A Customer Identification Program (CIP) is required under the BSA for any fintech that opens accounts. This guide explains what CIP requires, what you must collect, and how to build one that holds up to scrutiny.
What Is a Customer Identification Program (CIP)? Requirements for Fintechs
If your fintech opens accounts for customers, you're required to have a Customer Identification Program. This isn't optional, and it's not something you can outsource away. The responsibility sits with you.
What Is a Customer Identification Program (CIP)?
A Customer Identification Program (CIP) is a set of policies, procedures, and controls that a financial institution uses to verify the identity of its customers before opening an account.
CIP is a federal requirement under the Bank Secrecy Act, specifically implemented through the Customer Identification Program rule (31 CFR 1020.220 for banks; similar rules for other covered entities). It was introduced after the USA PATRIOT Act in 2001.
Who Is Required to Have a CIP?
The CIP rule applies to covered financial institutions — which includes banks, credit unions, broker-dealers, mutual funds, and certain other entities. If your fintech operates as a money services business (MSB), or if you operate through a sponsor bank relationship, you're generally subject to CIP requirements.
What Must a CIP Collect?
For Individual Customers:
- Full legal name
- Date of birth
- Residential address (not a P.O. box — a physical street address is required)
- Identification number — SSN for US persons; passport number or other government-issued ID for non-US persons
For Business Customers (Legal Entities):
- Legal business name
- Principal place of business address
- Employer Identification Number (EIN)
- Beneficial ownership information for individuals who own 25% or more of the entity
How Must Identity Be Verified?
Documentary Verification
The customer provides a copy of a government-issued ID with photo: driver's license, passport, state-issued ID card, or military ID.
Non-Documentary Verification
When a customer cannot produce documents, you may verify identity using alternative methods: contacting the customer directly, checking databases (credit bureaus, government records), using third-party identity verification services, or asking security questions.
The Customer Notice Requirement
The CIP rule requires you to notify customers that you are requesting information to verify their identity before the account is opened. A standard CIP notice reads: "To help the government fight the funding of terrorism and money laundering activities, federal law requires all financial institutions to obtain, verify, and record information that identifies each person who opens an account."
How Long Must CIP Records Be Kept?
CIP records must be retained for a minimum of five years after the account is closed.
CIP vs. CDD — What's the Difference?
CIP is the foundation. CDD builds on top of it. Together they form the core of your KYC program.
Common CIP Failures
- Missing one of the four required data fields for a customer
- Accepting P.O. boxes as an address
- Not documenting the verification method used for each customer
- Failing to provide the customer notice before account opening
- Incomplete business customer CIP — missing beneficial ownership data
- Poor record retention — records not maintained for the full five-year period
Frequently Asked Questions
Does CIP apply to every customer, including existing customers?
CIP applies to new account openings. Existing accounts opened before the rule took effect are not retroactively subject to CIP, but institutions are expected to address significant gaps in existing records.
What happens if a customer won't provide the required information?
You cannot open the account. If a prospective customer refuses to provide required identity information, you must decline to establish the relationship.
Can I use a third-party service to fulfill CIP requirements?
Yes. You may rely on another institution or third-party service to fulfill CIP requirements, but the obligation remains with your institution. You must have a written agreement and certification that the third party has a compliant CIP.
Is CIP the same as KYC?
CIP is a component of KYC. KYC is the broader program that includes CIP (identity verification), CDD (understanding the customer relationship), and Enhanced Due Diligence for high-risk customers.
This article is for educational purposes only and does not constitute legal or compliance advice. Regulations vary by jurisdiction and change frequently. Consult a qualified compliance professional or legal counsel for guidance specific to your business.
