Three dates shaped the rule:
- 26 October 2001. The USA PATRIOT Act added 31 U.S.C. 5318(l), the identity duty at account opening.
- 9 May 2003. The final CIP rule (68 FR 25090) followed; banks had to comply by 1 October 2003.
- 27 June 2025. An exemptive order let banks under the OCC, FDIC and NCUA take the taxpayer identification number (TIN) from a third party.
The rule, now 31 CFR 1020.220, is where KYC requirements in the United States begin: identity first, owners and purpose after.
What is a customer identification program (CIP)?
In banking, the meaning of CIP is narrow: the identity part of a bank's AML program under the Bank Secrecy Act (BSA). The statute asks for three procedures: verifying the identity of any person seeking to open an account, where reasonable and practicable; keeping records of the information used; and consulting government lists of known or suspected terrorists (5318(l)(2)). The rule turns them into six paragraphs.
Its sample notice to customers names the purpose: "To help the government fight the funding of terrorism and money laundering activities" ((a)(5)(iii)).
"Customer information program" is a misreading of the name. In India, CIP is the customer identification procedure in Chapter V of the Reserve Bank of India's KYC Directions, 2025 for commercial banks, a different rule.
What are the customer identification program requirements?
Table 1. The CIP rule, paragraph by paragraph (31 CFR 1020.220, as of October 2026).
| Paragraph | What it requires | Timing | Note |
|---|---|---|---|
| (a)(1) Written program | A written CIP appropriate for the bank's size and type of business, inside its AML program | None set | The board approves it through the AML program (FFIEC manual) |
| (a)(2)(i) Customer information | Name, date of birth for an individual, address, identification number | Before opening | TIN for a US person; for others a TIN, passport, alien card or other government photo ID number |
| (a)(2)(i) Address | Residential or business street address; without one, an APO or FPO box or a contact's address | Before opening | An entity gives its principal place of business, a local office or other physical location |
| (a)(2)(i)(B), (C) Exceptions | A TIN applied for but not yet received; credit card accounts | TIN within a reasonable time after opening; for a card, before credit is extended | For a card, the identifying information may come from a third party source |
| (a)(2)(ii) Verification | Risk based procedures: documents, non documentary methods or both | Within a reasonable time after opening | Documents include unexpired government issued photo ID |
| (a)(2)(ii)(C) Added checks | Information on the people with authority or control over an account a non individual customer opens | None set | Only when documents and non documentary methods cannot verify the customer |
| (a)(2)(iii) Lack of verification | Procedures on refusing the account, its use while checks run, closing it and filing a SAR | Part of the written CIP | Applies when the bank cannot form a reasonable belief |
| (a)(3) Records | Identifying information, document details, methods and results, resolved discrepancies | Five years after closing (identifying information) or after the record is made (the rest) | Credit cards: after closing or dormancy |
| (a)(4) Government lists | A check against federal terrorist lists that Treasury designates | Within a reasonable time after opening, or earlier if another federal rule says so | None designated for CIP purposes; OFAC and 314(a) checks are separate duties |
| (a)(5) Customer notice | Adequate notice that the bank asks for identity information | Before opening | Sample wording in (a)(5)(iii) |
| (a)(6) Reliance, optional | Another regulated financial institution performs parts of the CIP and certifies each year by contract | None set | The bank "will not be held responsible" for its failure if reliance was reasonable and the contract and certification exist (68 FR 25090) |
| (b) Exemption, premium finance | Loans by banks and their subsidiaries, to any customer, that pay for property and casualty insurance | Order of 5 October 2020 | Granted by the four banking agencies with FinCEN's concurrence |
| (b) Exemption, TIN | The TIN may come from a third party instead of the customer | Since 27 June 2025 (OCC, FDIC, NCUA) and 31 July 2025 (Federal Reserve) | Optional; TIN only; full TIN before opening; not for banks outside those agencies |
Paragraphs (a)(1) to (a)(5) are mandatory; (a)(6) is optional, and (b) lets regulators grant exemptions. The identity procedures are risk based ((a)(2)).
The government list check in (a)(4) has no list to run. The FFIEC manual (CIP section updated 25 February 2021) says none is designated for CIP purposes, and OFAC and 314(a) checks are separate duties. Since 2025, banks under the OCC, FDIC, NCUA or Federal Reserve may take the TIN from a third party instead of the customer. A bank that does so must still obtain the full number before the account opens (TIN order, p. 8).
How does a bank verify a customer's identity under a CIP?
A bank verifies with documents, non documentary methods or both, and its CIP says when it uses each ((a)(2)(ii)). Non documentary methods include a consumer reporting agency or public database check; they must cover five situations, among them a customer who opens the account without appearing in person.
The address is collected, but no document has to prove it, so proof of address is a bank's own policy.
Picture an applicant (illustrative) opening a checking account in an app at 23:00. No document is seen, so a consumer reporting agency match runs. If the Social Security number belongs to someone else, the account is open but unverified.
What happens when a bank cannot verify a customer?
