Quick Answer
The Customer Identification Program (CIP) verifies identity at account opening using four data points; Know Your Customer (KYC) captures essential facts and authority on an ongoing basis. Regulation S-P guards nonpublic personal information. Power of Attorney, discretion, and entity documents decide who else may trade, and every Power of Attorney dies with the principal.
The whole unit on one sheet: who the customer is, how you verify it, how you protect the data, and who is allowed to touch the account.
Who Is the Customer: CIP vs. KYC
- Customer Identification Program (CIP): verifies identity at account opening under the USA PATRIOT Act. Collect four items (name, date of birth, physical address, taxpayer ID), then verify by documentary or non-documentary methods and check the Office of Foreign Assets Control (OFAC) Specially Designated Nationals (SDN) list.
- Know Your Customer (KYC): reasonable diligence to know the essential facts and the authority of anyone acting for the customer, on an ongoing basis. Applies even with no recommendation.
- CIP is the bouncer checking your ID once at the door; KYC is the host tracking who you came with, and it never stops.
The One-Liners That Win Points
- CIP verifies identity; KYC understands the customer. An ID check is CIP; knowing who can trade a corporate account is KYC.
- KYC needs no recommendation. Suitability is the rule that requires one.
- No P.O. boxes for individual CIP addresses (APO/FPO is fine).
- CIP records run from account close, not account open.
- Non-resident alien accounts use a passport number and country (or alien ID), not a Social Security Number, and default to 30% withholding unless Form W-8BEN is on file.
- Corporate insiders (directors, executive officers, 10%-or-greater shareholders): the rep flags and routes to the firm's restricted- and control-stock procedures; the rep does not do resale math.
- Full Power of Attorney = trade plus withdraw. Limited (trading) Power of Attorney = trade only. An outside money manager gets a limited one.
- Durable Power of Attorney survives incapacity; non-durable does not. No Power of Attorney survives death: the account freezes.
- Discretion = the three A's (Action, Asset, Amount). Choosing any one without customer contact is discretion, and full discretion needs written customer authorization plus written principal acceptance. Verbal is never enough.
- Time-and-price discretion on a specific named-security order is not full discretion and expires at the end of the business day.
- Tipping off a customer that a Suspicious Activity Report (SAR) was filed is a federal violation. Escalate to the anti-money-laundering (AML) officer; never confront or investigate.
Numbers to Lock In
| Item | Value |
|---|---|
| CIP identifying information required | 4 items (name, date of birth, physical address, taxpayer ID) |
| CIP recordkeeping | 5 years after the account is closed |
| Non-resident alien default withholding | 30% (unless W-8BEN treaty claim) |
| Outside-account consent (pre-existing account) | within 30 calendar days of association |
| Structuring threshold | deposits just under $10,000 |
| SAR filing trigger | transaction at or above $5,000 |
| SAR filing window | 30 calendar days from detection (to 60 if no suspect) |
| SAR retention | 5 years from filing |
| Reg S-P reasonable opt-out opportunity | commonly 30 days from notice delivery |
| Reg S-P breach notification | no later than 30 days after the firm becomes aware |
| Beneficial ownership (Customer Due Diligence Rule) | 25% ownership plus a control person |
Top Gotchas
- CIP retention starts at account close. A decades-old account closed last year still has 5 more years of retention ahead.
- Death revokes every Power of Attorney immediately, durable or not; a trade placed after death (even in good faith) must be reversed. A non-durable Power of Attorney is already gone once the principal is declared incompetent.
- Verbal discretion is never sufficient. Trading on "do what you think is best" without written authorization is unauthorized trading.
- Duplicate statements under the outside-account rule go out only on the employer member's written request, but the associated person's duty to get consent and notify the executing firm is automatic.
- Irrevocable trust uses its own Employer Identification Number, not the grantor's Social Security Number; a revocable trust typically uses the grantor's number while the grantor is alive.
- Corporate margin or options require specific authority in the charter and resolution; a general cash-account resolution will not do.
- Death of a general partner freezes the partnership account pending reconstitution or dissolution.
- No opt-out for Regulation S-P excepted disclosures (service providers, law enforcement, transaction processing); the opt-out right covers only nonaffiliated-third-party sharing for non-exception purposes.
One-Breath Recap
Verify identity once with CIP's four data points, then know your customer's essential facts and authority forever after. Regulation S-P locks down their private data, and every Power of Attorney, trust, corporate resolution, and discretionary grant just answers one question: who else may trade, and within what limits. Death freezes the account, and tipping off is a federal line you never cross.
Need more than the recap? This is a condensed summary. If it is not enough, read the full Customer Screening and Documentation unit for the complete lesson.