What Is a Customer Identification Program?
A Customer Identification Program, known as a CIP, is the written program that Section 1023.220 of Title 31 of the Code of Federal Regulations, known as the CFR, requires a broker-dealer to establish, document, and maintain, appropriate for its size and business. At a minimum, the CIP includes each of the requirements of paragraphs (a)(1) through (a)(5) of the section, and it must be a part of the broker-dealer's anti-money laundering compliance program required under 31 U.S.C. 5318(h).
The CIP rule implements Section 326 of the USA PATRIOT Act. The Department of the Treasury, known as Treasury, and the Securities and Exchange Commission, known as the SEC, jointly issued a final rule on April 30, 2003 to implement Section 326. Under Section 326, Treasury and the SEC issue a rule that, at a minimum, requires broker-dealers to implement reasonable procedures to verify the identity of any person seeking to open an account, to the extent reasonable and practicable, to maintain records of the information used to verify the person's identity, and to determine whether the person appears on any lists of known or suspected terrorists or terrorist organizations provided to brokers or dealers by any government agency.
Section 5318(l) of Title 31 of the United States Code is headed Identification and Verification of Accountholders. It directs the Secretary of the Treasury to prescribe regulations setting forth the minimum standards for financial institutions and their customers regarding the identity of the customer that shall apply in connection with the opening of an account at a financial institution. The regulations must, at a minimum, require financial institutions to implement, and customers (after being given adequate notice) to comply with, reasonable procedures for verifying the identity of any person seeking to open an account to the extent reasonable and practicable, maintaining records of the information used to verify a person's identity, including name, address, and other identifying information, and consulting lists of known or suspected terrorists or terrorist organizations provided to the financial institution by any government agency to determine whether a person seeking to open an account appears on any such list.
Customer Information Required Before an Account Is Opened
The CIP must contain procedures for opening an account that specify identifying information that will be obtained from each customer. Except as permitted by paragraph (a)(2)(i)(B) of the section, the broker-dealer must obtain, at a minimum, the following information prior to opening an account: the customer's name, the date of birth for an individual, an address, and an identification number.
For an individual, the address is a residential or business street address. For an individual who does not have a residential or business street address, the address is an Army Post Office or Fleet Post Office box number, or the residential or business street address of a next of kin or another contact individual. For a person other than an individual, such as a corporation, partnership or trust, the address is a principal place of business, local office or other physical location.
For a U.S. person, the identification number is a taxpayer identification number. For a non-U.S. person, the identification number is one or more of the following: a taxpayer identification number, a passport number and country of issuance, an alien identification card number, or the number and country of issuance of any other government-issued document evidencing nationality or residence and bearing a photograph or similar safeguard. When opening an account for a foreign business or enterprise that does not have an identification number, the broker-dealer must request alternative government-issued documentation certifying the existence of the business or enterprise.
Instead of obtaining a taxpayer identification number from a customer prior to opening an account, the CIP may include procedures for opening an account for a customer that has applied for, but has not received, a taxpayer identification number. In this case, the CIP must include procedures to confirm that the application was filed before the customer opens the account and to obtain the taxpayer identification number within a reasonable period of time after the account is opened.
Accounts and Customers Under the CIP Rule
For purposes of Section 1023.220, an account is a formal relationship with a broker-dealer established to effect transactions in securities, including, but not limited to, the purchase or sale of securities and securities loaned and borrowed activity, and to hold securities or other assets for safekeeping or as collateral. An account does not include an account that the broker-dealer acquires through any acquisition, merger, purchase of assets, or assumption of liabilities, or an account opened for the purpose of participating in an employee benefit plan established under the Employee Retirement Income Security Act of 1974.
A customer is a person that opens a new account, and an individual who opens a new account for an individual who lacks legal capacity or for an entity that is not a legal person. A customer does not include a financial institution regulated by a Federal functional regulator or a bank regulated by a state bank regulator, a person described in Section 1020.315(b)(2) through (4) of the chapter, or a person that has an existing account with the broker-dealer, provided the broker-dealer has a reasonable belief that it knows the true identity of the person.
Verifying the Identity of Each Customer
The CIP must include risk-based procedures for verifying the identity of each customer to the extent reasonable and practicable. The procedures must enable the broker-dealer to form a reasonable belief that it knows the true identity of each customer. The procedures must be based on the broker-dealer's assessment of the relevant risks, including those presented by the various types of accounts maintained by the broker-dealer, the various methods of opening accounts provided by the broker-dealer, the various types of identifying information available and the broker-dealer's size, location and customer base.
The CIP must contain procedures for verifying the identity of each customer, using information obtained in accordance with paragraph (a)(2)(i) of the section, within a reasonable time before or after the customer's account is opened. The procedures must describe when the broker-dealer will use documents, non-documentary methods, or a combination of both methods, as described in paragraph (a)(2)(ii) of the section.
