US Customer Identification Program: 31 CFR 1020.220 Explained

The customer identification program, or CIP, is the part of US anti-money laundering law that tells a bank how to establish who its customers are before it opens an account. For banks it sits in 31 CFR 1020.220. This guide walks through the rule paragraph by paragraph using the regulation text published by Cornell's Legal Information Institute, then explains a June 2025 order that changed how banks can collect one data point. If you are comparing the US approach with other systems, see our guide to digital identity verification under the UK money laundering regulations.

Who must have a CIP

Paragraph (a)(1) applies to banks that must maintain an anti-money laundering compliance program under 31 U.S.C. 5318(h), 12 U.S.C. 1818(s) or 12 U.S.C. 1786(q)(1). Each must have a written CIP appropriate to its size and type of business, and the CIP must be part of its anti-money laundering program.

Identity verification procedures

Paragraph (a)(2) requires risk-based procedures, applied as far as reasonable and practicable, that let the bank form a reasonable belief that it knows each customer's true identity. The rule names risk factors including account types, the way accounts are opened, available identifying information, and the bank's size, location and customer base.

The minimum information

Under paragraph (a)(2)(i), a bank must obtain at least the following before opening an account:

• Name.
• Date of birth for individuals.
• Address: a street address for individuals (or an APO or FPO box, or the street address of next of kin or another contact person, if the individual has no street address), and a principal place of business or other physical location for non-individuals.
• Identification number: a taxpayer identification number for US persons, and for non-US persons one of several listed government-issued identifiers.

The rule lets a bank open an account for a customer who has applied for but not yet received a taxpayer identification number, if the bank confirms the application and obtains the number within a reasonable time. For credit card accounts, the required information may be obtained from a third-party source before credit is extended.

Verification

Paragraph (a)(2)(ii) requires the bank to verify identity within a reasonable time after the account is opened and to describe when it uses documents, non-documentary methods or both. For individuals, documentary verification means an unexpired government-issued photo identification such as a driver's licence or passport. For entities, it means documents showing existence, such as formation or licensing records, partnership agreements or trust instruments. Non-documentary methods can include contacting the customer, comparing information against consumer reporting agencies or public databases, checking references with other financial institutions, and obtaining financial statements. The procedures must address cases such as a customer with no photo identification, unfamiliar documents, accounts opened without documents or in-person appearance, and other higher-risk circumstances. For non-individual customers, if documentary and non-documentary methods fail, the bank may gather information on people with authority or control over the account, such as signatories.

When verification fails

Paragraph (a)(2)(iii) requires procedures for when the bank cannot form a reasonable belief about a customer's identity: when not to open an account, terms for limited use of an account while verification is under way, when to close an account after failed verification, and when to file a suspicious activity report.

Records, lists and notice

• Recordkeeping (a)(3): keep the identifying information, descriptions of documents relied on, the methods and results of non-documentary or additional verification, and the resolution of substantive discrepancies. Identifying information is kept for five years after the account is closed (for credit card accounts, after closure or dormancy), and the other records for five years from creation.
• Government lists (a)(4): procedures to check whether a customer appears on federal lists of known or suspected terrorists, within a reasonable time after opening or earlier if required, and to follow related federal directives.
• Customer notice (a)(5): adequate notice before the account opens that the bank is requesting identifying information. The rule allows notice in a lobby, online, on applications or in other written or oral form, and gives a sample.

Relying on another institution

Paragraph (a)(6) lets a bank rely on another financial institution, including an affiliate, to perform CIP steps if reliance is reasonable under the circumstances, the other institution is subject to an anti-money laundering program rule and regulated by a federal functional regulator, and it contractually certifies annually that it has a program in place and will perform the required steps. Paragraph (b) allows the federal functional regulator, with the concurrence of the Treasury Secretary, to exempt a bank or type of account by order or regulation.

The June 2025 order on taxpayer identification numbers

According to the Office of the Comptroller of the Currency's Bulletin 2025-15, an order issued on 27 June 2025 by the OCC, FDIC and NCUA with the concurrence of FinCEN exempts banks from the CIP requirement to collect a taxpayer identification number from customers before opening an account, in the situations the order describes. A bank may instead obtain the number from a third-party source. The use of the alternative is optional, and banks can keep collecting the number directly. A bank that uses it must still have written procedures that let it obtain the number before opening the account, rest on its own risk assessment, and apply a risk-based approach to verifying each customer so that it can form a reasonable belief that it knows the customer's true identity. The order applies to all accounts at banks and their subsidiaries under the three agencies' jurisdiction.

Our suggestions for a CIP review

These are Learnsignal's suggestions, not regulator requirements. Compare your written CIP to each paragraph above and mark where your procedure lives. Check that your risk factors match the ones in paragraph (a)(2). Test the cases the rule says must be addressed, such as no photo identification or non-face-to-face opening. Confirm retention periods in your records system. If you rely on a third party for taxpayer identification numbers under the 2025 order, record the conditions you applied. For related due diligence on foreign institutions, see our guide to US correspondent accounts for foreign banks, and for training see Learnsignal CPD.

What we could not confirm

This guide covers the bank CIP rule only. Other types of financial institution, including broker-dealers and mutual funds, have their own CIP rules which we did not review. The text we read did not define customer, account or the exclusions, which sit elsewhere in the chapter, and the Cornell page may not reflect the very latest amendments. We read the OCC bulletin rather than the order itself, and the bulletin does not state an effective date or the full list of situations the order covers. We did not review FinCEN's frequently asked questions on the rule.

Frequently asked questions

What four items must a bank collect for an individual?

Name, date of birth, a residential or business street address (or the alternatives the rule allows), and an identification number, under paragraph (a)(2)(i).

How long must CIP records be kept?

The rule says five years after account closure for the identifying information, and five years from creation for the other records.

Can a bank get a taxpayer identification number from a third party?

According to OCC Bulletin 2025-15, yes under the June 2025 order, as an optional alternative subject to risk-based written procedures.