CIP Policy Drafting
Draft an exam-ready CIP policy covering identity collection, verification, screening, recordkeeping, and governance under Section 326 / 31 CFR 1020.220.
Prerequisites
Gather before drafting:
- Institution profile — charter type, products, channels, footprint, risk assessment
- AML/BSA program — related policies (CDD/EDD, SAR, sanctions)
- Account taxonomy — definitions of "account" and product coverage
- Onboarding procedures — current workflows and system capabilities
Quick Start
- Collect institution profile and existing AML/BSA program details
- Walk through each policy section below in order
- Populate tables with institution-specific data
- Tag uncertain regulatory citations as
[VERIFY]
- Route draft for BSA Officer and board review
Policy Sections
1. Header
Effective date, version, approving authority, policy owner.
2. Purpose and Authority
- Cite Section 326 and 31 CFR 1020.220
- State CIP is mandatory and integrated with BSA/AML program
3. Scope and Definitions
- Covered accounts, channels, customer types
- Narrowly defined exclusions with rule basis cited
- Define "customer," "account," "beneficial owner"
4. Minimum Information Collection
| Customer Type |
Required Data |
Notes |
| Individual |
Name, DOB, residential address, ID number |
Physical address required |
| Entity |
Legal name, principal place of business, EIN/TIN, formation docs |
Identify authorized signers |
| Non-U.S. |
Passport/foreign ID number + country |
Risk-based verification |
5. Verification Methods
| Method |
When Used |
Record |
| Documentary |
Default |
Doc type, issuer, number, expiration |
| Non-documentary |
No suitable docs or higher risk |
Source, date, result, analyst notes |
Documentary checklist: genuine/unaltered, photo matches, name/DOB/address match, unexpired (or approved exception).
Non-documentary options: database/consumer report checks, contact at verified address/phone, references from other FIs, corroborating documents.
6. Entity and Beneficial Ownership
- Verify legal existence (formation docs, good standing, registry)
- Verify identity of authorized individuals
- Collect/verify beneficial ownership per CDD Rule (31 CFR 1010.230)
[VERIFY]
7. Discrepancy Resolution
- Document mismatch and remediation steps
- Escalate unresolved discrepancies
- Refuse/restrict account when identity unverifiable
- Consider SAR referral when warranted
8. Government List Screening
- Screen against OFAC lists before account opening
- Document list sources, tool, match logic, clearance
- Escalation and blocking for true matches
- No customer notice of sanctions match or blocking
9. Risk-Based Enhancements
- Define risk factors and EDD triggers
- Additional verification, senior approval, transaction limits
- Periodic review cadence by risk tier
10. Recordkeeping
- Retain CIP records 5 years after account closure
- Maintain retrievable records for exam/law enforcement
- Define storage format and custody responsibility
11. Customer Notice
Provide CIP notice at or before account opening. Sample (adapt per channel):
To help the government fight the funding of terrorism and money laundering, federal law requires all financial institutions to obtain, verify, and record information that identifies each person who opens an account. We will ask for your name, address, date of birth, and identification number, and may ask to see your driver's license or other identifying documents.
