Contents
Introduction
The Customer Identification Program (CIP) is the foundational building block of anti-money laundering (AML) compliance in the United States. It is not a voluntary best practice but a mandatory legal obligation that every bank, broker-dealer, money services business, and other covered financial institution must implement. The CIP requires these institutions to “form a reasonable belief” that they know the true identity of every customer before opening an account or establishing a business relationship. While often discussed alongside Know Your Customer (KYC) and Customer Due Diligence (CDD), the CIP is distinct: it is the specific, congressionally mandated process for identity verification at the point of onboarding, whereas KYC is the broader ongoing risk-management framework.
Legal Authority: Section 326 of the USA PATRIOT Act
The CIP requirement originates from Section 326 of the USA PATRIOT Act of 2001, which amended the Bank Secrecy Act (BSA). Section 326 directed the Secretary of the Treasury to prescribe minimum standards for financial institutions relating to the identity of customers. The implementing regulation is codified at 31 C.F.R. § 1020.220 (for banks) and parallel provisions for other sectors, enforced by the Financial Crimes Enforcement Network (FinCEN) and the federal banking agencies. The rule requires a written CIP that is appropriate for the institution’s size and type of business and that includes, at a minimum, the following components.
The Four Pillars of a Compliant CIP
1. Collection of Required Customer Information
Before opening an account, the institution must obtain four core data elements from every customer: name, date of birth (for individuals), address (a physical street address, not a P.O. box), and an identification number. For a U.S. person, the identification number is typically a Taxpayer Identification Number (TIN). For a non-U.S. person, acceptable identifiers include a TIN, passport number and country of issuance, alien identification card number, or another government-issued document evidencing nationality or residence and bearing a photograph. FinCEN has recently granted a limited exemption allowing banks, under certain conditions, to obtain TIN information from a third-party source rather than directly from the customer, reflecting the evolving nature of digital onboarding.
2. Identity Verification (Risk-Based)
Collecting information is insufficient; the institution must verify it using risk-based procedures. The CIP must describe when the institution will use documentary methods (e.g., reviewing a government-issued photo ID), non-documentary methods (e.g., cross-referencing data against credit bureaus, public databases, or government registries), or a combination of both. The chosen methods must be calibrated to the institution’s assessment of the relevant risks—such as the type of account, the method of opening (in-person versus online), and the customer’s profile—to enable the institution to form a reasonable belief that it knows the customer’s true identity.
3. Recordkeeping
The CIP must include procedures for retaining records of the identifying information obtained and the verification methods used. For documentary verification, the institution must record the type of document, its number, the place of issuance, and, if applicable, issuance and expiration dates. For non-documentary verification, it must record the methods and results. These records must generally be retained for five years after the account is closed.
4. Comparison with Government Lists
The CIP must include procedures for determining whether a customer appears on any federal government list of known or suspected terrorists or terrorist organizations, such as the OFAC Specially Designated Nationals (SDN) list. This screening must occur within a reasonable time after the account is opened.
5. Customer Notice
Finally, the CIP must include procedures for providing customers with adequate notice that the institution is requesting information to verify their identities. The notice is adequate if it generally describes the identification requirements and is provided in a manner reasonably designed to ensure the customer can view or receive it before the account is opened.
Beneficial Ownership: The CDD Overlay
The CIP is focused on identifying the customer—the individual or legal entity opening the account. However, the separate Customer Due Diligence (CDD) Rule (31 C.F.R. § 1010.230) imposes an additional obligation for legal entity customers: the institution must identify and verify the identity of beneficial owners—natural persons who own or control 25% or more of the entity, as well as one individual with significant managerial control. While beneficial ownership is a CDD requirement rather than a strict CIP element, the verification of each beneficial owner’s identity must be conducted using the same CIP standards for individuals. The distinction matters: CIP verifies the account holder; CDD digs deeper into the ownership structure behind a corporate customer.
The CKYC Contrast: A U.S. Perspective
The term CKYC (Central KYC) most commonly refers to India’s Central KYC Records Registry (CKYCR), operated by CERSAI. In the Indian model, a regulated entity completes KYC and uploads a standardized record to a centralized registry, which assigns a unique KYC Identifier (KIN). With appropriate consent, another eligible institution can retrieve that valid record instead of requesting the same documents again, reducing duplication and friction in customer onboarding.
It is critical to state clearly: the United States has no equivalent nationwide, government-backed CKYCR that assigns every customer a reusable KYC number. The U.S. CIP framework is institution-centric and account-opening-focused. Each covered financial institution must maintain its own written CIP, collect the four core elements, verify identity according to its own risk-based procedures, and retain its own records. There is no centralized U.S. registry from which a bank can pull a “CIP number” to satisfy its obligations. While U.S. fintechs may build “unified KYC” workflows that coordinate identity collection, verification, sanctions screening, and risk classification across systems, such workflows are internal or vendor-driven operational tools—they are not participation in a statutory central registry.
Enforcement and Penalties
Failure to implement or adhere to a compliant CIP carries significant consequences. Civil money penalties can reach $250,000 per violation** (and in some contexts, up to **$1 million per violation), along with cease-and-desist orders and potential loss of regulatory licenses. Enforcement actions are not theoretical. The SEC has repeatedly sanctioned broker-dealers and investment advisers for CIP and CDD failures—for example, LPL Financial settled charges related to its failure to comply with its own CIP and CDD obligations between 2019 and 2023, and other firms have faced multi-million-dollar penalties for deficient AML controls. FinCEN and the federal banking agencies prioritize CIP compliance in BSA examinations, and operating a financial institution without an adequate CIP can even trigger criminal exposure under 18 U.S.C. § 1960.
Conclusion
The U.S. CIP is a prescriptive, four-pillar mandate: collect the required data, verify it on a risk basis, keep the records, screen against government lists, and tell the customer what you are doing. It is narrower than KYC but non-negotiable as the gateway to the financial system. The absence of a CKYC-style central registry in the United States means that the burden of identity verification rests squarely on each institution’s written program, its risk assessment, and its ability to demonstrate to examiners that it has formed a reasonable belief about who its customers truly are. In an era of increasing digital onboarding and evolving FinCEN exemptions, the core principle remains unchanged: no CIP, no compliant account.