Before a firm can evaluate suitability or accept an order, it must first answer a fundamental question: who is this customer? The Customer Identification Program (CIP) provides the legal framework for answering that question.
The Legal Foundation
- The USA PATRIOT Act and Treasury implementing regulations require every broker-dealer to establish, document, and maintain a written CIP as part of its anti-money laundering (AML) compliance program
- The goal is to form a reasonable belief that the firm knows the true identity of each customer
- CIP must include risk-based procedures for verifying identity, not a one-size-fits-all checklist
The Four Required Identifying Items
Every CIP must collect these four pieces of information before or at account opening:
| Item | Details |
|---|---|
| Name | Full legal name |
| Date of birth | For individual accounts |
| Address | Residential or business street address (P.O. box alone is not sufficient for individuals) |
| Identification number | SSN or taxpayer ID for U.S. persons; passport number and country of issuance or alien ID number for non-U.S. persons |
Exam Tip: Gotchas
- CIP requires exactly four pieces of identifying information. Not three, not five. The exam may list a set of items and ask which one is NOT required.
- Occupation, income, and net worth are NOT part of CIP. They are collected for suitability purposes, not identity verification.
- A P.O. box is NOT sufficient as an address for individual CIP purposes. The CIP address is the customer's physical residential or business location; a P.O. box may still be used as a separate mailing address. A current street address satisfies CIP even if it is temporary (for example, a recently relocated or extended-stay customer): CIP requires a current, not a permanent, address.
- CIP information must be collected before or at account opening, not after.
- Non-U.S. persons can provide a passport number (with country of issuance) instead of an SSN.
Verification Methods
Once the four items are collected, the firm must verify the customer's identity through one of two methods:
- Documentary methods: Government-issued photo ID (driver's license, passport)
- Non-documentary methods: Database checks, credit bureau reports, public records
Firms are not required to use both methods; either is acceptable as long as the firm forms a reasonable belief about the customer's identity.
Government Lists and OFAC Screening
- CIP must include procedures to check whether a customer appears on any government list of known or suspected terrorists, maintained by the Office of Foreign Assets Control (OFAC)
- This check must be completed within a reasonable period after account opening
- OFAC screening is separate from the identity verification process but is part of the overall CIP requirement
- If a customer appears to match a name on the list, the representative does not proceed on their own: they stop, escalate the potential match to the firm's AML compliance function, hold (do not complete) the account opening or transaction pending that review, and do not tip off the customer that a sanctions match is being investigated
- Resolving and reporting a confirmed match (including any blocking of assets) is handled by the firm's AML/compliance function, not by the representative. The representative's role on a hit is to stop, escalate, and not tip off
Record Retention
| Record Type | Retention Period |
|---|---|
| CIP records | 5 years after the account is closed |
| Verification records | 5 years after the record is made |
Exam Tip: Gotchas
- CIP records must be kept for 5 years after account closure. Verification records are also kept for 5 years, but measured from when the record is made.
- Record retention is "after the account is closed" for CIP identifying information, not "after the record is made." The exam tests this distinction.