12. Third-Party Reliance
- Written contract with certification of compliant CIP
- Ongoing monitoring and audit rights
- Institution retains ultimate responsibility
13. Training and Governance
- Initial and annual training for relevant staff
- BSA/AML Officer duties and reporting line
- Independent testing cadence and board reporting
14. Review and Change Control
- Annual review minimum
- Board approval for material changes
- Version history and distribution log
Pitfalls
- Exemption creep — do not expand exclusions beyond regulatory text; document rationale for each
- Verification timing — use "reasonable time" in policy; define exact SLAs in procedures only
- Stale citations — confirm all regulatory references are current; tag uncertain sources
[VERIFY]
- Policy isolation — align with broader AML, sanctions, and CDD policies; cross-reference where applicable
- Jurisdiction deviations — mark and get approval for any state- or charter-specific departures
1---2name: cip-policy3description: >-4 Drafts a U.S. Customer Identification Program (CIP) policy compliant with5 USA PATRIOT Act Section 326 and 31 CFR 1020.220. Covers identity collection,6 verification, OFAC screening, CDD/beneficial ownership, recordkeeping, and7 governance. Trigger when the user needs to create or update a CIP policy,8 AML onboarding procedures, or exam-ready Section 326 documentation.9tags:10 - drafting11 - regulatory12 - research13---1415# CIP Policy Drafting1617Draft an exam-ready CIP policy covering identity collection, verification, screening, recordkeeping, and governance under Section 326 / 31 CFR 1020.220.1819## Prerequisites2021Gather before drafting:2223- **Institution profile** — charter type, products, channels, footprint, risk assessment24- **AML/BSA program** — related policies (CDD/EDD, SAR, sanctions)25- **Account taxonomy** — definitions of "account" and product coverage26- **Onboarding procedures** — current workflows and system capabilities2728## Quick Start29301. Collect institution profile and existing AML/BSA program details312. Walk through each policy section below in order323. Populate tables with institution-specific data334. Tag uncertain regulatory citations as `[VERIFY]`345. Route draft for BSA Officer and board review3536## Policy Sections3738### 1. Header3940Effective date, version, approving authority, policy owner.4142### 2. Purpose and Authority4344- Cite Section 326 and 31 CFR 1020.22045- State CIP is mandatory and integrated with BSA/AML program4647### 3. Scope and Definitions4849- Covered accounts, channels, customer types50- Narrowly defined exclusions with rule basis cited51- Define "customer," "account," "beneficial owner"5253### 4. Minimum Information Collection5455| Customer Type | Required Data | Notes |56|---|---|---|57| Individual | Name, DOB, residential address, ID number | Physical address required |58| Entity | Legal name, principal place of business, EIN/TIN, formation docs | Identify authorized signers |59| Non-U.S. | Passport/foreign ID number + country | Risk-based verification |6061### 5. Verification Methods6263| Method | When Used | Record |64|---|---|---|65| Documentary | Default | Doc type, issuer, number, expiration |66| Non-documentary | No suitable docs or higher risk | Source, date, result, analyst notes |6768**Documentary checklist:** genuine/unaltered, photo matches, name/DOB/address match, unexpired (or approved exception).6970**Non-documentary options:** database/consumer report checks, contact at verified address/phone, references from other FIs, corroborating documents.7172### 6. Entity and Beneficial Ownership7374- Verify legal existence (formation docs, good standing, registry)75- Verify identity of authorized individuals76- Collect/verify beneficial ownership per CDD Rule (31 CFR 1010.230) `[VERIFY]`7778### 7. Discrepancy Resolution7980- Document mismatch and remediation steps81- Escalate unresolved discrepancies82- Refuse/restrict account when identity unverifiable83- Consider SAR referral when warranted8485### 8. Government List Screening8687- Screen against OFAC lists **before** account opening88- Document list sources, tool, match logic, clearance89- Escalation and blocking for true matches90- No customer notice of sanctions match or blocking9192### 9. Risk-Based Enhancements9394- Define risk factors and EDD triggers95- Additional verification, senior approval, transaction limits96- Periodic review cadence by risk tier9798### 10. Recordkeeping99100- Retain CIP records **5 years after account closure**101- Maintain retrievable records for exam/law enforcement102- Define storage format and custody responsibility103104### 11. Customer Notice105106Provide CIP notice at or before account opening. Sample (adapt per channel):107108> To help the government fight the funding of terrorism and money laundering, federal law requires all financial institutions to obtain, verify, and record information that identifies each person who opens an account. We will ask for your name, address, date of birth, and identification number, and may ask to see your driver's license or other identifying documents.109110### 12. Third-Party Reliance111112- Written contract with certification of compliant CIP113- Ongoing monitoring and audit rights114- Institution retains ultimate responsibility115116### 13. Training and Governance117118- Initial and annual training for relevant staff119- BSA/AML Officer duties and reporting line120- Independent testing cadence and board reporting121122### 14. Review and Change Control123124- Annual review minimum125- Board approval for material changes126- Version history and distribution log127128## Pitfalls129130- **Exemption creep** — do not expand exclusions beyond regulatory text; document rationale for each131- **Verification timing** — use "reasonable time" in policy; define exact SLAs in procedures only132- **Stale citations** — confirm all regulatory references are current; tag uncertain sources `[VERIFY]`133- **Policy isolation** — align with broader AML, sanctions, and CDD policies; cross-reference where applicable134- **Jurisdiction deviations** — mark and get approval for any state- or charter-specific departures
lev-os