individual, a residential or business street address (or, if there is none, an Army or Fleet Post Office box number or the street address of next of kin or another contact). For an entity, a principal place of business, local office or other physical location.
4. Identification number. For a U.S. person, a taxpayer identification number (TIN). For a non-U.S. person, one or more of: a TIN, a passport number and country of issuance, an alien identification card number, or the number and country of issuance of another government-issued document showing nationality or residence and bearing a photo or similar safeguard.

The rule includes a few exceptions and special cases:

• Applied for a TIN but don’t have it yet. The CIP may allow an account for someone who has applied for a TIN. The bank must confirm the application was filed before the account is opened and get the number within a reasonable time afterward.
• Foreign businesses without an ID number. The bank must ask for other government-issued documents that certify the business exists.
• Credit card accounts. The bank may get the required information from a third-party source before extending credit.

One update on the TIN: on June 27, 2025, the Financial Crimes Enforcement Network (FinCEN), with the Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC) and NCUA, issued an order that permits banks to collect TIN information from a third party instead of from the customer; a July 31, 2025 order extended this to banks the Federal Reserve supervises. It is optional, and the rest of the CIP rule still applies.

How banks verify identity under the CIP rule

The CIP must verify the customer’s identity “within a reasonable time after the account is opened,” in the words of the current rule. The written procedures must say when the bank uses documents, non-documentary methods, or both.

Documentary verification

For an individual, documents may include an unexpired government-issued ID that shows nationality or residence and has a photo or similar safeguard, “such as a driver’s license or passport.” For an entity, documents that show it exists, such as certified articles of incorporation, a government-issued business license, a partnership agreement or a trust instrument.

Non-documentary verification

Non-documentary methods may include contacting the customer, comparing what the customer provided against a consumer reporting agency, public database or other source, checking references with other financial institutions, and getting a financial statement.

The rule also says when a bank’s non-documentary procedures must apply. They must address situations where:

• an individual can’t present an unexpired government photo ID;
• the bank isn’t familiar with the documents presented;
• the account is opened without getting documents;
• the customer opens the account without appearing in person at the bank; and
• other circumstances raise the risk that documents alone won’t verify the customer’s true identity.

The fourth point is the one that matters for remote account opening, and the Federal Financial Institutions Examination Council (FFIEC) BSA/AML Examination Manual’s CIP section repeats it.

Businesses and other non-individuals

For customers that aren’t individuals, the CIP must address when, based on the bank’s risk assessment, it will get information about the individuals with authority or control over the account, including signatories. This applies only when the bank can’t verify the entity’s identity with documentary and non-documentary methods.

When verification fails

The CIP must include procedures for when the bank can’t form a reasonable belief that it knows who the customer is. These should describe when not to open an account, the terms for using an account while verification is in progress, when to close an account, and when to file a Suspicious Activity Report (SAR).

Other parts of the CIP rule

• Comparison with government lists. The CIP must include procedures to determine whether the customer appears on any list of known or suspected terrorists or terrorist organizations issued by a federal agency and designated as such by Treasury. The check must happen within a reasonable time after the account is opened, or earlier if another federal law or directive requires it, and the bank must follow federal directives issued for those lists. The FFIEC manual notes that, as of its publication, no lists have been designated for CIP purposes; checks against Office of Foreign Assets Control (OFAC) sanctions lists, which tools such as AML screening support, are a separate requirement.
• Customer notice. Customers must get adequate notice, before the account is opened, that the bank is requesting information to verify their identity. Examples in the rule include a lobby or website notice or text on the account application.
• Reliance on another financial institution. A bank may rely on another financial institution, including an affiliate, to perform parts of its CIP for a customer that has (or is opening) an account or similar relationship there, if the reliance is reasonable, the other institution is subject to an AML program rule and regulated by a federal functional regulator, and it agrees by contract to certify its AML program each year and perform the specified CIP steps.

CIP record-keeping

The record must include, at a minimum:

• all identifying information obtained from the customer;
• a description of any document relied on, noting the type of document, any ID number on it, the place of issuance and, if any, the issue and expiration dates;
• a description of the methods and results of any non-documentary or additional verification; and
• a description of how any substantive discrepancy was resolved.

