Who Is Not Required to Be Covered Under the CIP?

Federal rules leave several categories of people, entities, and transactions outside a bank’s Customer Identification Program. Those not required to be covered under the CIP fall into three groups: entities already subject to heavy public oversight, existing customers whose identity the bank has already verified, and financial interactions that don’t create a formal account. The exclusions come from how 31 CFR 1020.100 defines “customer” and “account,” which narrows the identity-verification duty created by Section 326 of the USA PATRIOT Act.¹

Government Bodies and Publicly Listed Companies

The CIP definition of “customer” excludes any person described in 31 CFR 1020.315(b)(2) through (b)(4).¹ That covers three groups:

Any department or agency of the United States, a state, or a political subdivision of a state.
Organizations created under federal, state, or interstate law that exercise governmental authority, such as public utility commissions or transit authorities.
Entities whose common stock or equivalent equity interest is listed on the New York Stock Exchange, the American Stock Exchange, or designated as a NASDAQ National Market Security on the NASDAQ Stock Market.

Government bodies operate under public budgets and legislative oversight, and publicly traded companies already file detailed disclosures with the SEC, so the incremental value of CIP verification is low.²

One detail causes trouble. The NASDAQ carve-out reaches only the NASDAQ National Market tier. Companies on the separate NASDAQ Capital Markets tier, formerly the SmallCap Market, do not qualify.² Treating every NASDAQ ticker as automatically exempt leaves a gap.

Subsidiaries of Listed Companies Are Not Automatically Exempt

For Currency Transaction Report purposes, exempt-person treatment extends to subsidiaries where a listed company owns at least 51 percent of the equity, provided the subsidiary is organized under U.S. or state law.² But the CIP customer exclusion only references paragraphs (b)(2) through (b)(4), and subsidiaries live in paragraph (b)(5).¹ A majority-owned subsidiary of an NYSE-listed parent still has to go through normal CIP when it opens a new bank account, unless another exclusion applies.

Other Regulated Financial Institutions

The “customer” definition separately excludes any financial institution regulated by a federal functional regulator and any bank regulated by a state bank regulator.¹ When a credit union, savings association, or federally regulated broker-dealer opens an account at another bank, the receiving bank doesn’t have to run CIP on that institution. It already answers to its own examiners.

Existing Customers the Bank Has Already Verified

A bank doesn’t have to repeat CIP every time an existing customer opens a new account, provided the bank has a reasonable belief that it already knows the person’s true identity.¹ Rolling over a certificate of deposit, opening a second checking account, or adding an investment product at the same institution all fit. The rule pulls these people out of the “customer” definition, so CIP simply doesn’t apply to the new account.³

The friction point is “reasonable belief.” For accounts predating October 1, 2003, when the CIP rule took effect, a bank can satisfy the standard by showing it had comparable identity-verification procedures in place before the rule was finalized, even if those older procedures didn’t collect the exact data elements the current rule requires.³ Without documentation from the original opening, or without adequate procedures at the time, the exclusion isn’t available and the person has to be treated as a new customer.

Transactions and Accounts Outside the Rule

CIP only kicks in when someone opens an “account,” and that term is defined more narrowly than most people expect. Several ordinary financial interactions sit outside it.

Walk-In Transactions Without a Formal Account

Products and services that don’t create an ongoing banking relationship aren’t “accounts” under the rule. The regulation lists check-cashing, wire transfers, and purchasing a check or money order as examples.¹ Someone who walks in to cash a paycheck and leaves has no continuing relationship with the bank, so CIP doesn’t apply.

That doesn’t mean those visitors escape all scrutiny. Any cash transaction over $10,000 still triggers a Currency Transaction Report under the Bank Secrecy Act, whether the person has an account or not.⁴ Suspicious activity reporting also runs on its own track. Skipping identity verification isn’t the same as skipping monitoring.

ERISA Employee Benefit Plan Accounts

Accounts opened to participate in an employee benefit plan established under the Employee Retirement Income Security Act are excluded from the definition of “account.”¹ The plan sponsor or administrator opens the account, not the individual employees, and the participants and beneficiaries aren’t considered customers of the bank for CIP purposes.⁵

The boundary matters. When an employee leaves and their benefits roll into an individual account at the bank, CIP kicks in at the moment the former employee contacts the bank to claim the funds. Until then, no one has “opened” an account in the regulatory sense.⁶

Acquired Loans and Loan Participations

Loans a bank picks up through a merger, asset purchase, or assumption of liabilities are outside the definition of “account” for CIP.¹ The same is true for loan participations bought from other lenders and loans purchased from car dealers or mortgage brokers.⁵ The original lender already verified identity at origination.

The wrinkle: if a bank uses a car dealer or mortgage broker as its agent to originate loans on the bank’s behalf, the bank is the original lender, not a purchaser. The exclusion doesn’t apply, and the bank has to make sure the agent is running the bank’s CIP.⁵

Trust Beneficiaries

When a bank opens a trust account, the customer is the trust itself. Banks aren’t required to look through trust, escrow, or similar accounts to verify each beneficiary’s identity.⁵ The bank verifies the named accountholder and, based on its risk assessment, may need information about people who control the account, such as a trustee or the grantor of a revocable trust. Beneficiaries who didn’t initiate the relationship stay outside the CIP process.

Businesses That Don’t Have to Maintain a CIP at All

The CIP requirement itself only reaches entities that qualify as “banks” under the Bank Secrecy Act: commercial banks, savings associations, credit unions, trust companies, and private banks. Securities broker-dealers and mutual funds carry separate but similar obligations under their own rules.⁷ A retail store, a tech company, or a payment processor not classified as a financial institution under the BSA has no CIP obligation. The everyday meaning of “financial institution” is broader than the legal one, and businesses sometimes buy compliance procedures the law doesn’t require of them.

What Still Applies When CIP Doesn’t

Relying on any of these exclusions is not the same as ignoring the file. The rule requires banks to retain customer identifying information for five years after the account closes, with verification records kept for five years after they’re created.⁸ A bank treating an entity as exempt should be able to show why, whether that means documenting the qualifying exchange listing or the earlier verification of a longtime customer.

Getting the classification wrong is expensive. Federal regulators can impose civil monetary penalties of up to $1,776,364 per violation for failures related to due diligence requirements, which include CIP deficiencies.⁹ Regulators will issue a mandatory cease and desist order when a bank fails to maintain a reasonably designed BSA/AML compliance program, including CIP, or fails to correct previously identified problems.¹⁰ The exclusions cut administrative burden. They don’t turn off Currency Transaction Reports, suspicious activity reporting, or the recordkeeping that supports both.

1
eCFR. 31 CFR 1020.100 – Definitions
2
eCFR. 31 CFR 1020.315 – Transactions of Exempt Persons
3
Financial Crimes Enforcement Network. Interagency Interpretive Guidance on Customer Identification Program Requirements Under Section 326 of the USA PATRIOT Act
4
FinCEN. Notice to Customers: A CTR Reference Guide
5
Financial Crimes Enforcement Network. FAQs: Final CIP Rule
6
Financial Crimes Enforcement Network. FAQs: Final CIP Rule
7
FFIEC BSA/AML General Definitions. FFIEC BSA/AML General Definitions
8
eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
9
eCFR. 31 CFR 1010.821 – Penalty Adjustment and Table
10
FFIEC. Interagency Guidelines on Enforcement of Bank Secrecy Act/Anti-Money Laundering Requirements