Verification Through Documents
For a broker-dealer relying on documents, the CIP must contain procedures that set forth the documents the broker-dealer will use. For an individual, the documents may include an unexpired government-issued identification evidencing nationality or residence and bearing a photograph or similar safeguard, such as a driver's license or passport. For a person other than an individual, such as a corporation, partnership or trust, the documents may include documents showing the existence of the entity, such as certified articles of incorporation, a government-issued business license, a partnership agreement, or a trust instrument.
Verification Through Non-Documentary Methods
For a broker-dealer relying on non-documentary methods, the CIP must contain procedures that set forth the non-documentary methods the broker-dealer will use. These methods may include contacting a customer, independently verifying the customer's identity through the comparison of information provided by the customer with information obtained from a consumer reporting agency, public database, or other source, checking references with other financial institutions, or obtaining a financial statement.
The broker-dealer's non-documentary procedures must address situations where an individual is unable to present an unexpired government-issued identification document that bears a photograph or similar safeguard, the broker-dealer is not familiar with the documents presented, the account is opened without obtaining documents, the customer opens the account without appearing in person at the broker-dealer, and where the broker-dealer is otherwise presented with circumstances that increase the risk that the broker-dealer will be unable to verify the true identity of a customer through documents.
Additional Verification for Certain Customers
The CIP must address situations where, based on the broker-dealer's risk assessment of a new account opened by a customer that is not an individual, the broker-dealer will obtain information about individuals with authority or control over such account. This verification method applies only when the broker-dealer cannot verify the customer's true identity using the verification methods described in paragraphs (a)(2)(ii)(A) and (B) of the section.
When Identity Cannot Be Verified
The CIP must include procedures for responding to circumstances in which the broker-dealer cannot form a reasonable belief that it knows the true identity of a customer. These procedures should describe when the broker-dealer should not open an account, the terms under which a customer may conduct transactions while the broker-dealer attempts to verify the customer's identity, when the broker-dealer should close an account after attempts to verify a customer's identity fail, and when the broker-dealer should file a Suspicious Activity Report in accordance with applicable law and regulation.
Recordkeeping and Retention
The CIP must include procedures for making and maintaining a record of all information obtained under the procedures implementing paragraph (a) of Section 1023.220. At a minimum, the record must include all identifying information about a customer obtained under paragraph (a)(2)(i), a description of any document that was relied on under paragraph (a)(2)(ii)(A), noting the type of document, any identification number contained in the document, the place of issuance, and if any, the date of issuance and expiration date, a description of the methods and the results of any measures undertaken to verify the identity of a customer under paragraphs (a)(2)(ii)(B) and (C), and a description of the resolution of each substantive discrepancy discovered when verifying the identifying information obtained.
The broker-dealer must retain the records of identifying information about a customer for five years after the account is closed, and the other records for five years after the record is made. In all other respects, the records must be maintained pursuant to the provisions of 17 CFR 240.17a-4.
Comparison With Government Lists
The CIP must include procedures for determining whether a customer appears on any list of known or suspected terrorists or terrorist organizations issued by any Federal government agency and designated as such by Treasury in consultation with the Federal functional regulators. The procedures must require the broker-dealer to make such a determination within a reasonable period of time after the account is opened, or earlier if required by another Federal law or regulation or Federal directive issued in connection with the applicable list. The procedures also must require the broker-dealer to follow all Federal directives issued in connection with such lists.
Customer Notice
The CIP must include procedures for providing customers with adequate notice that the broker-dealer is requesting information to verify their identities. Notice is adequate if the broker-dealer generally describes the identification requirements of the section and provides such notice in a manner reasonably designed to ensure that a customer is able to view the notice, or is otherwise given notice, before opening an account. Depending upon the manner in which the account is opened, a broker-dealer may post a notice in the lobby or on its Web site, include the notice on its account applications or use any other form of oral or written notice.
If appropriate, a broker-dealer may use sample language headed Important Information About Procedures for Opening a New Account. The sample language reads: "To help the government fight the funding of terrorism and money laundering activities, Federal law requires all financial institutions to obtain, verify, and record information that identifies each person who opens an account. What this means for you: When you open an account, we will ask for your name, address, date of birth and other information that will allow us to identify you. We may also ask to see your driver's license or other identifying documents."
Reliance on Another Financial Institution
The CIP may include procedures specifying when the broker-dealer will rely on the performance by another financial institution (including an affiliate) of any procedures of the broker-dealer's CIP, with respect to any customer of the broker-dealer that is opening an account or has established an account or similar business relationship with the other financial institution to provide or engage in services, dealings, or other financial transactions, provided that the reliance is reasonable under the circumstances, the other financial institution is subject to a rule implementing 31 U.S.C. 5318(h) and regulated by a Federal functional regulator, and the other financial institution enters into a contract requiring it to certify annually to the broker-dealer that it has implemented its anti-money laundering program, and that it will perform (or its agent will perform) specified requirements of the broker-dealer's CIP.
