Section 326 of the USA PATRIOT Act requires every financial institution to run a Customer Identification Program, known as a CIP, that collects basic identifying information from anyone opening an account, verifies that person’s identity, and checks them against government terrorism watchlists. The statute is codified at 31 U.S.C. 5318(l), and the Treasury Department’s implementing regulations set the minimum standards for what institutions must collect, how they verify it, how long they hold the records, and what happens when the rules are broken.
Which Institutions the Rule Covers
The CIP obligation reaches banks, credit unions, and savings associations, along with broker-dealers in securities, mutual funds, futures commission merchants, and introducing brokers. Treasury issued joint final rules with each relevant federal regulator to fit the requirements to different institution types, but the core duties are the same across the board. If you are opening an account at a U.S.-regulated financial institution, Section 326 almost certainly applies.
Information Collected When You Open an Account
At a minimum, the institution must collect four pieces of identifying information from you before opening the account:
- Your full legal name.
- Your date of birth, if you are an individual.
- A residential or business street address. A P.O. box alone will not satisfy the requirement for most domestic customers.
- An identification number. For U.S. persons, this is typically a Social Security number or taxpayer identification number. For non-U.S. persons, it can be a passport number, alien identification card number, or the number from another government-issued document showing nationality or residence.
These are floors, not ceilings. Many institutions ask for more, particularly on higher-risk accounts. If you have not yet received a taxpayer identification number when you open the account, the institution must have procedures to obtain it within a reasonable time afterward.
How the Institution Verifies Your Identity
Collecting the information is only half the requirement. The institution must also verify it, using documentary methods, non-documentary methods, or both.
Documentary Verification
This is the familiar experience: the institution examines an unexpired government-issued photo ID such as a driver’s license or passport. For someone who is not a U.S. citizen, documents showing nationality or residence that bear a photograph are also acceptable. The institution typically copies the document or records its details, including document type, identification number, place of issuance, and any expiration date.
Non-Documentary Verification
When no physical document is available, or when the institution wants added confidence, it can verify identity through other means. Common approaches include cross-referencing your information against public databases or consumer reporting agency records, or contacting you directly to confirm details. Institutions must also have procedures for the case where they cannot verify a customer’s identity at all, which can include refusing to open the account or closing it after a failed verification.
When Verification Must Happen
The regulations require verification “within a reasonable time after the account is opened” rather than a fixed number of days. Treasury built in that flexibility because different account types and opening channels create different practical constraints. What matters is that the institution has risk-based procedures and follows them consistently. In practice, in-person customers are verified at or before opening, and remote or online applicants within a short window afterward.
Relying on Another Institution’s CIP Work
A bank can rely on another financial institution’s CIP work for a shared customer, but only under strict conditions. The other institution must be subject to its own anti-money-laundering program rules and regulated by a federal agency. It must also sign a contract certifying annually that it has a functioning anti-money-laundering program and will perform the specific CIP steps the relying bank needs. Without that contract and regulatory oversight, the bank must do its own verification.
The Notice You Should Receive
Section 326 explicitly requires that customers get “adequate notice” that the institution is requesting information to verify their identity. The standard language reads: “To help the government fight the funding of terrorism and money laundering activities, federal law requires financial institutions to obtain, verify and record information that identifies each person who opens an account.” Banks post this notice in branches, print it on applications, and display it during online account opening. For joint accounts, every account owner must receive it. The institution has flexibility in how it delivers the notice, but you must see it before the account opens.
Screening Against Terrorism Watchlists
Every institution must check whether a new customer appears on any list of known or suspected terrorists or terrorist organizations provided by a federal agency. This check must happen within a reasonable time after the account is opened. The most prominent list is the Specially Designated Nationals and Blocked Persons (SDN) List, maintained by the Treasury Department’s Office of Foreign Assets Control (OFAC). Individuals and entities on the SDN List have their assets frozen, and U.S. persons are broadly prohibited from doing business with them.
A software flag does not trigger an automatic freeze. OFAC guidance directs the institution to run its own due diligence first, comparing the customer’s full identifying information against the SDN entry’s details. Many flags turn out to be false positives where a name is similar but the other details do not line up. If the institution determines the match is real, it must block the funds by placing them in an interest-bearing account and report the blocked transaction to OFAC within 10 business days.
A blocked-transaction report filed with OFAC for certain designated categories, including designated global terrorists and narcotics traffickers, is treated as simultaneously satisfying the institution’s duty to file a Suspicious Activity Report with FinCEN for the fact of the match. If the surrounding circumstances are independently suspicious beyond the OFAC match itself, a separate SAR covering those additional facts is still required.
Recordkeeping
Institutions must keep detailed records of what they collected and how they verified it. For documentary verification, the record must include the type of document examined, any identification number on it, the place of issuance, and the issuance and expiration dates. For non-documentary methods, the institution records the steps taken and the results.
Retention is long. Records of the identifying information must be kept for five years after the account is closed. Records describing the verification documents and methods must be kept for five years after the record is made. For credit card accounts, the five-year clock starts when the account is closed or goes dormant, whichever comes first.
Business Accounts and Beneficial Ownership
When a business or other legal entity opens an account, Section 326’s CIP requirements apply to the entity itself, and a separate rule reaches further. Under the Customer Due Diligence (CDD) rule, the institution must identify every individual who owns 25 percent or more of the entity’s equity, plus at least one individual with significant day-to-day control, such as a CEO, CFO, or managing member. The institution collects the same core identifying information from each of these individuals as it would from any individual customer.
This CDD beneficial ownership work is a separate obligation from the Corporate Transparency Act’s beneficial ownership information (BOI) reporting to FinCEN, which was largely rolled back for domestic companies in early 2025. The CDD rule sits with the financial institution at account opening; it is not a filing the company itself makes with the government.
Penalties for the Institution
A financial institution that negligently violates Bank Secrecy Act requirements, including CIP rules, faces a civil penalty of up to $500 per violation. Where the negligence forms a pattern, the penalty rises to up to $50,000.
Willful violations are far more serious. The civil penalty is up to the greater of $25,000 or the amount involved in the transaction, capped at $100,000. Repeat violators can face additional penalties of up to three times the profit gained or twice the maximum penalty, whichever is greater. Willful violations can also result in criminal prosecution, with fines up to $250,000 and five years in prison, or up to $500,000 and ten years if the violation is part of a broader pattern of illegal activity involving more than $100,000 in a 12-month period.
Penalties for the Customer
Providing false identity information to a financial institution can constitute bank fraud under federal law, which carries penalties of up to $1,000,000 in fines and 30 years in prison. That ceiling is reserved for the most serious cases involving deliberate schemes to defraud, but even a single act of using a fake ID to open an account can trigger federal prosecution. Beyond the criminal exposure, the institution will close the account and may file a Suspicious Activity Report, which creates a permanent record with federal law enforcement.