A Customer Identification Program, or CIP, is the federally mandated procedure every U.S. bank, credit union, and brokerage uses to confirm who you are before opening an account for you. Under Section 326 of the USA PATRIOT Act and its implementing rule at 31 CFR 1020.220, the institution must collect four specific pieces of identifying information from you and then verify that information within a reasonable time.1eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks The customer identification program requirements exist to keep the financial system from being used for money laundering or terrorist financing, and they apply whether you are opening a checking account, an investment account, or a safety deposit box.
The Four Pieces of Information You Must Provide
Before an account can be opened for you as an individual, the institution has to collect all of the following:1eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
- Your full legal name as it appears on government-issued documents.
- Your date of birth.
- A residential or business street address.
- An identification number. For U.S. persons that means a taxpayer identification number such as a Social Security Number or Employer Identification Number. For non-U.S. persons, it can be a taxpayer ID number, a passport number with country of issuance, an alien identification card number, or another government-issued document number showing nationality or residence.
A standalone P.O. box will not satisfy the address requirement if you have a street address. If you genuinely do not have one, the rule allows two alternatives: an APO or FPO box for military personnel, or the street address of a next of kin or another contact person. Business entities such as corporations, partnerships, and trusts give a principal place of business or other physical location instead of a date of birth, and the institution verifies the entity’s legal existence rather than a birthdate.
Which Institutions Have to Do This
CIP reaches well past traditional banks. Credit unions, savings associations, broker-dealers, mutual funds, futures commission merchants, and introducing brokers all operate under the same obligation to build procedures giving them a reasonable belief they know each customer’s true identity.2Federal Reserve. FAQs: Final CIP Rule Each institution writes its own CIP within the framework the regulation sets out, so the specific documents one bank accepts may not be what another asks for. Federal regulators audit these programs.
How Your Identity Gets Verified
Collecting your four data points is only the first step. The institution then has to verify that the information is genuine, and it can do so with documents, with non-documentary methods, or with a combination of both.
Documentary Verification
For individuals, the regulation points to unexpired government-issued identification that shows nationality or residence and bears a photograph. A driver’s license, passport, or military ID is the standard. The rule uses “may” rather than “must” for any specific document, so the acceptable list is set by each institution’s own CIP.1eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks For entities, acceptable documents include certified articles of incorporation, a government-issued business license, a partnership agreement, or a trust instrument.
Non-Documentary Verification
Banks often supplement document checks with behind-the-scenes verification, and in some situations rely on it entirely. This is common when you open an account online without ever handing over a physical ID. Non-documentary methods include comparing what you provided against consumer reporting agency records, public databases, or references from other financial institutions, and can also involve contacting you directly or requesting a financial statement.3eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
The regulation specifically requires the bank’s non-documentary procedures to address several higher-risk scenarios: when you cannot present an unexpired photo ID, when the bank is unfamiliar with the documents you present, when the account is opened without any documents at all, and when you never appear in person. None of these situations automatically disqualifies you, but each one triggers more thorough checks.
Timing and Temporary Restrictions
The four identifying data points must be collected before the account is opened, but the actual verification can be completed “within a reasonable time” afterward.1eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks Many institutions run automated electronic checks that finish in seconds. When something needs a closer look, your new account may come with temporary limits: caps on withdrawal amounts, blocks on wire transfers, or holds on deposited funds until verification is complete. Each institution’s CIP has to spell out the terms under which you can use the account while verification is still pending.
Screening Against Government Lists
Beyond confirming that you are who you say you are, the CIP has to include procedures for checking whether you appear on any list of known or suspected terrorists issued by a federal agency and designated by Treasury.1eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks This check happens within a reasonable time after the account is opened. It is separate from OFAC sanctions screening against the Specially Designated Nationals list, which most banks also run under a different legal framework.4FFIEC BSA/AML InfoBase. Office of Foreign Assets Control
When Verification Fails
If the institution cannot form a reasonable belief that it knows your true identity, the escalation path is written into its CIP. The regulation requires every program to cover four scenarios: when to refuse to open the account in the first place, the terms of limited use during ongoing verification, when to close the account after failed verification, and when to file a Suspicious Activity Report.1eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
A SAR filing is confidential. Federal law prohibits the institution and its employees from telling you that a report was filed or hinting one exists.5Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority If your application is denied or your new account is closed abruptly without a detailed explanation, that legal prohibition is often why the institution cannot say more.