The CIP Within the Anti-Money Laundering Program
The CIP is a part of the broker-dealer's anti-money laundering compliance program. Rule 3310 of the Financial Industry Regulatory Authority, known as FINRA, is headed Anti-Money Laundering Compliance Program. Under the rule, each member develops and implements a written anti-money laundering program reasonably designed to achieve and monitor the member's compliance with the requirements of the Bank Secrecy Act (31 U.S.C. 5311, et seq.), known as the BSA, and the implementing regulations promulgated thereunder by the Department of the Treasury. Each member's anti-money laundering program must be approved, in writing, by a member of senior management.
The program must also include appropriate risk-based procedures for conducting ongoing customer due diligence, to include, but not be limited to, understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile, and conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information. Customer information includes information regarding the beneficial owners of legal entity customers, as defined in 31 CFR 1010.230(e).
Nothing in Section 1023.220 relieves a broker-dealer of its obligation to comply with any other provision of the chapter, including provisions concerning information that must be obtained, verified, or maintained in connection with any account or transaction. The identification required for a Currency Transaction Report is set by Section 1010.312, a separate requirement from the CIP.
Exam Relevance
The Securities Industry Essentials examination content outline lists, among the rules of Section 3, Understanding Trading, Customer Accounts and Prohibited Activities, the USA PATRIOT Act with Section 314 – Cooperative Efforts to Deter Money Laundering, Section 326 – Verification of Identification, and Section 352 – Anti-Money Laundering Programs, and it lists 3310 – Anti-money Laundering Compliance Program. Candidates should check the current outline before the examination.
Common Misunderstandings
A CIP applies only to individuals. A customer is a person that opens a new account, and the rule provides addresses and verification documents for a person other than an individual, such as a corporation, partnership or trust.
Any address is acceptable. For an individual, the address is a residential or business street address, and an Army Post Office or Fleet Post Office box number, or the residential or business street address of a next of kin or another contact individual, is for an individual who does not have a residential or business street address.
A social security number is the only identification number. For a U.S. person, the identification number is a taxpayer identification number, and for a non-U.S. person it is one or more of the following: a taxpayer identification number, a passport number and country of issuance, an alien identification card number, or the number and country of issuance of any other government-issued document evidencing nationality or residence and bearing a photograph or similar safeguard.
Identity must be fully verified before the account is opened. The identifying information is obtained prior to opening an account, and the verification is carried out within a reasonable time before or after the customer's account is opened.
Verification always requires a government-issued document. The procedures must describe when the broker-dealer will use documents, non-documentary methods, or a combination of both methods.
A customer without a taxpayer identification number can never open an account. The CIP may include procedures for opening an account for a customer that has applied for, but has not received, a taxpayer identification number, with confirmation that the application was filed and with the number obtained within a reasonable period of time after the account is opened.
A current customer must be verified again for every new account. A customer does not include a person that has an existing account with the broker-dealer, provided the broker-dealer has a reasonable belief that it knows the true identity of the person.
Identifying information is kept for five years from the date the account is opened. The broker-dealer must retain the records of identifying information about a customer for five years after the account is closed, and the other records for five years after the record is made.
Checking a government list is optional. The CIP must include procedures for determining whether a customer appears on any list of known or suspected terrorists or terrorist organizations issued by any Federal government agency and designated as such by Treasury in consultation with the Federal functional regulators.
A broker-dealer can never rely on another firm for CIP procedures. The CIP may include procedures specifying when the broker-dealer will rely on the performance by another financial institution of any procedures of the broker-dealer's CIP, provided the conditions of the rule are met.
The CIP stands apart from the anti-money laundering program. The CIP must be a part of the broker-dealer's anti-money laundering compliance program required under 31 U.S.C. 5318(h).
Key Points to Retain
A CIP is the written program that a broker-dealer must establish, document, and maintain, appropriate for its size and business, and it must be a part of the broker-dealer's anti-money laundering compliance program.
Before opening an account, the broker-dealer must obtain, at a minimum, the name, the date of birth for an individual, an address, and an identification number.
The CIP must include risk-based procedures for verifying the identity of each customer to the extent reasonable and practicable, enabling the broker-dealer to form a reasonable belief that it knows the true identity of each customer.
Verification takes place within a reasonable time before or after the account is opened, through documents, non-documentary methods, or a combination of both.
The CIP must include procedures for responding to circumstances in which the broker-dealer cannot form a reasonable belief that it knows the true identity of a customer, including when to close an account and when to file a Suspicious Activity Report.
Records of identifying information are retained for five years after the account is closed, and the other CIP records for five years after the record is made.
The CIP must include procedures for determining whether a customer appears on any list of known or suspected terrorists or terrorist organizations designated as such by Treasury.
The CIP must include procedures for providing customers with adequate notice that the broker-dealer is requesting information to verify their identities.
