CIP vs CIF comes down to this: a Customer Identification Program is a federally mandated procedure a bank runs to verify who you are before opening an account, while a Customer Information File is the internal database where the bank stores everything it knows about you across every product you hold. One is a legal requirement created by the USA PATRIOT Act. The other is an operational tool the bank builds for itself. The identity data collected through CIP ends up living in the CIF, which is why the two get confused, but they answer different questions and exist for different reasons.
The Short Comparison
CIP is a process. It happens at a moment in time, at account opening, and it exists because federal law requires it. CIF is a record. It exists for as long as you have a relationship with the bank, and it grows over that entire relationship. CIP asks: can we form a reasonable belief this person is who they say they are? CIF asks: what do we know about this customer, and where is it stored so every department can see it?
Put another way, CIP is the front door that checks your identity when you arrive. The CIF is the filing cabinet behind the door that keeps your identity data alongside your account balances, your service history, your risk rating, and every product you hold with the bank.
What a Customer Identification Program Actually Does
Section 326 of the USA PATRIOT Act directed federal regulators to require every bank to implement written procedures for verifying the identity of anyone opening an account.1U.S. Department of the Treasury. Treasury and Federal Financial Regulators Issue Patriot Act Regulations on Customer Identification The regulation carrying that out is 31 CFR 1020.220, which requires each bank to maintain a written CIP scaled to the bank’s size and type of business.2eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks The program has to be folded into the bank’s broader anti-money-laundering compliance program, and the bank’s board of directors must approve it.3Federal Deposit Insurance Corporation. FFIEC BSA/AML Examination Manual – Customer Identification Program
A small community bank with a local customer base can run simpler procedures than a multinational institution handling high-risk foreign accounts, but nobody gets to skip the framework. Every CIP has to account for the accounts offered, the ways accounts get opened, and the identifying information the bank can realistically obtain from its customer base.3Federal Deposit Insurance Corporation. FFIEC BSA/AML Examination Manual – Customer Identification Program
The Four Data Points
Before opening any account, a bank must collect at least four pieces of information from you:4eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
- Full legal name.
- Date of birth (for individuals, not for business entities).
- A residential or business street address. If you don’t have one, the bank can accept an APO or FPO box, or the street address of a next of kin or other contact person.
- An identification number. For U.S. persons, a taxpayer identification number such as a Social Security number. For non-U.S. persons, a taxpayer identification number, a passport number with country of issuance, an alien identification card number, or another government-issued document number bearing a photograph.
The address requirement trips people up. A standard P.O. box won’t do, but the regulation carves out exceptions for military personnel and individuals without a fixed address.4eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks For a business entity, the bank needs a principal place of business or other physical location.
Verification
Collecting the four data points is only the start. The bank then verifies the information through risk-based procedures designed to form a reasonable belief that it knows your true identity.2eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks Verification usually happens one of two ways. Documentary verification means reviewing an unexpired government-issued photo ID such as a driver’s license or passport. Non-documentary verification means checking your information against consumer reporting agencies, public databases, or other reliable third-party sources, and it’s the common route when accounts are opened online or by phone.
Banks don’t always have to finish verification before you can start using an account. The regulation allows a reasonable window after opening to complete the process, particularly when a customer has applied for a taxpayer identification number but hasn’t received it.4eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks If the bank ultimately cannot verify your identity, its written procedures decide what happens next: deny the account outright, allow limited use while verification continues, close the account, or file a Suspicious Activity Report.5FFIEC BSA/AML InfoBase. Regulatory Requirements – Customer Identification Program
The Notice You’ve Probably Seen
Banks can’t quietly collect this information. The regulation requires them to give you notice, before opening an account, that they’re requesting information to verify your identity.4eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks The wording is familiar: “To help the government fight the funding of terrorism and money laundering activities, Federal law requires all financial institutions to obtain, verify, and record information that identifies each person who opens an account.” It can be posted in the lobby, displayed on the bank’s website, or printed on account applications.
What a Customer Information File Actually Is
A Customer Information File is an internal bank database that consolidates everything the bank knows about you into a single electronic profile, tied to a unique CIF number. No federal regulation dictates its format. It’s a system banks build to manage customer relationships efficiently. Open a checking account, add a savings account later, then take out a car loan, and the CIF links all three products under one identifier so the bank isn’t running three disconnected records for the same person.
The CIF typically holds your contact information, account statuses, product types, tax information, risk ratings, and transaction history. Update your address or phone number and the change propagates across every linked account instead of forcing separate updates for each product. That centralized structure gives every department the same set of facts about you, which is what keeps conflicting or outdated data from floating around inside the bank.
Who Uses the CIF
The unified profile serves nearly every department. Fraud analysts compare current transactions against your historical pattern, so a wire transfer to a country you’ve never done business with stands out against ten years of purely domestic activity. Credit teams look at the depth and history of your existing relationship when evaluating loan applications, not just an external credit score. Customer service representatives pull up your full profile immediately instead of asking you to re-explain your account history on every call. Compliance monitoring systems run CIF data against screening requirements continuously, not just at account opening.
Without a CIF, a bank with millions of customers would have fragmented records scattered across product lines, and every compliance check or customer interaction would require reassembling that data from scratch.
How the Two Fit Together
CIP feeds the CIF, but the CIF grows well beyond what CIP requires. The four data points and the record of how the bank verified them enter the CIF at account opening. From there the CIF keeps accumulating: new accounts, service interactions, transaction histories, internal risk assessments, product changes. CIP is a one-time gate with defined inputs. The CIF is an open-ended record that keeps updating for as long as you’re a customer.
The legal footing differs too. CIP compliance is examined by federal regulators against a specific rule. A CIF is an internal system; regulators care about whether the bank can produce accurate customer records when required, but they don’t prescribe the database’s design.
Who Doesn’t Trigger CIP
Not everyone who walks into a bank triggers the full CIP process. FinCEN’s guidance and the regulation exclude several categories from the definition of “customer”:6FinCEN. FAQs – Final CIP Rule
- Existing customers, if the bank already has a reasonable belief it knows your identity. Opening a second account doesn’t require running CIP again.
- People who never receive banking services. Apply for a loan and get denied, and you were never a “customer” for CIP purposes.
- Agents. If someone with power of attorney opens an account on your behalf, you are the customer, not the agent.
- Acquired loans. Loan participations purchased from third parties, or loans bought from a car dealer or mortgage broker, don’t trigger CIP for the borrowers.
The CIP rule also does not apply to any part of a bank’s operations located outside the United States.6FinCEN. FAQs – Final CIP Rule
How Long the CIP Data Sticks Around
Banks must keep the identifying information collected under CIP for five years after the account is closed. For credit card accounts, the clock starts when the account is closed or becomes dormant. Other CIP records, including descriptions of the documents used for verification and the methods and results of any identity checks, must be retained for five years after the record was created.7GovInfo. 31 CFR 1020.220 Those retention rules apply to the CIP records themselves. What lives in the broader CIF, and for how long, is a matter of the bank’s own recordkeeping practices layered on top of whatever other legal retention obligations apply to specific products.