Quick Answer
The Customer Identification Program (CIP) generally collects name, date of birth for individuals, address, and an identification number before opening. Verification may occur within a reasonable time before or after opening. Know Your Customer (KYC) requires reasonable diligence to know essential customer facts and the authority of anyone acting for the customer, at opening and during maintenance.
When opening an account, the broker-dealer (BD) has two responsibilities: verify the customer's identity through the Customer Identification Program (CIP) under the USA PATRIOT Act, and learn the essential facts needed to service the account under the Know Your Customer (KYC) rule. Each follows its own timing requirements.
What does the Customer Identification Program (CIP) require?
Legal basis:
- The USA PATRIOT Act customer-identification-program requirement (2001), implemented for broker-dealers
- Part of the firm's overall anti-money laundering (AML) program
When it applies: At account opening. The firm generally collects required identifying information before opening and must verify identity within a reasonable time before or after opening. Verification must enable the firm to form a reasonable belief that it knows the customer's true identity.
What Information Must the Firm Collect?
The firm must collect four pieces of identifying information from every new customer before opening the account:
| Item | Details |
|---|---|
| Name | Legal name of the customer |
| Date of birth | For individuals only (not entities) |
| Physical address | Residential or business address; no P.O. boxes for individuals (APO/FPO is allowed) |
| Taxpayer Identification Number (TIN) | social security number (SSN) or EIN for U.S. persons; passport number and country, alien ID card, or other government-issued photo ID for non-U.S. persons |
How Does the Firm Verify Identity?
Using the collected identifying information, the firm must verify identity within a reasonable time before or after account opening, using one or both of:
- Documentary methods: driver's license, passport, birth certificate, government-issued ID
- Non-documentary methods: credit bureau reports, public records, consumer reporting agency checks, contacting the customer
The firm picks the method that fits the customer's situation, including when the customer cannot appear in person.
Pending verification is different from failed verification. Verification may continue after opening within the permitted reasonable time. If the firm cannot form a reasonable belief about identity, it must follow its written CIP procedures for that situation.
Those procedures should describe when not to open an account, permitted transactions while verification is pending, when to close an account after verification attempts fail, and when to file a Suspicious Activity Report (SAR). A customer acknowledgment cannot override the firm's procedures.
Which Government List Must the Firm Check?
- The CIP must include procedures to check whether a new customer appears on any list of known or suspected terrorists that the Department of the Treasury designates for CIP purposes, within a reasonable time after the account is opened (or sooner if another federal requirement says so)
- No list has been designated for CIP purposes to date. Screening against the Office of Foreign Assets Control (OFAC) Specially Designated Nationals (SDN) list is a separate obligation under OFAC's own regulations, not part of the CIP
- A customer on the SDN list cannot be onboarded, and the firm must follow OFAC procedures (which can include blocking assets and reporting)
What Notice Must the Firm Give the Customer?
- The firm must give the customer adequate notice that information is being collected to verify identity
- Notice is adequate if it generally describes the identification requirements and reaches the customer before the account opens (posted in the branch, included in the account agreement, on the firm's website)
How Long Must the Firm Keep These Records?
| Record | Retention |
|---|---|
| Customer's identifying information | 5 years after the account is closed |
| Verification records (a description of each document relied on, non-documentary check results) | 5 years after the record is made |
Exam Tip: Gotchas
- CIP retention runs after the account is closed, not after the account was opened. A 30-year-old account closed last year still has 5 more years of CIP retention ahead of it.
What does the Know Your Customer rule require?
Standard: The firm must use reasonable diligence, in regard to the opening and maintenance of every account, to know the essential facts concerning every customer and the authority of each person acting on the customer's behalf.
What Counts as Essential Facts?
Essential facts are the facts required to:
- Effectively service the customer's account
- Act in accordance with any special handling instructions on the account
- Understand the authority of each person acting on behalf of the customer (Power of Attorney (POA) holder, trustee, corporate officer, etc.)
- Comply with applicable laws, regulations, and rules
When Does the KYC Rule Apply?
- At the beginning of the broker-customer relationship (account opening)
- On an ongoing basis throughout the relationship
- Triggered regardless of whether the firm makes a recommendation
How Does KYC Differ from Suitability?
| Feature | KYC Rule | Suitability Rule |
|---|---|---|
| Trigger | Opening and maintaining any account | Firm makes a recommendation |
| Focus | Essential facts and authority of persons acting for the customer | Whether a specific recommendation is suitable |
| Applies to a self-directed account? | Yes | No (no recommendation is made) |
| Ongoing? | Yes | Per recommendation |
Exam Tip: Gotchas
- The KYC rule does NOT require a recommendation. A customer who opens a self-directed account still triggers KYC obligations. The suitability rule is the one that requires a recommendation to trigger.
- CIP and KYC are distinct. CIP (USA PATRIOT Act) is about verifying identity with documentary or non-documentary evidence within a reasonable time before or after opening. KYC is about understanding the customer's essential facts and authority on an ongoing basis. A question that asks about verifying a government-issued ID is testing CIP. A question about knowing who can trade in a corporate account is testing KYC.
Think of it this way: CIP is the bouncer at the door checking your ID against a list. KYC is the host who keeps track of who you came with, what you ordered, and whether the kid at your table is actually allowed to order a drink. CIP happens once, at the door. KYC never stops.
What are the most commonly tested CIP and KYC distinctions?
Exam Tip: Gotchas
- "No P.O. boxes" for individual CIP: APO/FPO is fine, but a P.O. box is not a physical address.
- CIP records run from account close, not account open.
- KYC applies without a recommendation. Suitability does not.
- The CIP list check covers only lists Treasury designates for CIP purposes (none designated to date). OFAC SDN screening is a separate obligation under OFAC's own regulations.
What Should You Check on Exam Day?
- Can you name the four CIP data points a firm must collect before opening an account: name, date of birth, physical address, and taxpayer ID?
- Do you know CIP identifying-information retention runs 5 years after the account closes, not after it opened?
- Can you explain why a self-directed account with no recommendation still triggers KYC obligations, while suitability requires a recommendation?
- Do you know a P.O. box is not an acceptable physical address for an individual under CIP, though APO/FPO addresses are?
- Can you explain why the CIP list check covers only lists Treasury designates for CIP purposes, while OFAC Specially Designated Nationals screening is a separate obligation?