Quick Answer
The Customer Identification Program (CIP) requires every broker-dealer to collect name, date of birth, address, and an identification number before or at account opening, then verify identity through documentary or non-documentary methods. The goal is a reasonable belief the firm knows the customer's true identity, not certainty.
Before a firm can evaluate suitability or accept an order, it must first answer a fundamental question: who is this customer? The Customer Identification Program (CIP) provides the legal framework for answering that question.
What Legal Framework Requires a CIP?
- The USA PATRIOT Act and Treasury implementing regulations require every broker-dealer to establish, document, and maintain a written CIP as part of its anti-money laundering (AML) compliance program
- The goal is to form a reasonable belief that the firm knows the true identity of each customer
- CIP must include risk-based procedures for verifying identity, not a one-size-fits-all checklist
- The CIP is one piece of the firm's broader written AML compliance program, which must also be approved in writing by senior management, tested independently, staffed with a designated AML compliance person, and include risk-based ongoing customer due diligence: understanding the purpose of each customer relationship, building a customer risk profile, and monitoring on a risk basis for suspicious activity
What Are the Four Required Identifying Items?
Every CIP must collect these four pieces of information before or at account opening:
| Item | Details |
|---|---|
| Name | Full legal name |
| Date of birth | For individual accounts |
| Address | Residential or business street address (P.O. box alone is not sufficient for individuals) |
| Identification number | SSN or taxpayer ID for U.S. persons; passport number and country of issuance or alien ID number for non-U.S. persons |
Exam Tip: Gotchas
- CIP requires exactly four pieces of identifying information. Not three, not five.
- Occupation, income, and net worth are NOT part of CIP. They are collected for suitability purposes, not identity verification.
- A P.O. box is NOT sufficient as an address for individual CIP purposes. The CIP address is the customer's physical residential or business location; a P.O. box may still be used as a separate mailing address. A current street address satisfies CIP even if it is temporary (for example, a recently relocated or extended-stay customer): CIP requires a current, not a permanent, address.
- CIP information must be collected before or at account opening, not after.
- Non-U.S. persons can provide a passport number (with country of issuance) instead of an SSN.
How Is Identity Verified?
Once the four items are collected, the firm must verify the customer's identity through one of two methods:
- Documentary methods: Government-issued photo ID (driver's license, passport)
- Non-documentary methods: Database checks, credit bureau reports, public records
Firms are not required to use both methods; either is acceptable as long as the firm forms a reasonable belief about the customer's identity.
What Happens on an OFAC List Match?
- CIP must include procedures to check whether a customer appears on any government list of known or suspected terrorists, maintained by the Office of Foreign Assets Control (OFAC)
- This check must be completed within a reasonable period after account opening
- OFAC screening is separate from the identity verification process but is part of the overall CIP requirement
- If a customer appears to match a name on the list, the representative does not proceed on their own: they stop, escalate the potential match to the firm's AML compliance function, hold (do not complete) the account opening or transaction pending that review, and do not tip off the customer that a sanctions match is being investigated
- Resolving and reporting a confirmed match (including any blocking of assets) is handled by the firm's AML/compliance function, not by the representative. The representative's role on a hit is to stop, escalate, and not tip off
How Long Must CIP Records Be Kept?
| Record Type | Retention Period |
|---|---|
| CIP records | 5 years after the account is closed |
| Verification records | 5 years after the record is made |
Exam Tip: Gotchas
- CIP records must be kept for 5 years after account closure. Verification records are also kept for 5 years, but measured from when the record is made.
- Record retention is "after the account is closed" for CIP identifying information, not "after the record is made."
What Should You Check on Exam Day?
- Lock in the four CIP items (name, date of birth, address, ID number) and remember occupation, income, and net worth belong to suitability, not CIP
- Know that a P.O. box alone fails for an individual's CIP address, but a current temporary street address is fine
- On an OFAC hit, the rep's job is only to stop, escalate, and stay silent; resolving the match belongs to AML compliance