CIP Policy Drafting
Draft an exam-ready CIP policy covering identity collection, verification, screening, recordkeeping, and governance under Section 326 / 31 CFR 1020.220.
Prerequisites
Gather before drafting:
- Institution profile — charter type, products, channels, footprint, risk assessment
- AML/BSA program — related policies (CDD/EDD, SAR, sanctions)
- Account taxonomy — definitions of "account" and product coverage
- Onboarding procedures — current workflows and system capabilities
Quick Start
- Collect institution profile and existing AML/BSA program details
- Walk through each policy section below in order
- Populate tables with institution-specific data
- Tag uncertain regulatory citations as
[VERIFY]
- Route draft for BSA Officer and board review
Policy Sections
1. Header
Effective date, version, approving authority, policy owner.
2. Purpose and Authority
- Cite Section 326 and 31 CFR 1020.220
- State CIP is mandatory and integrated with BSA/AML program
3. Scope and Definitions
- Covered accounts, channels, customer types
- Narrowly defined exclusions with rule basis cited
- Define "customer," "account," "beneficial owner"
4. Minimum Information Collection
| Customer Type |
Required Data |
Notes |
| Individual |
Name, DOB, residential address, ID number |
Physical address required |
| Entity |
Legal name, principal place of business, EIN/TIN, formation docs |
Identify authorized signers |
| Non-U.S. |
Passport/foreign ID number + country |
Risk-based verification |
5. Verification Methods
| Method |
When Used |
Record |
| Documentary |
Default |
Doc type, issuer, number, expiration |
| Non-documentary |
No suitable docs or higher risk |
Source, date, result, analyst notes |
Documentary checklist: genuine/unaltered, photo matches, name/DOB/address match, unexpired (or approved exception).
Non-documentary options: database/consumer report checks, contact at verified address/phone, references from other FIs, corroborating documents.
6. Entity and Beneficial Ownership
- Verify legal existence (formation docs, good standing, registry)
- Verify identity of authorized individuals
- Collect/verify beneficial ownership per CDD Rule (31 CFR 1010.230)
[VERIFY]
7. Discrepancy Resolution
- Document mismatch and remediation steps
- Escalate unresolved discrepancies
- Refuse/restrict account when identity unverifiable
- Consider SAR referral when warranted
8. Government List Screening
- Screen against OFAC lists before account opening
- Document list sources, tool, match logic, clearance
- Escalation and blocking for true matches
- No customer notice of sanctions match or blocking
9. Risk-Based Enhancements
- Define risk factors and EDD triggers
- Additional verification, senior approval, transaction limits
- Periodic review cadence by risk tier
10. Recordkeeping
- Retain CIP records 5 years after account closure
- Maintain retrievable records for exam/law enforcement
- Define storage format and custody responsibility
11. Customer Notice
Provide CIP notice at or before account opening. Sample (adapt per channel):
To help the government fight the funding of terrorism and money laundering, federal law requires all financial institutions to obtain, verify, and record information that identifies each person who opens an account. We will ask for your name, address, date of birth, and identification number, and may ask to see your driver's license or other identifying documents.
