Customer Identification Program (CIP) Rule for US Banks Explained

If you work in or alongside US financial services, the Customer Identification Program, usually shortened to CIP, is the rule that turns "know your customer" into specific items a bank must collect and check before it opens an account. This guide walks through the text of 31 CFR 1020.220, the CIP rule for banks, as shown on the eCFR (the unofficial online version of the Code of Federal Regulations) when we read it on 20 October 2026. It pairs well with our guides to the bank beneficial ownership rule and to KYC and customer due diligence in accountancy practices.

What the CIP rule requires

Under paragraph (a)(1), a bank that must keep an anti-money laundering compliance program must also adopt a written CIP. The program has to suit the bank's size and type of business and form part of its wider AML program. In other words, the rule is not a one-size form: the bank designs the detail, but the minimum content is set by the regulation.

The four identifiers a bank must collect

Before opening an account, paragraph (a)(2)(i)(A) requires the bank to obtain, at a minimum, a name, a date of birth for an individual, an address, and an identification number.

• Address: for an individual, a residential or business street address, or, if there is none, an Army Post Office or Fleet Post Office box number or the address of next of kin or another contact. For a business or other non-individual, the principal place of business, a local office or another physical location.
• Identification number, US persons: a taxpayer identification number.
• Identification number, non-US persons: one or more of a taxpayer identification number, a passport number and country of issuance, an alien identification card number, or the number and country of issuance of another government-issued document showing nationality or residence and bearing a photograph or similar safeguard.

There are two narrow relaxations. A customer who has applied for a taxpayer identification number but not yet received it can still open an account, provided the bank confirms the application was made and obtains the number within a reasonable time. For credit card accounts, the bank may obtain the information from a third-party source before extending credit.

How the bank verifies identity

Paragraph (a)(2)(ii) says verification must happen within a reasonable time after the account is opened, and the CIP must say whether the bank uses documents, non-documentary methods or both.

For individuals, documentary verification means an unexpired government-issued identification showing nationality or residence and bearing a photograph, such as a driver's licence or passport. For companies and other entities, it means documents showing the entity exists, for example formation or licensing records, a partnership agreement or a trust instrument.

Non-documentary methods listed in the text include contacting the customer, comparing the information with a consumer reporting agency or public database, checking references with other financial institutions, and obtaining a financial statement. The CIP must say how the bank handles cases such as a customer with no unexpired photo identification, unfamiliar documents, accounts opened without documents, and accounts opened without the customer being physically present. For non-individual customers where the bank cannot verify identity through those routes, it must obtain information about the individuals who have authority or control over the account, including signatories.

When verification fails

Paragraph (a)(2)(iii) requires procedures for the case where the bank cannot form a reasonable belief that it knows the customer's true identity. They must cover when the bank should not open an account, the terms on which a customer may use an account while verification is pending, when to close an account, and when to file a suspicious activity report. Our guide to the bank SAR rule covers that last step.

Records, retention, list checks and notice

Under (a)(3), the bank must keep the identifying information it collected, a description of any document relied on (type, number, place of issuance and, where relevant, issue and expiry dates), a description of the methods and results of any non-documentary or additional verification, and a description of how any substantive discrepancy was resolved.

Retention differs by record. The identifying information must be kept for five years after the account is closed, while the verification and discrepancy records must be kept for five years after the record is made.

Paragraph (a)(4) requires the bank to check, within a reasonable time after account opening or earlier if another rule requires, whether the customer appears on any federal list of known or suspected terrorists or terrorist organisations designated by the Treasury. Paragraph (a)(5) requires adequate notice to customers, before the account is opened, that the bank is requesting information to verify identity; a lobby sign, website posting or wording on the application can do this.

Reliance on another institution

Paragraph (a)(6) allows reliance on another financial institution, including an affiliate, for some CIP steps. The reliance must be reasonable, the other institution must be subject to an AML program rule and regulated by a federal functional regulator, and it must contractually agree to certify annually that it has an AML program and will perform the specified CIP requirements.

What this means for accountants and advisers: our suggestions

These points are our suggestions, not requirements in the rule. First, expect clients to be asked for the items above when they open or review bank accounts, and tell them early which entity documents are likely to be requested. Second, keep formation documents, ownership information and signatory details in a place you can find quickly. Third, when a client's bank asks for more, treat it as a normal part of the bank meeting its own obligations rather than a sign of suspicion.

What we could not confirm

We read the eCFR text of the rule but not the supervisory guidance, FAQs or examination manuals that banks use to apply it, so this post does not describe how examiners test the program in practice. We did not confirm the separate retention trigger the text sets for credit card accounts, and we have not covered the rules for broker-dealers, mutual funds or other financial institutions, which have their own CIP provisions. The eCFR states that it is unofficial, so anyone relying on the text should check the official Code of Federal Regulations. This post is general information, not legal advice.