Remote account opening: the CIP basics every community bank should know
The Customer Identification Program rule sets the minimum identity information banks must collect. Here’s how it applies when customers never visit a branch.
Every bank in the United States must have a written Customer Identification Program (CIP) under the Bank Secrecy Act. The rule, at 31 CFR 1020.220, sets the minimum a bank must do to form a reasonable belief that it knows the true identity of each customer. Credit unions are covered by the same requirement through their regulators.
The four minimum data points
Before opening an account, the program must require at least:
- Name
- Date of birth (for individuals)
- Address
- Identification number — for U.S. persons, typically a taxpayer identification number
Verifying identity: documentary and non-documentary
The rule allows verification through documents (such as an unexpired government-issued photo ID), non-documentary methods (such as checking information against consumer reporting agencies or other sources), or both. Your written program describes which you use and when.
The rule also expects the program to address situations where a customer is not physically present — exactly the situation in digital account opening.
Record keeping
Banks must keep the identifying information obtained and a description of how identity was verified, including any discrepancies found and how they were resolved. Those records generally must be kept for five years after the account is closed (identifying information) or five years after the record is made (verification records).
Where remote ID verification fits
A phone-based document and selfie check is a documentary method you can use when the customer isn’t in a branch. Done well, it also produces the evidence your program needs:
- Name, date of birth and document number read from the ID and its barcode
- Images of the document and the live selfie, with a face-match result
- Any discrepancies flagged, and the reviewer’s decision with a timestamp
- A report that can be filed with the member or customer record
How remote verification fits into your program — and which risks call for additional checks — is a decision for your BSA officer and your written policies.
Source: 31 CFR 1020.220, Customer identification program requirements for banks. This article is general information, not legal or compliance advice.
