To verify a customer’s identity under federal law, a covered financial institution must collect the customer’s full legal name, date of birth, residential or business address, and an identification number, then confirm that information through documents, database checks, or both before opening the account. The framework comes from the Bank Secrecy Act and the USA PATRIOT Act, and it is implemented through the Customer Identification Program (CIP) rule at 31 C.F.R. ยง 1020.220.1eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks Every covered bank must maintain a written CIP scaled to its size and the type of business it conducts, and every new customer runs through it.
The Four Pieces of Information You Must Collect
Before opening any account, gather these from each customer:
- Full legal name.
- Date of birth, for individuals.
- A residential or business street address for U.S. persons. A P.O. box alone does not satisfy this requirement.
- An identification number: a taxpayer identification number for U.S. persons, or for non-U.S. persons, a passport number, alien identification card number, or another government-issued document number showing nationality or residence.
U.S. citizens and residents typically supply a Social Security Number. Non-citizens without one may use an Individual Taxpayer Identification Number, or a passport number with country of issuance.1eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
When you transcribe information into your systems, match the official document exactly. A spelling mismatch between the ID and the application will flag the account for review and slow everything down.
Documents That Satisfy Verification
For individuals, the CIP regulation looks for unexpired government-issued identification that shows nationality or residence and includes a photograph. A driver’s license or passport is the standard choice. The photo is what ties the physical person to the data on file.1eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
Secondary documents such as utility bills, bank statements, or voter registration cards can corroborate a residential address when a primary document alone leaves a question open. They carry less weight than a government photo ID. Most institutions prefer recent secondary documents, though the regulation does not fix a timeframe.
How to Actually Verify the Information
Verification has two lanes: documentary review and non-documentary checks against outside data. Most programs use both.
On the document side, staff or software inspects the ID for security features such as microprint and holograms that indicate a legitimate government issue. High-resolution uploads through a digital portal have replaced in-person inspection at many institutions, but the analysis is the same.
On the data side, systems cross-reference what the customer submitted against outside records. The Social Security Administration can confirm whether a name and number match. Credit bureau records help confirm that the address and identity details correspond to a real person with a financial history. E-Verify is not part of this process; it is an employment eligibility system that confirms a new hire’s authorization to work in the United States, not a customer identity tool.2U.S. Department of Homeland Security. E-Verify and Form I-9
Knowledge-Based Authentication
Knowledge-based authentication (KBA) pulls from credit histories and public records to generate questions only the real person should answer, such as previous loan amounts or old addresses. The customer has a limited window to respond. Its weakness is that much of the source material is now discoverable through social media and data breaches, which makes KBA vulnerable to fraud.3Experian. What is Knowledge Based Authentication Institutions that still use KBA generally treat it as one layer rather than a standalone gate.
Biometrics and Liveness Detection
Biometric checks connect a living person to the ID on file, usually by comparing a live image of the user’s face against the photo on their government identification. Liveness detection guards against spoofing with a photo or replayed video. Active liveness asks the user to turn their head or smile on camera. Passive liveness analyzes skin texture, depth, and edge artifacts in the background without prompting the user. Passive checks tend to produce a smoother experience and reveal less about what the system is looking for.
Two-Factor Authentication
Two-factor authentication adds a second proof layer, usually a one-time code sent by text or generated by an authenticator app. Even if someone steals a password, they still need control of the device linked to the account. The time-sensitive code ties the person to a pre-verified phone number or device that is hard to replicate remotely.
Resolving Failures
Automated checks usually return a result within seconds. When something does not match, whether a name discrepancy, an expired document, or a watchlist hit, the case goes to a compliance officer for manual review. The applicant then receives either an approval or a notice specifying what went wrong and what can resolve it. Applicants whose verification fails on a technical error or a document quality issue can typically resubmit.
Screening Against OFAC Sanctions
Confirming that someone is who they say they are does not answer whether you are allowed to do business with them. The Office of Foreign Assets Control (OFAC) administers sanctions programs that prohibit transactions with certain individuals, entities, and countries. Every U.S. person and every U.S. business, regardless of industry, must comply.4Office of Foreign Assets Control. OFAC FAQs – Who Must Comply With OFAC Sanctions
Screen customer names against OFAC’s Specially Designated Nationals (SDN) list before establishing the relationship. When a potential match appears, compare available identifying details, not just the name. Look at whether the match is an individual or an organization, whether additional identifiers align, and whether multiple data points corroborate the hit.5Office of Foreign Assets Control. Assessing OFAC Name Matches A last-name-only match is not a valid hit. When the comparison shows genuine similarities across multiple identifiers, contact OFAC’s hotline before proceeding.
