CIP Policy Drafting
Draft an exam-ready CIP policy covering identity collection, verification, screening, recordkeeping, and governance under Section 326 / 31 CFR 1020.220.
Prerequisites
Gather before drafting:
- Institution profile — charter type, products, channels, footprint, risk assessment
- AML/BSA program — related policies (CDD/EDD, SAR, sanctions)
- Account taxonomy — definitions of "account" and product coverage
- Onboarding procedures — current workflows and system capabilities
Quick Start
- Collect institution profile and existing AML/BSA program details
- Walk through each policy section below in order
- Populate tables with institution-specific data
- Tag uncertain regulatory citations as
[VERIFY]
- Route draft for BSA Officer and board review
Policy Sections
1. Header
Effective date, version, approving authority, policy owner.
2. Purpose and Authority
- Cite Section 326 and 31 CFR 1020.220
- State CIP is mandatory and integrated with BSA/AML program
3. Scope and Definitions
- Covered accounts, channels, customer types
- Narrowly defined exclusions with rule basis cited
- Define "customer," "account," "beneficial owner"
4. Minimum Information Collection
| Customer Type |
Required Data |
Notes |
| Individual |
Name, DOB, residential address, ID number |
Physical address required |
| Entity |
Legal name, principal place of business, EIN/TIN, formation docs |
Identify authorized signers |
| Non-U.S. |
Passport/foreign ID number + country |
Risk-based verification |
5. Verification Methods
| Method |
When Used |
Record |
| Documentary |
Default |
Doc type, issuer, number, expiration |
| Non-documentary |
No suitable docs or higher risk |
Source, date, result, analyst notes |
Documentary checklist: genuine/unaltered, photo matches, name/DOB/address match, unexpired (or approved exception).
Non-documentary options: database/consumer report checks, contact at verified address/phone, references from other FIs, corroborating documents.
6. Entity and Beneficial Ownership
- Verify legal existence (formation docs, good standing, registry)
- Verify identity of authorized individuals
- Collect/verify beneficial ownership per CDD Rule (31 CFR 1010.230)
[VERIFY]
7. Discrepancy Resolution
- Document mismatch and remediation steps
- Escalate unresolved discrepancies
- Refuse/restrict account when identity unverifiable
- Consider SAR referral when warranted
8. Government List Screening
- Screen against OFAC lists before account opening
- Document list sources, tool, match logic, clearance
- Escalation and blocking for true matches
- No customer notice of sanctions match or blocking
9. Risk-Based Enhancements
- Define risk factors and EDD triggers
- Additional verification, senior approval, transaction limits
- Periodic review cadence by risk tier
10. Recordkeeping
- Retain CIP records 5 years after account closure
- Maintain retrievable records for exam/law enforcement
- Define storage format and custody responsibility
11. Customer Notice
Provide CIP notice at or before account opening. Sample (adapt per channel):
To help the government fight the funding of terrorism and money laundering, federal law requires all financial institutions to obtain, verify, and record information that identifies each person who opens an account. We will ask for your name, address, date of birth, and identification number, and may ask to see your driver's license or other identifying documents.