Retention periods differ by record. The identifying information must be kept for five years after the account is closed (for credit card accounts, five years after the account is closed or becomes dormant). The document descriptions, verification methods and results, and discrepancy resolutions must be kept for five years after the record is made.

CIP vs. KYC vs. CDD

• KYC (know your customer) is a broad, informal term for everything a business does to understand who its customers are. It isn’t a single U.S. rule.
• CIP is the specific identification rule described above.
• CDD (customer due diligence) goes further. Under 31 CFR 1020.210, a bank’s AML program must include risk-based procedures for “understanding the nature and purpose of customer relationships” to build a customer risk profile, plus ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to keep customer information current.

CDD also covers the beneficial owners of business customers. Under 31 CFR 1010.230, that means each individual who owns 25 percent or more of the entity, plus one individual with significant responsibility to control it. Verifying those people must at least follow the same elements the CIP rule uses for individuals. Since a February 13, 2026 FinCEN exceptive relief order, institutions may choose to do this only when a business first opens an account with the institution, when facts call earlier information into question, and as their risk-based procedures require, rather than at every new account. The order addresses beneficial ownership, not the CIP rule.

Where remote ID verification fits

A phone-based document and selfie check is one way to examine a customer’s government ID when they aren’t in a branch; your written procedures say how it counts toward verification. With identity verification from Securely Verify, for example, the customer opens a secure link on their own phone and the check produces evidence your program can file:

• name, date of birth, document number and expiration date read from the ID, and from the barcode on U.S. driver’s licenses;
• ID images and a live selfie, with a face-match score and an active liveness check; and
• the reviewer’s decision from the review dashboard, with a PDF report for each verification.

Compare the report with the record list above and capture anything your program needs that it doesn’t include. And because selfies and ID images are deleted 90 days after a decision by default, file the report in your own customer records for the CIP retention periods. More on this for banks and credit unions.

How remote verification fits your program, and which risks call for extra non-documentary checks, is a decision for your BSA officer.

Frequently asked questions

What does CIP stand for in banking?

CIP stands for Customer Identification Program: a bank’s written procedures to collect, verify and record each customer’s identifying information under 31 CFR 1020.220.

What are the four CIP requirements for customer information?

Before opening an account, a bank must get at least the customer’s name, date of birth (for an individual), address and an identification number, such as a taxpayer identification number for a U.S. person.

Can a bank verify identity after the account is opened?

Yes. The rule requires verification within a reasonable time after the account is opened, and the CIP should describe the terms under which the customer may use the account while verification is in progress.

How long must CIP records be kept?

Identifying information must be kept for five years after the account is closed. Records describing documents, verification methods and results, and discrepancy resolutions must be kept for five years after the record is made.

If you want to see what a remote ID check produces for your own files, start a 7-day free trial — 20 verifications, no card required.

Related guides

• Know your customer checklist for small businesses and credit unions
• Enhanced due diligence (EDD): what U.S. rules require
• Proof of address: what documents count and how to verify them
• Merchant onboarding: how to verify a merchant and its owners

Sources: 31 CFR 1020.220, Customer identification program requirements for banks (eCFR, current as of October 2026); 31 CFR 1010.100, General definitions (eCFR, October 2026); 12 CFR 748.2, Procedures for monitoring Bank Secrecy Act compliance (NCUA rule on eCFR, October 2026); FinCEN Permits Banks to Use Alternative Collection Method for Obtaining TIN Information (FinCEN, June 27, 2025, updated July 31, 2025); Customer Identification Program (FFIEC BSA/AML Examination Manual, accessed October 2026); 31 CFR 1020.210, Anti-money laundering program requirements for banks (eCFR, October 2026); 31 CFR 1010.230, Beneficial ownership requirements for legal entity customers (eCFR, October 2026); Exceptive Relief from Requirement to Identify and Verify Beneficial Owners at Each Account Opening, FIN-2026-R001 (FinCEN, February 13, 2026). This article is general information, not legal or compliance advice.