Customer Identification Program (CIP)
A Customer Identification Program, or CIP, is the United States rule requiring a bank to collect a minimum set of identifying details — name, date of birth for an individual, address and an identification number — before it opens an account, and to verify identity within a reasonable time afterwards. It is not a synonym for KYC.
Also called: CIP rule
A Customer Identification Program is a narrow, technical United States rule, universally shortened to CIP. It requires a bank to obtain, at a minimum, a name, a date of birth for an individual customer, a residential or business address, and an identification number such as a taxpayer identification number, before the account is opened — and then, within a reasonable time after the account is opened, to verify enough of those details to form a reasonable belief that it knows the customer’s true identity. Collection comes first; verification is allowed to follow.
Two details do most of the work. “Reasonable belief” is the standard rather than certainty: verification may be documentary, such as a passport or incorporation papers, or non-documentary, such as comparing the details against independent data sources, and the firm is expected to have decided in advance which methods it uses and when. Second, the process has to leave records behind, retained for the period the rules specify, together with any required checks of the customer against government lists.
Which institutions the rule reaches
The rule is written institution by institution, inside the same Bank Secrecy Act regulations that carry the rest of US anti-money-laundering law. Parallel CIP rules exist for broker-dealers, mutual funds and futures commission merchants, and the version binding one is not the version binding another.
There is no CIP rule for money services businesses. An MSB’s obligation is a written anti-money-laundering program proportionate to its risks, whose policies and internal controls must provide for verifying customer identification to the extent applicable, alongside a designated compliance officer, staff training and independent review. The only prescribed collection of name, date of birth, address and identification number in the MSB rules is for providers and sellers of prepaid access. Otherwise an MSB’s identification duties attach transaction by transaction — the USD 3,000 recordkeeping threshold for transmittals of funds being the familiar one. Designing an MSB onboarding flow around “our CIP” is designing around a rule that does not apply to it.
CIP is not KYC
Satisfying CIP does not make a customer file complete. It says nothing about the beneficial owners behind a corporate account, nothing about expected activity, and nothing about what happens after day one. Those come from customer due diligence and the ongoing monitoring rules, and they are the parts a regulator or a sponsor bank actually probes. KYC is the umbrella; CIP is one panel of it.
In practice
CIP is a specific United States rule and it binds banks, with parallel versions for broker-dealers, mutual funds and futures commission merchants. There is no CIP rule for money services businesses: an MSB owes a written, risk-based anti-money-laundering program instead, with identification duties that attach transaction by transaction. And even for a bank the sequence is often misstated — the identifiers are collected before the account is opened, while verification may follow within a reasonable time after it is open.
Example
A US bank onboards a small company. The required identifiers are collected before the account is opened, and CIP is satisfied once the bank has verified enough of them, within a reasonable time afterwards, to form a reasonable belief that it knows who the customer is. The humans behind the entity, the expected activity, and the review of both over time come from other rules. The CIP box can be ticked while the file is nowhere near complete.
Commonly confused with
| Term | How it differs |
|---|---|
| Know Your Customer | KYC is the international shorthand for the whole practice of knowing a customer; CIP is one named US rule about identity verification at account opening. |
| Customer Due Diligence | CDD covers beneficial ownership, purpose of the relationship and ongoing monitoring; CIP stops at verifying identity before the account opens. |
See also
- Know Your CustomerKnow Your Customer, or KYC, is the process of identifying and verifying a customer before a business relationship starts and keeping that understanding current while it lasts, so a firm knows who it is actually dealing with. Identity verification is the first step of KYC, not the whole of it.
- Customer Due DiligenceCustomer due diligence, or CDD, is the baseline set of checks a regulated firm performs on a customer: who they are, who owns and controls them, and what activity to expect. It is done at onboarding and then kept current for as long as the relationship lasts, with risk rather than a fixed calendar setting when it is revisited.
- Bank Secrecy ActThe Bank Secrecy Act is the 1970 United States statute, heavily amended since, that requires banks, money services businesses and other financial institutions to keep records, register where applicable, report large cash transactions and suspicious activity, and maintain an anti-money-laundering program.
- Know Your BusinessKnow Your Business, or KYB, is the verification of a corporate customer rather than an individual: that the entity legally exists, who owns and controls it, and what it actually does. It is the corporate counterpart to KYC, and the ownership chain is the hard part.