12. Third-Party Reliance
- Written contract with certification of compliant CIP
- Ongoing monitoring and audit rights
- Institution retains ultimate responsibility
13. Training and Governance
- Initial and annual training for relevant staff
- BSA/AML Officer duties and reporting line
- Independent testing cadence and board reporting
14. Review and Change Control
- Annual review minimum
- Board approval for material changes
- Version history and distribution log
Pitfalls
- Exemption creep — do not expand exclusions beyond regulatory text; document rationale for each
- Verification timing — use "reasonable time" in policy; define exact SLAs in procedures only
- Stale citations — confirm all regulatory references are current; tag uncertain sources
[VERIFY]
- Policy isolation — align with broader AML, sanctions, and CDD policies; cross-reference where applicable
- Jurisdiction deviations — mark and get approval for any state- or charter-specific departures
1---2name: cip-policy3description: Drafts a U.S. Customer Identification Program (CIP) policy compliant with USA PATRIOT Act Section 326 and 31 CFR 1020.220. Covers identity collection, verification, OFAC screening, CDD/beneficial ownership, recordkeeping, and governance. Trigger when the user needs to create or update a CIP policy, AML onboarding procedures, or exam-ready Section 326 documentation.4license: Apache-2.05---67# CIP Policy Drafting89Draft an exam-ready CIP policy covering identity collection, verification, screening, recordkeeping, and governance under Section 326 / 31 CFR 1020.220.1011## Prerequisites1213Gather before drafting:1415- **Institution profile** — charter type, products, channels, footprint, risk assessment16- **AML/BSA program** — related policies (CDD/EDD, SAR, sanctions)17- **Account taxonomy** — definitions of "account" and product coverage18- **Onboarding procedures** — current workflows and system capabilities1920## Quick Start21221. Collect institution profile and existing AML/BSA program details232. Walk through each policy section below in order243. Populate tables with institution-specific data254. Tag uncertain regulatory citations as `[VERIFY]`265. Route draft for BSA Officer and board review2728## Policy Sections2930### 1. Header3132Effective date, version, approving authority, policy owner.3334### 2. Purpose and Authority3536- Cite Section 326 and 31 CFR 1020.22037- State CIP is mandatory and integrated with BSA/AML program3839### 3. Scope and Definitions4041- Covered accounts, channels, customer types42- Narrowly defined exclusions with rule basis cited43- Define "customer," "account," "beneficial owner"4445### 4. Minimum Information Collection4647| Customer Type | Required Data | Notes |48|---|---|---|49| Individual | Name, DOB, residential address, ID number | Physical address required |50| Entity | Legal name, principal place of business, EIN/TIN, formation docs | Identify authorized signers |51| Non-U.S. | Passport/foreign ID number + country | Risk-based verification |5253### 5. Verification Methods5455| Method | When Used | Record |56|---|---|---|57| Documentary | Default | Doc type, issuer, number, expiration |58| Non-documentary | No suitable docs or higher risk | Source, date, result, analyst notes |5960**Documentary checklist:** genuine/unaltered, photo matches, name/DOB/address match, unexpired (or approved exception).6162**Non-documentary options:** database/consumer report checks, contact at verified address/phone, references from other FIs, corroborating documents.6364### 6. Entity and Beneficial Ownership6566- Verify legal existence (formation docs, good standing, registry)67- Verify identity of authorized individuals68- Collect/verify beneficial ownership per CDD Rule (31 CFR 1010.230) `[VERIFY]`6970### 7. Discrepancy Resolution7172- Document mismatch and remediation steps73- Escalate unresolved discrepancies74- Refuse/restrict account when identity unverifiable75- Consider SAR referral when warranted7677### 8. Government List Screening7879- Screen against OFAC lists **before** account opening80- Document list sources, tool, match logic, clearance81- Escalation and blocking for true matches82- No customer notice of sanctions match or blocking8384### 9. Risk-Based Enhancements8586- Define risk factors and EDD triggers87- Additional verification, senior approval, transaction limits88- Periodic review cadence by risk tier8990### 10. Recordkeeping9192- Retain CIP records **5 years after account closure**93- Maintain retrievable records for exam/law enforcement94- Define storage format and custody responsibility9596### 11. Customer Notice9798Provide CIP notice at or before account opening. Sample (adapt per channel):99100> To help the government fight the funding of terrorism and money laundering, federal law requires all financial institutions to obtain, verify, and record information that identifies each person who opens an account. We will ask for your name, address, date of birth, and identification number, and may ask to see your driver's license or other identifying documents.101102### 12. Third-Party Reliance103104- Written contract with certification of compliant CIP105- Ongoing monitoring and audit rights106- Institution retains ultimate responsibility107108### 13. Training and Governance109110- Initial and annual training for relevant staff111- BSA/AML Officer duties and reporting line112- Independent testing cadence and board reporting113114### 14. Review and Change Control115116- Annual review minimum117- Board approval for material changes118- Version history and distribution log119120## Pitfalls121122- **Exemption creep** — do not expand exclusions beyond regulatory text; document rationale for each123- **Verification timing** — use "reasonable time" in policy; define exact SLAs in procedures only124- **Stale citations** — confirm all regulatory references are current; tag uncertain sources `[VERIFY]`125- **Policy isolation** — align with broader AML, sanctions, and CDD policies; cross-reference where applicable126- **Jurisdiction deviations** — mark and get approval for any state- or charter-specific departures
ThomasMoreAI