When CIP Does Not Apply the Same Way
Not every interaction with a financial institution triggers the full CIP process. Several common situations sit outside it:
- You already have an account at the institution. The rule excludes an existing customer as long as the bank has a reasonable belief it knows your true identity, so opening a second account generally does not restart the full collection-and-verification cycle.6Financial Crimes Enforcement Network. FAQs: Final CIP Rule
- One-off services such as cashing a check, sending a wire, or buying a money order when you do not hold an account at that institution.
- Accounts the bank acquires through a merger, acquisition, or purchase of assets. You are not forced to re-verify because your bank was acquired.7FFIEC BSA/AML InfoBase. Assessing Compliance with BSA Regulatory Requirements – Customer Identification Program
- Accounts opened solely to participate in an employer-sponsored ERISA retirement plan.
Business Accounts: Beneficial Ownership
Opening an account for a legal entity such as a corporation, LLC, partnership, or similar structure adds a second layer of identification on top of the entity itself. Under the Customer Due Diligence rule at 31 CFR 1010.230, the institution must identify and verify the entity’s beneficial owners: any individual who directly or indirectly owns 25 percent or more of the equity interests, plus one individual with significant management responsibility such as a CEO, CFO, or managing member.8Financial Crimes Enforcement Network. Exceptive Relief from Requirement to Identify and Verify Beneficial Owners at Each Account Opening
For each beneficial owner the institution collects the same information required from individuals: name, address, date of birth, and an identification number. As of early 2026, FinCEN issued exceptive relief letting institutions collect beneficial ownership information only when an entity first opens an account rather than at every new account opening, unless new facts call the earlier information into question. Ongoing monitoring still applies on a risk basis.
Accounts for Minors
Children rarely carry driver’s licenses, and many do not have a Social Security card in hand. FinCEN has confirmed that because CIP verification is risk-based, institutions have flexibility in how they verify a minor’s identity.9Financial Crimes Enforcement Network. Guidance to Encourage Youth Savings and Address FAQs A bank might accept a student ID, verify the child’s information through a consumer reporting agency or public database, or, in school-based savings programs, have a teacher confirm the student’s identity. The institution’s CIP still has to specify which methods it uses, and verification must happen within a reasonable time after the account is opened.
Red Flags That Can Slow You Down
Banks are not just checking whether your documents match your stated name. Under the FTC’s Red Flags Rule, financial institutions must maintain an identity theft prevention program that watches for warning signs across several categories:10eCFR. 16 CFR Part 681 – Identity Theft Rules
- A consumer reporting agency has flagged the applicant’s file with a fraud alert or credit freeze.
- An ID looks altered, a photo does not match the person, or information conflicts between documents.
- A Social Security Number does not match the date of birth range, the stated address does not match the credit report, or the SSN appears on the Death Master File.
- Requests for new cards immediately after an address change, sudden large transactions on a dormant account, or mail returned as undeliverable while transactions continue.
- A customer, law enforcement, or another institution reports that an account may be fraudulent.
Any of these can trigger additional verification, delay your account opening, or lead to a denial. When a legitimate applicant gets held up, one of these automated checks has usually surfaced a mismatch worth investigating.
How Long Records Are Kept
CIP obligations continue after your account is open. The institution keeps different records for different periods:1eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
- Your basic identifying information (name, address, date of birth, identification number) is retained for five years after the account is closed.
- Documentary verification records (a description of each document, its identification number, place of issuance, and any issuance or expiration dates) are retained for five years from the date the record was made.
- Non-documentary verification records (results of credit bureau checks, database queries, or reference contacts) are retained for five years from the date the verification was performed.
The distinction matters. If you hold an account for 20 years, the bank keeps your name and address on file the entire time plus five more years. But a credit check run at account opening only needs to be retained for five years from that date, regardless of how long the account stays open.