Beneficial Owners of Entity Customers
When the customer is a legal entity, FinCEN’s Customer Due Diligence rule requires you to identify and verify the individuals behind it. That means any individual who owns 25 percent or more of the entity, plus anyone who exercises substantial control over it. Verify those individuals using the same procedures you use for individual customers.6eCFR. 31 CFR 1010.230 – Beneficial Ownership Requirements for Legal Entity Customers
The CDD rule also requires written policies that address four things together: verifying customer identity, verifying beneficial ownership for entity customers, understanding the nature and purpose of the customer relationship in order to build a risk profile, and ongoing monitoring to flag suspicious transactions and keep customer information current.7Financial Crimes Enforcement Network. Information on Complying with the Customer Due Diligence (CDD) Final Rule
Recordkeeping, Data Protection, and Disposal
Federal regulations require banks to keep verification records for five years after the account closes. Retained records must include a description of the documents used, the methods and results of any database checks, and how any discrepancies were resolved.1eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
While you hold the records, the Gramm-Leach-Bliley Act requires you to protect the security and confidentiality of nonpublic personal information through administrative, technical, and physical safeguards.8Office of the Law Revision Counsel. 15 USC 6801 – Protection of Nonpublic Personal Information The FTC’s Safeguards Rule adds specifics: designate a qualified individual to oversee the information security program, run risk assessments, and implement protections including encryption and access controls. If a breach involves the unencrypted information of 500 or more consumers, notify the FTC within 30 days of discovery through its online form.9Federal Trade Commission. FTC Safeguards Rule – What Your Business Needs to Know State laws often add their own notification requirements with different timelines.
When the retention period ends, destroy records so they cannot be reconstructed. The FTC’s Disposal Rule requires reasonable measures against unauthorized access during disposal. Burn, pulverize, or shred paper. Destroy or erase electronic media so the data cannot be read or recovered.10eCFR. 16 CFR Part 682 – Disposal of Consumer Report Information and Records If you outsource destruction, vet the vendor through audits, references, or certifications before handing over the material.
Ongoing Duty: The Red Flags Rule
Verification at account opening is only the start. The Red Flags Rule requires financial institutions and certain creditors to maintain a written program for detecting, preventing, and responding to identity theft on an ongoing basis. A business qualifies as a covered creditor if it regularly extends credit, defers payment for goods or services, and either uses consumer reports in credit transactions, furnishes information to credit bureaus, or advances repayable funds.11Federal Trade Commission. Fighting Identity Theft With the Red Flags Rule – A How-To Guide for Business
The program must address several categories of red flags: alerts from fraud detection services or credit bureaus, suspicious documents presented during verification, suspicious personal information such as an address that does not match any known records, unusual account activity after opening, and direct notices from customers or law enforcement about possible identity theft.12Legal Information Institute (LII) / Cornell Law School. 16 CFR Appendix A to Part 681 – Interagency Guidelines on Identity Theft Detection, Prevention, and Mitigation Update the program as new threats appear. A strong baseline identity record from the initial verification is what makes anomalies visible later.
Penalties for Getting It Wrong
Civil penalties under the Bank Secrecy Act reach up to $25,000 per willful violation for general reporting and recordkeeping failures, with a separate violation accruing for each day the problem continues. Violations involving international counter-money-laundering provisions can reach $1,000,000.13Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties
Criminal penalties are more severe. A willful violation can bring up to five years in prison and a $250,000 fine. If the violation is part of a pattern of illegal activity involving more than $100,000 over a 12-month period, the ceiling rises to ten years in prison and a $500,000 fine.14Office of the Law Revision Counsel. 31 USC 5322 – Criminal Penalties The penalties reach both the institution and individual officers, directors, and employees who were involved in or responsible for the violation. Because civil penalties accrue daily, a known compliance gap gets more expensive with each day it remains unaddressed.