12. Third-Party Reliance
- Written contract with certification of compliant CIP
- Ongoing monitoring and audit rights
- Institution retains ultimate responsibility
13. Training and Governance
- Initial and annual training for relevant staff
- BSA/AML Officer duties and reporting line
- Independent testing cadence and board reporting
14. Review and Change Control
- Annual review minimum
- Board approval for material changes
- Version history and distribution log
Pitfalls
- Exemption creep — do not expand exclusions beyond regulatory text; document rationale for each
- Verification timing — use "reasonable time" in policy; define exact SLAs in procedures only
- Stale citations — confirm all regulatory references are current; tag uncertain sources
[VERIFY]
- Policy isolation — align with broader AML, sanctions, and CDD policies; cross-reference where applicable
- Jurisdiction deviations — mark and get approval for any state- or charter-specific departures
1---2name: cip-policy3description: Drafts a U.S. Customer Identification Program (CIP) policy compliant with USA PATRIOT Act Section 326 and 31 CFR 1020.220. Covers identity collection, verification, OFAC screening, CDD/beneficial ownership, recordkeeping, and governance. Trigger when the user needs to create or update a CIP policy, AML onboarding procedures, or exam-ready Section 326 documentation.4---56# CIP Policy Drafting78Draft an exam-ready CIP policy covering identity collection, verification, screening, recordkeeping, and governance under Section 326 / 31 CFR 1020.220.910## Prerequisites1112Gather before drafting:1314- **Institution profile** — charter type, products, channels, footprint, risk assessment15- **AML/BSA program** — related policies (CDD/EDD, SAR, sanctions)16- **Account taxonomy** — definitions of "account" and product coverage17- **Onboarding procedures** — current workflows and system capabilities1819## Quick Start20211. Collect institution profile and existing AML/BSA program details222. Walk through each policy section below in order233. Populate tables with institution-specific data244. Tag uncertain regulatory citations as `[VERIFY]`255. Route draft for BSA Officer and board review2627## Policy Sections2829### 1. Header3031Effective date, version, approving authority, policy owner.3233### 2. Purpose and Authority3435- Cite Section 326 and 31 CFR 1020.22036- State CIP is mandatory and integrated with BSA/AML program3738### 3. Scope and Definitions3940- Covered accounts, channels, customer types41- Narrowly defined exclusions with rule basis cited42- Define "customer," "account," "beneficial owner"4344### 4. Minimum Information Collection4546| Customer Type | Required Data | Notes |47|---|---|---|48| Individual | Name, DOB, residential address, ID number | Physical address required |49| Entity | Legal name, principal place of business, EIN/TIN, formation docs | Identify authorized signers |50| Non-U.S. | Passport/foreign ID number + country | Risk-based verification |5152### 5. Verification Methods5354| Method | When Used | Record |55|---|---|---|56| Documentary | Default | Doc type, issuer, number, expiration |57| Non-documentary | No suitable docs or higher risk | Source, date, result, analyst notes |5859**Documentary checklist:** genuine/unaltered, photo matches, name/DOB/address match, unexpired (or approved exception).6061**Non-documentary options:** database/consumer report checks, contact at verified address/phone, references from other FIs, corroborating documents.6263### 6. Entity and Beneficial Ownership6465- Verify legal existence (formation docs, good standing, registry)66- Verify identity of authorized individuals67- Collect/verify beneficial ownership per CDD Rule (31 CFR 1010.230) `[VERIFY]`6869### 7. Discrepancy Resolution7071- Document mismatch and remediation steps72- Escalate unresolved discrepancies73- Refuse/restrict account when identity unverifiable74- Consider SAR referral when warranted7576### 8. Government List Screening7778- Screen against OFAC lists **before** account opening79- Document list sources, tool, match logic, clearance80- Escalation and blocking for true matches81- No customer notice of sanctions match or blocking8283### 9. Risk-Based Enhancements8485- Define risk factors and EDD triggers86- Additional verification, senior approval, transaction limits87- Periodic review cadence by risk tier8889### 10. Recordkeeping9091- Retain CIP records **5 years after account closure**92- Maintain retrievable records for exam/law enforcement93- Define storage format and custody responsibility9495### 11. Customer Notice9697Provide CIP notice at or before account opening. Sample (adapt per channel):9899> To help the government fight the funding of terrorism and money laundering, federal law requires all financial institutions to obtain, verify, and record information that identifies each person who opens an account. We will ask for your name, address, date of birth, and identification number, and may ask to see your driver's license or other identifying documents.100101### 12. Third-Party Reliance102103- Written contract with certification of compliant CIP104- Ongoing monitoring and audit rights105- Institution retains ultimate responsibility106107### 13. Training and Governance108109- Initial and annual training for relevant staff110- BSA/AML Officer duties and reporting line111- Independent testing cadence and board reporting112113### 14. Review and Change Control114115- Annual review minimum116- Board approval for material changes117- Version history and distribution log118119## Pitfalls120121- **Exemption creep** — do not expand exclusions beyond regulatory text; document rationale for each122- **Verification timing** — use "reasonable time" in policy; define exact SLAs in procedures only123- **Stale citations** — confirm all regulatory references are current; tag uncertain sources `[VERIFY]`124- **Policy isolation** — align with broader AML, sanctions, and CDD policies; cross-reference where applicable125- **Jurisdiction deviations** — mark and get approval for any state- or charter-specific departures
CaseMark