Customer Screening: CIP, KYC, and Entity Documents

What Must a Customer Identification Program Collect and Verify?

• A broker-dealer's written customer identification program (CIP) is part of its anti-money-laundering compliance program.
• Before opening an account, the firm must obtain, at minimum:
  • Name
  • Date of birth, for an individual
  • Address: for an individual, a residential or business street address, or, if they have neither, an Army Post Office or Fleet Post Office box number or the street address of a next of kin or other contact. For an entity, a principal place of business, local office, or other physical location
  • Identification number: a taxpayer identification number for a U.S. person. For a person who is not a U.S. person, one or more of a taxpayer identification number, a passport number with its country of issuance, an alien identification card number, or the number and country of issuance of another government-issued document showing nationality or residence and bearing a photograph or similar safeguard
• The firm then verifies each customer's identity, within a reasonable time before or after the account opens, using:
  • Documents: for an individual, an unexpired government-issued identification document, such as a driver's license or passport; for an entity, documents showing the entity exists, such as certified articles of incorporation, a government-issued business license, a partnership agreement, or a trust instrument
  • Non-documentary methods: contacting the customer directly, independently verifying identity by comparing the customer's information against a consumer reporting agency, a public database, or another source, checking references with other financial institutions, or obtaining a financial statement
  • A combination of both
• One exception to the collect-before-opening rule. Instead of obtaining a taxpayer identification number before the account opens, the program may allow an account to open for a customer who has applied for one but not yet received it. The firm confirms the application was filed before the account opened, and obtains the number within a reasonable period afterward.
• A fallback when neither method works. Where the firm's risk assessment of a new entity account calls for it, the program must address obtaining information about the individuals with authority or control over the account. That step applies only when documents and non-documentary methods both fail to verify the customer's true identity.
• What to do when identity cannot be verified. The program must include procedures for this case. Having them is mandatory. Their contents are stated more softly: the rule says those procedures should describe when the firm should decline to open the account, on what terms a customer may transact while verification continues, when to close an account after attempts fail, and when to file a suspicious activity report.
• For a corporate customer, articles of incorporation are one of the entity-existence documents a firm reviews under its CIP, alongside a business license or a partnership agreement for other entity types.

What Else Must the Program Include Besides Collection and Verification?

Collecting and verifying identity, and keeping the records, are three of the program's five required parts. Two more are easy to overlook:

• Comparison with government lists. The program must include procedures for determining whether a customer appears on any list of known or suspected terrorists or terrorist organizations that a federal government agency issues and the Treasury designates. The firm makes that determination within a reasonable period after the account opens, or earlier if another federal law, regulation, or directive requires it.
• Customer notice. The program must include procedures for giving customers adequate notice that the firm is requesting information to verify their identities. Notice is adequate if it generally describes the identification requirements and reaches the customer, by a means reasonably designed to let the customer see it, before the account opens. A lobby posting, a website notice, or wording on the account application can each serve.

Exam Tip: Gotchas

• CIP information, meaning name, date of birth, address, and identification number, must be obtained before the account opens. Identity verification can happen within a reasonable time before or after that. Collected and verified are not the same checkpoint.

• The collect-before-opening rule is not absolute. A customer who has applied for a taxpayer identification number but not yet received it can still have an account opened, if the firm confirms the application was filed first and obtains the number within a reasonable period afterward.

How Long Must CIP Records Be Kept?

• The record of a customer's identifying information is kept for five years after the account closes.
• Three other records are kept for five years after the record is made:
  • A description of any document the firm relied on, including its type, identification number, place and date of issue, and expiration date
  • A description of the verification methods used and their results
  • A description of how any substantive discrepancy was resolved
• Retention runs from two different starting points, so a question that anchors every CIP record to account closure is testing whether you know the split.

What Does the Know-Your-Customer Rule Require?

• The know-your-customer rule requires a firm to use reasonable diligence, when opening and maintaining every account, to know and retain the essential facts about every customer and about the authority of each person acting on that customer's behalf.
• Facts are essential when they are needed to:
  • Effectively service the customer's account
  • Follow any special handling instructions for the account
  • Understand the authority of each person acting on the customer's behalf
  • Comply with applicable laws, regulations, and rules

Exam Tip: Gotchas

• CIP and the know-your-customer duty are not the same obligation. CIP is the identity-collection-and-verification step performed around account opening. The know-your-customer duty is the broader, ongoing duty to know the essential facts about the customer and about who is authorized to act for them.

When Must a Representative Escalate Suspicious Activity?

• If information gathered while screening a customer or reviewing account documentation suggests suspicious activity, a representative escalates it to a supervisor rather than resolving it independently.

What Should You Check on Exam Day?

• Count both lists: four identifying items obtained before the account opens, inside a five-part program that also compares customers against government terrorist lists and gives customer notice.
• Separate identity collection, required before opening, from identity verification, allowed within a reasonable time before or after.
• Track the CIP retention split: identifying information for five years after the account closes, the other three records for five years after the record is made.
• Confirm whether a question tests CIP identity collection or the know-your-customer duty's ongoing essential facts, not the same obligation.
• Remember a representative escalates suspicious activity to a supervisor rather than resolving it independently.