The written CIP answers in advance: (A) when not to open an account, (B) the terms of use while verification continues, (C) when to close it after attempts fail and (D) when to file a Suspicious Activity Report ((a)(2)(iii)).
Where a bank's onboarding runs on complead, formerly Sanction Scanner, document and biometric checks stay with its identity verification (IDV) provider, and the verified identity goes into the customer risk assessment model. On customer onboarding, KYC checks, screening and adverse media run on the same record in a single request, and each onboard or decline decision is logged there with its evidence.
Who is subject to the CIP rule?
Four rules require a CIP, and FinCEN counts 14,575 institutions under them (Table 2 of its stablecoin CIP proposal, 22 June 2026):
- Banks with a federal functional regulator, 8,623. Credit unions and savings associations count as banks.
- Banks lacking one, 365. Private banks, non federally insured credit unions and certain trust companies are among them, covered since 16 November 2020 (85 FR 57129).
- Broker-dealers, 3,278. 31 CFR 1023.220, enforced on FINRA members through Rule 3310(b); verification before or after opening.
- Mutual funds, 1,355. 31 CFR 1024.220: verification after opening, as for banks.
- Futures commission merchants and introducing brokers, 954. 31 CFR 1026.220: verification before or after opening.
Money services businesses, casinos, insurers, precious metals dealers, card system operators and loan or finance companies run AML programs without a CIP rule, though an MSB's program covers verifying customer identification (31 CFR 1022.210). An adviser CIP, proposed on 21 May 2024 (89 FR 44571), is not final.
Some applicants fall outside the rule's "customer", among them a financial institution with a federal functional regulator and an existing account holder the bank already reasonably believes it knows (31 CFR 1020.100).
How do examiners find a CIP failing?
In its 2026 Annual Regulatory Oversight Report (December 2025), FINRA lists among its AML findings the automatic approval of new accounts "without reasonably verifying the identity of the customer within a reasonable timeframe despite red flags" (p. 14). One red flag it names is a Social Security number tied to another person, "including a deceased individual".
Such an account was never verified as (a)(2)(ii) of the broker-dealer rule requires. A number that belongs to a deceased person is one of the red flags of identity fraud at account opening.
FINRA found that Stash Capital, a broker-dealer, approved about 350 accounts from January 2019 to April 2022 on only the last four digits of a Social Security number. The firm wrongly believed its vendor checked the complete number the CIP rules call for. It accepted a censure and a $450,000 fine for this and other failures, neither admitting nor denying the findings (letter of acceptance, 20 March 2026).
Examiners judge a CIP by its design. The FFIEC manual says isolated or technical violations need not make a CIP inadequate, so the failure to plan against is identity software that opens accounts on a vendor's pass with no written step for results the bank could not verify.
What is the difference between KYC and CIP?
Know your customer (KYC) is the industry's name for all a firm learns about a customer; the CIP is the identity part US law writes down, and KYC verification is that work as a process.
What the CIP leaves out, the CDD Rule adds: the beneficial owners of a legal entity customer (31 CFR 1010.230) and the nature and purpose of the relationship, with ongoing monitoring (31 CFR 1020.210).
Picture a bank opening an account for a two owner company (illustrative). The CIP verifies the company, customer due diligence under the CDD Rule identifies and verifies its owners, and enhanced due diligence (EDD) adds measures if the risk is higher.
Is the CIP rule changing in 2026?
No final rule changed 1020.220 in 2026; its text dates from 16 November 2020.
- 10 April. FinCEN proposed (91 FR 18704) rewording 1020.220(a)(1) and (a)(6)(iii) to "AML/CFT program", changes "not anticipated to establish new obligations"; still a proposal.
- 22 June. FinCEN and the four banking agencies proposed 31 CFR 1033.220, a CIP for payment stablecoin issuers; comments closed on 21 August.
Before the next account opens on a pending check, two answers belong in the written CIP. One is what the customer may do with the account meanwhile; the other is when the bank closes it if verification fails ((a)(2)(iii)(B) and (C)).
Related terms
- KYC verification. The checks that confirm an individual is who they claim to be.
- Customer due diligence. The four measures applied to each customer: identity, owners, purpose and monitoring.
- Proof of address. A document showing where a customer lives; the CIP collects the address without one.
- Identity fraud. Using another real person's identifying details.
- Know your customer (KYC). The industry's name for knowing who a customer is and what risk they bring.
- KYC documents. The papers a firm accepts to verify a person or a company.
How this entry was checked. The author, Onur Taner (Customer Success Manager at complead), wrote it from the rule texts; Ufuk Gürdaş, Compliance Specialist, checks its facts before it is published. Last reviewed: 29 October 2026. Each rule line was read on 28 October 2026 in its own text: 31 CFR 1020.220, 1023.220, 1024.220 and 1026.220, 31 U.S.C. 5318(l), the 2003 final rule, the 2020 premium finance order, the 2025 TIN orders, the FFIEC manual's CIP section, FinCEN's 2026 proposals, FINRA's 2026 oversight report and the Stash Capital letter of acceptance. The app applicant and the two owner company are illustrative.
